fusen/fusenapi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

新增:权限分组模块

Browse Source
This commit is contained in:
momo 2023-11-17 15:23:24 +08:00
commit ee2b0b5b81
6 changed files with 161 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
server/ldap-admin/internal/logic/createldaporganizationlogic.go
View File

@ -3,6 +3,7 @@ package logic
import (
"fusenapi/utils/auth"
"fusenapi/utils/basic"
"fusenapi/utils/chinese_to_pinyin"
"fusenapi/utils/ldap_lib"
"strings"
@ -33,26 +34,30 @@ func NewCreateLdapOrganizationLogic(ctx context.Context, svcCtx *svc.ServiceCont
// }
func (l *CreateLdapOrganizationLogic) CreateLdapOrganization(req *types.CreateLdapOrganizationReq, userinfo *auth.UserInfo) (resp *basic.Response) {
req.OrganizationOu = strings.Trim(req.OrganizationOu, " ")
req.OrganizationEnName = strings.Trim(req.OrganizationEnName, " ")
req.ParentOrganizationDN = strings.Trim(req.ParentOrganizationDN, " ")
req.BusinessCategory = strings.Trim(req.BusinessCategory, " ")
if len(strings.Split(req.OrganizationOu, ",")) != 1 {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,不合法的组织ou")
req.OrganizationName = strings.Trim(req.OrganizationName, " ")
if len(strings.Split(req.OrganizationEnName, ",")) != 1 {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,组织英文名不符合规范")
}
//转拼音比较下
if req.OrganizationEnName != chinese_to_pinyin.ChineseToPinyin(req.OrganizationEnName) {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,组织英文名不能包含中文")
}
if req.ParentOrganizationDN == "" {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,父级DN不能为空")
}
if req.BusinessCategory == "" {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,分类名不能为空")
if req.OrganizationName == "" {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,组织中文名不能为空")
}
//组装organization dn
organizationDN := "ou=" + req.OrganizationOu + "," + req.ParentOrganizationDN
organizationDN := "ou=" + req.OrganizationEnName + "," + req.ParentOrganizationDN
ldapServer := ldap_lib.NewLdap(l.svcCtx.Ldap, l.svcCtx.Config.Ldap.BaseDN, l.svcCtx.Config.Ldap.RootDN)
err := ldapServer.Create(organizationDN, map[string][]string{
"objectClass": {"top", "groupOfUniqueNames"},
"cn": {req.BusinessCategory},
"ou": {req.OrganizationOu},
"businessCategory": {req.BusinessCategory},
"cn": {req.OrganizationName},
"ou": {req.OrganizationEnName},
"businessCategory": {req.OrganizationName},
"uniqueMember": {l.svcCtx.Config.Ldap.RootDN}, //创建groupOfUniqueNames对象类型需要至少一个member,把root加进去
})
if err != nil {

101
server/ldap-admin/internal/logic/getldaporganizationmemberslogic.go
View File

@ -1,8 +1,12 @@
package logic
import (
"fmt"
"fusenapi/utils/auth"
"fusenapi/utils/basic"
"fusenapi/utils/ldap_lib"
"github.com/go-ldap/ldap/v3"
"strconv"
"strings"
"context"
@ -36,12 +40,97 @@ func (l *GetLdapOrganizationMembersLogic) GetLdapOrganizationMembers(req *types.
if len(req.OrganizationDN) <= 3 || req.OrganizationDN[:3] != "ou=" {
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误,无效的组织DN")
}
//先获取组织信息
/*ldapServer := ldap_lib.NewLdap(l.svcCtx.Ldap, l.svcCtx.Config.Ldap.BaseDN, l.svcCtx.Config.Ldap.RootDN)
filter := "(objectClass=groupOfUniqueNames)"
fields := ""
ldapServer.Search(req.OrganizationDN, ldap.ScopeWholeSubtree, filter, nil, nil)*/
return resp.SetStatus(basic.CodeOK)
//先获取组织成员
ldapServer := ldap_lib.NewLdap(l.svcCtx.Ldap, l.svcCtx.Config.Ldap.BaseDN, l.svcCtx.Config.Ldap.RootDN)
//获取跟用户dn筛选排除该用户
rootDNSlice := strings.Split(l.svcCtx.Config.Ldap.RootDN, ",")
if len(rootDNSlice) == 0 {
return resp.SetStatusWithMessage(basic.CodeServiceErr, "根用户DN未设置")
}
rootCn := rootDNSlice[0]
filter := "(&(objectClass=groupOfUniqueNames)(!(" + rootCn + ")))"
fields := []string{"uniqueMember"} //只是查询成员
result, err := ldapServer.Search(req.OrganizationDN, ldap.ScopeWholeSubtree, filter, fields, nil)
if err != nil {
logx.Error(err)
return resp.SetStatusWithMessage(basic.CodeServiceErr, "查询ldap组织成员错误,"+err.Error())
}
//初始化filter
filterBuilder := strings.Builder{}
memberCount := 0
for _, entry := range result.Entries {
if entry.DN != req.OrganizationDN {
continue
}
for _, attr := range entry.Attributes {
if attr.Name != "uniqueMember" {
continue
}
memberCount = len(attr.Values)
fmt.Println(attr.Values)
for _, memberDn := range attr.Values {
//不需要根用户
if memberDn == l.svcCtx.Config.Ldap.RootDN {
continue
}
//解析dn成每个小的单元
cellList := strings.Split(memberDn, ",") //取cn邮箱
filterBuilder.WriteString(fmt.Sprintf("(&%s)", "("+cellList[0]+")"))
}
break
}
break
}
//从新赋值filter
filter = "(&(objectClass=posixAccount)(objectClass=inetOrgPerson)(|" + filterBuilder.String() + "))"
fmt.Println(filter)
//从用户基本组中找到员工
result, err = ldapServer.Search(l.svcCtx.Config.Ldap.PeopleGroupDN, ldap.ScopeWholeSubtree, filter, nil, nil)
if err != nil {
logx.Error(err)
return resp.SetStatusWithMessage(basic.CodeServiceErr, "查询ldap帐号信息失败,"+err.Error())
}
userList := make([]types.GetLdapOrganizationMembersItem, 0, memberCount)
for _, entry := range result.Entries {
userInfo := types.GetLdapOrganizationMembersItem{
UserDN: entry.DN,
}
for _, attr := range entry.Attributes {
switch attr.Name {
case "uidNumber": //用户id
if len(attr.Values) == 0 {
return resp.SetStatusWithMessage(basic.CodeServiceErr, "用户id不存在")
}
userInfo.UserId, err = strconv.ParseInt(attr.Values[0], 10, 64)
if err != nil {
logx.Error(err)
return resp.SetStatusWithMessage(basic.CodeServiceErr, "用户id转数字失败")
}
case "sn": //用户真名
userInfo.UserName = strings.Join(attr.Values, "")
case "mail": //邮箱
userInfo.Email = strings.Join(attr.Values, "")
case "mobile": //手机号
userInfo.Mobile = strings.Join(attr.Values, "")
case "postalAddress": //头像
userInfo.Avatar = strings.Join(attr.Values, "")
case "postalCode": //状态
if len(attr.Values) == 0 {
return resp.SetStatusWithMessage(basic.CodeServiceErr, "用户状态不存在")
}
userInfo.Status, err = strconv.ParseInt(attr.Values[0], 10, 64)
if err != nil {
logx.Error(err)
return resp.SetStatusWithMessage(basic.CodeServiceErr, "用户状态转数字失败")
}
}
}
//添加列表
userList = append(userList, userInfo)
}
return resp.SetStatusWithMessage(basic.CodeOK, "success", types.GetLdapOrganizationMembersRsp{
List: userList,
})
}
// 处理逻辑后 w,r 如:重定向, resp 必须重新处理

6
server/ldap-admin/internal/logic/getldapuserinfologic.go
View File

@ -38,7 +38,7 @@ func (l *GetLdapUserInfoLogic) GetLdapUserInfo(req *types.GetLdapUserInfoReq, us
return resp.SetStatusWithMessage(basic.CodeRequestParamsErr, "参数错误，用户DN错误")
}
ldapServer := ldap_lib.NewLdap(l.svcCtx.Ldap, l.svcCtx.Config.Ldap.BaseDN, l.svcCtx.Config.Ldap.RootDN)
res, err := ldapServer.Search(req.UserDN, ldap.ScopeWholeSubtree, "(objectClass=inetOrgPerson)", nil, nil)
res, err := ldapServer.Search(req.UserDN, ldap.ScopeWholeSubtree, "(&(objectClass=posixAccount)(objectClass=inetOrgPerson))", nil, nil)
if err != nil {
logx.Error(err)
return resp.SetStatusWithMessage(basic.CodeServiceErr, "获取用户信息失败:"+err.Error())
@ -51,6 +51,9 @@ func (l *GetLdapUserInfoLogic) GetLdapUserInfo(req *types.GetLdapUserInfoReq, us
Status: 0,
}
for _, entry := range res.Entries {
if entry.DN != req.UserDN {
continue
}
apiRsp.UserDN = entry.DN
for _, attr := range entry.Attributes {
switch attr.Name {
@ -82,6 +85,7 @@ func (l *GetLdapUserInfoLogic) GetLdapUserInfo(req *types.GetLdapUserInfoReq, us
}
}
}
break
}
if apiRsp.UserId == 0 {
return resp.SetStatusWithMessage(basic.CodeServiceErr, "查询到的不是用户信息!!!")

20
server/ldap-admin/internal/types/types.go
View File

@ -112,8 +112,8 @@ type MenuItem struct {
}
type CreateLdapOrganizationReq struct {
OrganizationOu string `json:"organization_ou"` //组织ou
BusinessCategory string `json:"business_category"` //组织分类名称
OrganizationEnName string `json:"organization_en_name"` //组织英文名
OrganizationName string `json:"organization_name"` //组织中文名称
ParentOrganizationDN string `json:"parent_organization_dn"` //父级dn
}
@ -173,7 +173,21 @@ type RemoveLdapOrganizationMemberReq struct {
}
type GetLdapOrganizationMembersReq struct {
OrganizationDN string `json:"organization_dn"`
OrganizationDN string `form:"organization_dn"`
}
type GetLdapOrganizationMembersRsp struct {
List []GetLdapOrganizationMembersItem `json:"list"`
}
type GetLdapOrganizationMembersItem struct {
UserId int64 `json:"userId"`
UserDN string `json:"user_dn"`
UserName string `json:"user_name"` //用户名
Email string `json:"email"` //邮箱
Mobile string `json:"mobile"` //手机号
Avatar string `json:"avatar"` //头像地址
Status int64 `json:"status,options=0|1"` //状态 1正常0离职
}
type Request struct {

24
server_api/ldap-admin.api
View File

@ -19,11 +19,10 @@ service ldap-admin {
//删除权限组
@handler DeleteLdapGroupHandler
post /api/ldap-admin/delete_ldap_group(DeleteLdapGroupReq) returns (response);
//权限组授权菜单
@handler SetLdapGroupMenusHandler
post /api/ldap-admin/set_ldap_group_menus(SetLdapGroupMenusReq) returns (response);
//权限组授权接口
@handler SetLdapCasbinRuleHandler
post /api/ldap-admin/set_ldap_casbin_rule(SetLdapCasbinRuleReq) returns (response);
@ -31,14 +30,13 @@ service ldap-admin {
//权限组授权用户
@handler SetLdapGroupUserHandler
post /api/ldap-admin/set_ldap_group_user(SetLdapGroupUserReq) returns (response);
//获取API列表
@handler GetApisHandler
get /api/ldap-admin/get_apis(GetApisReq) returns (response);
//保存API
@handler SaveApiHandler
post /api/ldap-admin/save_api(SaveApiReq) returns (response);
//保存菜单
@handler SaveMenuHandler
post /api/ldap-admin/save_menu(SaveMenuReq) returns (response);
@ -189,8 +187,8 @@ type MenuItem {
}
//增加ldap组织
type CreateLdapOrganizationReq {
OrganizationOu string `json:"organization_ou"` //组织ou
BusinessCategory string `json:"business_category"` //组织分类名称
OrganizationEnName string `json:"organization_en_name"` //组织英文名
OrganizationName string `json:"organization_name"` //组织中文名称
ParentOrganizationDN string `json:"parent_organization_dn"` //父级dn
}
//删除ldap组织
@ -249,5 +247,17 @@ type RemoveLdapOrganizationMemberReq {
}
//获取ldap组织成员列表
type GetLdapOrganizationMembersReq {
OrganizationDN string `json:"organization_dn"`
OrganizationDN string `form:"organization_dn"`
}
type GetLdapOrganizationMembersRsp {
List []GetLdapOrganizationMembersItem `json:"list"`
}
type GetLdapOrganizationMembersItem {
UserId int64 `json:"userId"`
UserDN string `json:"user_dn"`
UserName string `json:"user_name"` //用户名
Email string `json:"email"` //邮箱
Mobile string `json:"mobile"` //手机号
Avatar string `json:"avatar"` //头像地址
Status int64 `json:"status,options=0|1"` //状态 1正常0离职
}

16
utils/ldap_lib/ldap_group.go
View File

@ -23,6 +23,9 @@ func NewLdap(conn *ldap.Conn, baseDN, rootDN string) *Ldap {
// 更新资源(分组/用户)
func (l *Ldap) Update(DN string, attr map[string][]string) error {
if DN == l.rootDN {
return errors.New("根用户不能更新")
}
modify := ldap.NewModifyRequest(DN, nil)
for key, v := range attr {
modify.Replace(key, v)
@ -41,12 +44,18 @@ func (l *Ldap) Create(DN string, attr map[string][]string) error {
// 删除资源(分组/用户)
func (l *Ldap) Delete(DN string) error {
if DN == l.rootDN {
return errors.New("根用户不能删除")
}
del := ldap.NewDelRequest(DN, nil)
return l.conn.Del(del)
}
// 查询资源(分组/用户)
func (l *Ldap) Search(DN string, scope int, filter string, attr []string, controls []ldap.Control) (resp *ldap.SearchResult, err error) {
if DN == l.rootDN {
return nil, errors.New("你没有权限查询根用户")
}
if filter == "" {
rootCn := strings.Split(l.rootDN, ",")
if len(rootCn) == 0 {
@ -67,10 +76,6 @@ func (l *Ldap) Search(DN string, scope int, filter string, attr []string, contro
// AddUserToGroup 添加用户到组织
func (l *Ldap) AddUserToOrganization(organizationDN, userDN string) error {
//判断dn是否以ou开头
/*if organizationDN[:3] == "ou=" {
return errors.New("不能添加用户到OU组织单元")
}*/
modify := ldap.NewModifyRequest(organizationDN, nil)
modify.Add("uniqueMember", []string{userDN})
return l.conn.Modify(modify)
@ -78,6 +83,9 @@ func (l *Ldap) AddUserToOrganization(organizationDN, userDN string) error {
// DelUserFromGroup 将用户从分组删除
func (l *Ldap) RemoveUserFromOrganization(groupDN, userDN string) error {
if userDN == l.rootDN {
return errors.New("根用户不能从分组删除")
}
modify := ldap.NewModifyRequest(groupDN, nil)
modify.Delete("uniqueMember", []string{userDN})
return l.conn.Modify(modify)