feat: ldap custom variables / string manipulation

.changeset/beige-days-push.md

@@ -0,0 +1,7 @@
+---
+'@rocket.chat/core-typings': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds new settings to allow configuring custom variables with string manipulation functions on the LDAP data mapper

apps/meteor/server/lib/ldap/Connection.ts

@@ -6,10 +6,12 @@ import type {
 	ILDAPCallback,
 	ILDAPPageCallback,
 } from '@rocket.chat/core-typings';
+import { wrapExceptions } from '@rocket.chat/tools';
 import ldapjs from 'ldapjs';
 
 import { logger, connLogger, searchLogger, authLogger, bindLogger, mapLogger } from './Logger';
 import { getLDAPConditionalSetting } from './getLDAPConditionalSetting';
+import { processLdapVariables, type LDAPVariableMap } from './processLdapVariables';
 import { settings } from '../../../app/settings/server';
 import { ensureArray } from '../../../lib/utils/arrayUtils';
 
@@ -50,6 +52,8 @@ export class LDAPConnection {
 
 	private usingAuthentication: boolean;
 
+	private _variableMap: LDAPVariableMap;
+
 	constructor() {
 		this.ldapjs = ldapjs;
 
@@ -83,9 +87,18 @@ export class LDAPConnection {
 			authentication: settings.get<boolean>('LDAP_Authentication') ?? false,
 			authenticationUserDN: settings.get<string>('LDAP_Authentication_UserDN') ?? '',
 			authenticationPassword: settings.get<string>('LDAP_Authentication_Password') ?? '',
+			useVariables: settings.get<boolean>('LDAP_DataSync_UseVariables') ?? false,
+			variableMap: settings.get<string>('LDAP_DataSync_VariableMap') ?? '{}',
 			attributesToQuery: this.parseAttributeList(settings.get<string>('LDAP_User_Search_AttributesToQuery')),
 		};
 
+		this._variableMap =
+			(this.options.useVariables &&
+				wrapExceptions(() => JSON.parse(this.options.variableMap)).suppress(() => {
+					mapLogger.error({ msg: 'Failed to parse LDAP Variable Map', map: this.options.variableMap });
+				})) ||
+			{};
+
 		if (!this.options.host) {
 			logger.warn('LDAP Host is not configured.');
 		}
@@ -322,7 +335,7 @@ export class LDAPConnection {
 			mapLogger.debug({ msg: 'Extracted Attribute', key, type: dataType, value: values[key] });
 		});
 
-		return values;
+		return processLdapVariables(values, this._variableMap);
 	}
 
 	public async doCustomSearch<T>(baseDN: string, searchOptions: ldapjs.SearchOptions, entryCallback: ILDAPEntryCallback<T>): Promise<T[]> {

apps/meteor/server/lib/ldap/Manager.ts

@@ -12,6 +12,9 @@ import { LDAPConnection } from './Connection';
 import { logger, authLogger, connLogger } from './Logger';
 import { LDAPUserConverter } from './UserConverter';
 import { getLDAPConditionalSetting } from './getLDAPConditionalSetting';
+import { getLdapDynamicValue } from './getLdapDynamicValue';
+import { getLdapString } from './getLdapString';
+import { ldapKeyExists } from './ldapKeyExists';
 import type { UserConverterOptions } from '../../../app/importer/server/classes/converters/UserConverter';
 import { setUserAvatar } from '../../../app/lib/server/functions/setUserAvatar';
 import { settings } from '../../../app/settings/server';
@@ -401,43 +404,9 @@ export class LDAPManager {
 		connLogger.debug(ldapUser);
 	}
 
-	private static ldapKeyExists(ldapUser: ILDAPEntry, key: string): boolean {
-		return !_.isEmpty(ldapUser[key.trim()]);
-	}
-
-	private static getLdapString(ldapUser: ILDAPEntry, key: string): string {
-		return ldapUser[key.trim()];
-	}
-
-	private static getLdapDynamicValue(ldapUser: ILDAPEntry, attributeSetting: string | undefined): string | undefined {
-		if (!attributeSetting) {
-			return;
-		}
-
-		// If the attribute setting is a template, then convert the variables in it
-		if (attributeSetting.includes('#{')) {
-			return attributeSetting.replace(/#{(.+?)}/g, (_match, field) => {
-				const key = field.trim();
-
-				if (this.ldapKeyExists(ldapUser, key)) {
-					return this.getLdapString(ldapUser, key);
-				}
-
-				return '';
-			});
-		}
-
-		// If it's not a template, then treat the setting as a CSV list of possible attribute names and return the first valid one.
-		const attributeList: string[] = attributeSetting.replace(/\s/g, '').split(',');
-		const key = attributeList.find((field) => this.ldapKeyExists(ldapUser, field));
-		if (key) {
-			return this.getLdapString(ldapUser, key);
-		}
-	}
-
 	private static getLdapName(ldapUser: ILDAPEntry): string | undefined {
 		const nameAttributes = getLDAPConditionalSetting<string | undefined>('LDAP_Name_Field');
-		return this.getLdapDynamicValue(ldapUser, nameAttributes);
+		return getLdapDynamicValue(ldapUser, nameAttributes);
 	}
 
 	private static getLdapExtension(ldapUser: ILDAPEntry): string | undefined {
@@ -446,14 +415,14 @@ export class LDAPManager {
 			return;
 		}
 
-		return this.getLdapString(ldapUser, extensionAttribute);
+		return getLdapString(ldapUser, extensionAttribute);
 	}
 
 	private static getLdapEmails(ldapUser: ILDAPEntry, username?: string): string[] {
 		const emailAttributes = getLDAPConditionalSetting<string>('LDAP_Email_Field');
 		if (emailAttributes) {
 			const attributeList: string[] = emailAttributes.replace(/\s/g, '').split(',');
-			const key = attributeList.find((field) => this.ldapKeyExists(ldapUser, field));
+			const key = attributeList.find((field) => ldapKeyExists(ldapUser, field));
 
 			const emails: string[] = [].concat(key ? ldapUser[key.trim()] : []);
 			const filteredEmails = emails.filter((email) => email.includes('@'));
@@ -497,7 +466,7 @@ export class LDAPManager {
 
 	protected static getLdapUsername(ldapUser: ILDAPEntry): string | undefined {
 		const usernameField = getLDAPConditionalSetting('LDAP_Username_Field') as string;
-		return this.getLdapDynamicValue(ldapUser, usernameField);
+		return getLdapDynamicValue(ldapUser, usernameField);
 	}
 
 	// This method will find existing users by LDAP id or by username.

apps/meteor/server/lib/ldap/getLdapDynamicValue.ts

@@ -0,0 +1,30 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+
+import { getLdapString } from './getLdapString';
+import { ldapKeyExists } from './ldapKeyExists';
+
+export function getLdapDynamicValue(ldapUser: ILDAPEntry, attributeSetting: string | undefined): string | undefined {
+	if (!attributeSetting) {
+		return;
+	}
+
+	// If the attribute setting is a template, then convert the variables in it
+	if (attributeSetting.includes('#{')) {
+		return attributeSetting.replace(/#{(.+?)}/g, (_match, field) => {
+			const key = field.trim();
+
+			if (ldapKeyExists(ldapUser, key)) {
+				return getLdapString(ldapUser, key);
+			}
+
+			return '';
+		});
+	}
+
+	// If it's not a template, then treat the setting as a CSV list of possible attribute names and return the first valid one.
+	const attributeList: string[] = attributeSetting.replace(/\s/g, '').split(',');
+	const key = attributeList.find((field) => ldapKeyExists(ldapUser, field));
+	if (key) {
+		return getLdapString(ldapUser, key);
+	}
+}

apps/meteor/server/lib/ldap/getLdapString.ts

@@ -0,0 +1,5 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+
+export function getLdapString(ldapUser: ILDAPEntry, key: string): string {
+	return ldapUser[key.trim()];
+}

apps/meteor/server/lib/ldap/ldapKeyExists.ts

@@ -0,0 +1,6 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+import _ from 'underscore';
+
+export function ldapKeyExists(ldapUser: ILDAPEntry, key: string): boolean {
+	return !_.isEmpty(ldapUser[key.trim()]);
+}

apps/meteor/server/lib/ldap/operations/executeOperation.ts

@@ -0,0 +1,31 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+
+import { executeFallback, type LDAPVariableFallback } from './fallback';
+import { executeMatch, type LDAPVariableMatch } from './match';
+import { executeReplace, type LDAPVariableReplace } from './replace';
+import { executeSplit, type LDAPVariableSplit } from './split';
+import { executeSubstring, type LDAPVariableSubString } from './substring';
+
+export type LDAPVariableOperation =
+	| LDAPVariableReplace
+	| LDAPVariableMatch
+	| LDAPVariableSubString
+	| LDAPVariableFallback
+	| LDAPVariableSplit;
+
+export function executeOperation(ldapUser: ILDAPEntry, input: string, operation?: LDAPVariableOperation): string | undefined {
+	switch (operation?.operation) {
+		case 'replace':
+			return executeReplace(input, operation);
+		case 'match':
+			return executeMatch(input, operation);
+		case 'substring':
+			return executeSubstring(input, operation);
+		case 'fallback':
+			return executeFallback(ldapUser, input, operation);
+		case 'split':
+			return executeSplit(input, operation);
+	}
+
+	return input;
+}

apps/meteor/server/lib/ldap/operations/fallback.ts

@@ -0,0 +1,24 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+
+import { getLdapDynamicValue } from '../getLdapDynamicValue';
+
+export type LDAPVariableFallback = {
+	operation: 'fallback';
+	fallback: string;
+
+	minLength?: number;
+};
+
+export function executeFallback(ldapUser: ILDAPEntry, input: string, operation: LDAPVariableFallback): string | undefined {
+	let valid = Boolean(input);
+
+	if (valid && typeof operation.minLength === 'number') {
+		valid = input.length >= operation.minLength;
+	}
+
+	if (valid) {
+		return input;
+	}
+
+	return getLdapDynamicValue(ldapUser, operation.fallback);
+}

apps/meteor/server/lib/ldap/operations/match.ts

@@ -0,0 +1,28 @@
+export type LDAPVariableMatch = {
+	operation: 'match';
+	pattern: string;
+	regex?: boolean;
+	flags?: string;
+	indexToUse?: number;
+	valueIfTrue?: string;
+	valueIfFalse?: string;
+};
+
+export function executeMatch(input: string, operation: LDAPVariableMatch): string | undefined {
+	if (!operation.pattern || (typeof operation.valueIfTrue !== 'string' && typeof operation.indexToUse !== 'number')) {
+		throw new Error('Invalid MATCH operation.');
+	}
+
+	const pattern = operation.regex ? new RegExp(operation.pattern, operation.flags) : operation.pattern;
+
+	const result = input.match(pattern);
+	if (!result) {
+		return operation.valueIfFalse;
+	}
+
+	if (typeof operation.indexToUse === 'number' && result.length > operation.indexToUse) {
+		return result[operation.indexToUse];
+	}
+
+	return operation.valueIfTrue;
+}

apps/meteor/server/lib/ldap/operations/replace.ts

@@ -0,0 +1,23 @@
+export type LDAPVariableReplace = {
+	operation: 'replace';
+	pattern: string;
+	regex?: boolean;
+	flags?: string;
+	all?: boolean;
+	replacement: string;
+};
+
+export function executeReplace(input: string, operation: LDAPVariableReplace): string {
+	if (!operation.pattern || typeof operation.replacement !== 'string') {
+		throw new Error('Invalid REPLACE operation.');
+	}
+
+	const flags = operation.regex && operation.all ? `${operation.flags || ''}${operation.flags?.includes('g') ? '' : 'g'}` : operation.flags;
+	const pattern = operation.regex ? new RegExp(operation.pattern, flags) : operation.pattern;
+
+	if (operation.all) {
+		return input.replaceAll(pattern, operation.replacement);
+	}
+
+	return input.replace(pattern, operation.replacement);
+}

apps/meteor/server/lib/ldap/operations/split.ts

@@ -0,0 +1,26 @@
+export type LDAPVariableSplit = {
+	operation: 'split';
+	pattern: string;
+	indexToUse?: number;
+};
+
+export function executeSplit(input: string, operation: LDAPVariableSplit): string | undefined {
+	if (!operation.pattern) {
+		throw new Error('Invalid SPLIT operation.');
+	}
+
+	const result = input.split(operation.pattern);
+	if (!result) {
+		return;
+	}
+
+	if (typeof operation.indexToUse === 'number') {
+		if (result.length > operation.indexToUse) {
+			return result[operation.indexToUse];
+		}
+
+		return;
+	}
+
+	return result.shift();
+}

apps/meteor/server/lib/ldap/operations/substring.ts

@@ -0,0 +1,13 @@
+export type LDAPVariableSubString = {
+	operation: 'substring';
+	start: number;
+	end?: number;
+};
+
+export function executeSubstring(input: string, operation: LDAPVariableSubString): string | undefined {
+	if (typeof operation.start !== 'number' || (operation.end !== undefined && typeof operation.end !== 'number')) {
+		throw new Error('Invalid SUBSTRING operation.');
+	}
+
+	return input.substring(operation.start, operation.end);
+}

apps/meteor/server/lib/ldap/processLdapVariables.ts

@@ -0,0 +1,38 @@
+import type { ILDAPEntry } from '@rocket.chat/core-typings';
+
+import { mapLogger } from './Logger';
+import { getLdapDynamicValue } from './getLdapDynamicValue';
+import { executeOperation, type LDAPVariableOperation } from './operations/executeOperation';
+
+export type LDAPVariableConfiguration = {
+	input: string;
+	output?: LDAPVariableOperation;
+};
+export type LDAPVariableMap = Record<string, LDAPVariableConfiguration>;
+
+export function processLdapVariables(entry: ILDAPEntry, variableMap: LDAPVariableMap): ILDAPEntry {
+	if (!variableMap || !Object.keys(variableMap).length) {
+		mapLogger.debug('No LDAP variables to process.');
+		return entry;
+	}
+
+	for (const variableName in variableMap) {
+		if (!variableMap.hasOwnProperty(variableName)) {
+			continue;
+		}
+
+		const variableData = variableMap[variableName];
+		if (!variableData?.input) {
+			continue;
+		}
+
+		const input = getLdapDynamicValue(entry, variableData.input) || '';
+		const output = executeOperation(entry, input, variableData.output) || '';
+
+		mapLogger.debug({ msg: 'Processed LDAP variable.', variableName, input, output });
+
+		entry[variableName] = output;
+	}
+
+	return entry;
+}

apps/meteor/server/settings/ldap.ts

@@ -214,6 +214,19 @@ export const createLdapSettings = () =>
 					type: 'string',
 					enableQuery,
 				});
+
+				await this.add('LDAP_DataSync_UseVariables', false, {
+					type: 'boolean',
+					enableQuery,
+					invalidValue: false,
+				});
+
+				await this.add('LDAP_DataSync_VariableMap', '{}', {
+					type: 'code',
+					multiline: true,
+					enableQuery: [enableQuery, { _id: 'LDAP_DataSync_UseVariables', value: true }],
+					invalidValue: '{}',
+				});
 			});
 
 			await this.section('LDAP_DataSync_Avatar', async function () {

packages/core-typings/src/ldap/ILDAPOptions.ts

@@ -28,4 +28,6 @@ export interface ILDAPConnectionOptions {
 	authenticationUserDN: string;
 	authenticationPassword: string;
 	attributesToQuery: Array<string>;
+	useVariables: boolean;
+	variableMap: string;
 }