# Waterlock RHEL IDM Auth

Fork of [https://github.com/waterlock/waterlock-ldap-auth](https://github.com/waterlock/waterlock-ldap-auth)

waterlock-rhel-idm-auth is a module for [waterlock](http://waterlock.ninja/)
providing a LDAP authentication method for users based on customizeable LDAP
queries. It uses [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) to
faciliate LDAP authentication.

## Usage

```bash
npm install waterlock-rhel-idm-auth
```

set the following option in your `waterlock.js` config file

```js
authMethod:[
  {
    name: "waterlock-rhel-idm-auth",
    connection: {
      url: "ldaps://ldap.example.com:636",
      bindDn: "uid=myadminusername,ou=users,o=example.com",
      bindCredentials: "mypassword",
      searchBase: "ou=users,o=example.com",
      searchFilter: "(|(email={{username}})(uid={{username}}))",
      groupSearchBase: "dc=groups,dc=local",
      groupSearchFilter: "(member={{dn}})",
      groupSearchAttributes: ["dn", "cn", "sAMAccountName"]
      cache: true
    },
    attributes: {},
    userAttributes: {}
  }
]
```

## Auth Model

LDAP auth adds the following attributes onto the Auth model:

```js
  ipaUniqueID: {
    type: 'string',
    unique: true
  },
  dn: {
    type: 'string',
    unique: true
  }
```

They map the `dn` and the`ipaUniqueID` values of the LDAP user to the `Auth`
model.

With the way waterlock is designed and this model you can override any of these
attributes.

waterlock-rhel-idm-auth will create a new Auth and User if LDAP authentication
succeeds but no Auth/User is found.

## Mapping LDAP attributes

It is possible to map attributes from the LDAP user object to the `Auth` model
automatically. Just add objects to the `attributes` property:

```js
authMethod:[
  {
    name: "waterlock-rhel-idm-auth",
    connection: { ... },
    attributes: {
      uid: {
        uid: {
          type: 'string'
        }
      },
      cn: {
        fullname: {
          type: 'string'
        }
      },
      mail: {
        email: {
          type: 'string'
        }
      }
    }
  }
]
```

This example adds a mapping from LDAP to `Auth` model:

| *LDAP* | *`Auth` model* | *Type* |
|--------|----------------|--------|
| uid    | uid            | string |
| cn     | fullname       | string |
| mail   | email          | string |

## License

**Waterlock LDAP Auth** is licensed under the MIT license. See the LICENSE file
for more details.