bitwarden/directory-connector
1
0
Fork 0
mirror of https://github.com/bitwarden/directory-connector synced 2025-12-05 23:53:21 +00:00
Code Issues Releases Wiki Activity

Filter out deleted AD users unless otherwise instructed (#548)

Browse Source
This commit is contained in:
Addison Beck
2024-08-12 11:04:07 -04:00
committed by GitHub
parent 3a639bb8f2
commit decada8745
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/services/ldap-directory.service.ts
View File

@@ -49,7 +49,7 @@ export class LdapDirectoryService implements IDirectoryService {
let users: UserEntry[];
if (this.syncConfig.users) {
users = await this.getUsers(force);
users = await this.getUsers(force, test);
}
let groups: GroupEntry[];
@@ -66,7 +66,7 @@ export class LdapDirectoryService implements IDirectoryService {
return [groups, users];
}
private async getUsers(force: boolean): Promise<UserEntry[]> {
private async getUsers(force: boolean, test: boolean): Promise<UserEntry[]> {
const lastSync = await this.stateService.getLastUserSync();
let filter = this.buildBaseFilter(this.syncConfig.userObjectClass, this.syncConfig.userFilter);
filter = this.buildRevisionFilter(filter, force, lastSync);
@@ -77,7 +77,20 @@ export class LdapDirectoryService implements IDirectoryService {
const regularUsers = await this.search<UserEntry>(path, filter, (se: any) =>
this.buildUser(se, false),
);
if (!this.dirConfig.ad) {
// Active Directory has a special way of managing deleted users that
// standard LDAP does not. Users can be "tombstoned", where they cease to
// exist, or they can be "recycled" where they exist in a quarantined
// state for a period of time before being tombstoned.
//
// Essentially, recycled users are soft deleted but tombstoned users are
// hard deleted. In standard LDAP deleted users are only ever hard
// deleted.
//
// We check for recycled Active Directory users below, but only if the
// sync is a test sync or the "Overwrite existing users" flag is checked.
const ignoreDeletedUsers = !this.dirConfig.ad || (!force && !test);
if (ignoreDeletedUsers) {
return regularUsers;
}