bitwarden/directory-connector
1
0
Fork 0
mirror of https://github.com/bitwarden/directory-connector synced 2025-12-05 23:53:21 +00:00
Code Issues Releases Wiki Activity

Filter out deleted AD users unless otherwise instructed (#548)

Browse Source
This commit is contained in:
Addison Beck
2024-08-12 11:04:07 -04:00
committed by GitHub
parent 3a639bb8f2
commit decada8745
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/services/ldap-directory.service.ts
View File

@@ -49,7 +49,7 @@ export class LdapDirectoryService implements IDirectoryService {
let users: UserEntry[]; let users: UserEntry[];
if (this.syncConfig.users) { if (this.syncConfig.users) {
users = await this.getUsers(force); users = await this.getUsers(force, test);
} }
let groups: GroupEntry[]; let groups: GroupEntry[];
@@ -66,7 +66,7 @@ export class LdapDirectoryService implements IDirectoryService {
return [groups, users]; return [groups, users];
} }
private async getUsers(force: boolean): Promise<UserEntry[]> { private async getUsers(force: boolean, test: boolean): Promise<UserEntry[]> {
const lastSync = await this.stateService.getLastUserSync(); const lastSync = await this.stateService.getLastUserSync();
let filter = this.buildBaseFilter(this.syncConfig.userObjectClass, this.syncConfig.userFilter); let filter = this.buildBaseFilter(this.syncConfig.userObjectClass, this.syncConfig.userFilter);
filter = this.buildRevisionFilter(filter, force, lastSync); filter = this.buildRevisionFilter(filter, force, lastSync);
@@ -77,7 +77,20 @@ export class LdapDirectoryService implements IDirectoryService {
const regularUsers = await this.search<UserEntry>(path, filter, (se: any) => const regularUsers = await this.search<UserEntry>(path, filter, (se: any) =>
this.buildUser(se, false), this.buildUser(se, false),
); );
if (!this.dirConfig.ad) {
// Active Directory has a special way of managing deleted users that
// standard LDAP does not. Users can be "tombstoned", where they cease to
// exist, or they can be "recycled" where they exist in a quarantined
// state for a period of time before being tombstoned.
//
// Essentially, recycled users are soft deleted but tombstoned users are
// hard deleted. In standard LDAP deleted users are only ever hard
// deleted.
//
// We check for recycled Active Directory users below, but only if the
// sync is a test sync or the "Overwrite existing users" flag is checked.
const ignoreDeletedUsers = !this.dirConfig.ad || (!force && !test);
if (ignoreDeletedUsers) {
return regularUsers; return regularUsers;
} }