Authentication / LDAP [+totp] - In cases where the user is able to in…

…fluence their group membership according to the memberOf attribute, offer the ability to only match on those being selected ib the container section. Although cases like these are likely misconfigurations elsewhere, it may help to improve security in some cases (although likely one should still fix the issue in the identity provider as well).

mentioned in #6871

src/opnsense/mvc/app/library/OPNsense/Auth/LDAP.php

@@ -116,6 +116,11 @@ class LDAP extends Base implements IAuthConnector
      */
     private $ldapSyncMemberOf = false;
 
+    /**
+     * constraint allowed memberOf results to those in selected containers
+     */
+    private $ldapSyncMemberOfConstraint = false;
+
     /**
      * when set, allow local user creation
      */
@@ -261,6 +266,7 @@ public function setProperties($config)
             "local_users" => "userDNmap",
             "ldap_read_properties" => "ldapReadProperties",
             "ldap_sync_memberof" => "ldapSyncMemberOf",
+            "ldap_sync_memberof_constraint" => "ldapSyncMemberOfConstraint",
             "ldap_sync_memberof_groups" => "ldapSyncMemberOfLimit"
         );
 
@@ -520,9 +526,28 @@ public function authenticate($username, $password)
                         } else {
                             $sync_groups = [];
                         }
+                        if ($this->ldapSyncMemberOfConstraint) {
+                            // Filter "memberOf" results to those recorded in ldapAuthcontainers, where
+                            // the first part of the member is considered the group name, the rest should be an exact
+                            // (case insensitive) match.
+                            // (e.g. : cn=mygroup,cn=users,dc=opnsense,dc=local matches cn=users,dc=opnsense,dc=local)
+                            $membersOf = [];
+                            $tmp_containers = explode(";", strtolower($this->ldapAuthcontainers));
+                            foreach (explode("\n", $this->lastAuthProperties['memberof']) as $member) {
+                                foreach ($tmp_containers as $tmp_container) {
+                                    $tmp = explode(",", strtolower($member), 2);
+                                    if (count($tmp) > 1 && $tmp[1] == $tmp_container) {
+                                        $membersOf[] = $member;
+                                    }
+                                }
+                            }
+                            $membersOf = implode("\n", $membersOf);
+                        } else {
+                            $membersOf = $this->lastAuthProperties['memberof'];
+                        }
                         $this->setGroupMembership(
                             $username,
-                            $this->lastAuthProperties['memberof'],
+                            $membersOf,
                             $sync_groups,
                             $this->ldapSyncCreateLocalUsers
                         );

src/www/system_authservers.php

@@ -59,6 +59,7 @@
         $pconfig['radius_auth_port'] = "1812";
         $pconfig['radius_acct_port'] = "1813";
         $pconfig['type'] = 'ldap';
+        $pconfig['sync_memberof_constraint'] = true;
         // gather auth plugin defaults
         // the hotplug properties should be different per type, if not the default won't function correctly
         foreach ($authCNFOptions as $authType) {
@@ -90,6 +91,7 @@
             }
             $pconfig['ldap_read_properties'] = !empty($a_server[$id]['ldap_read_properties']);
             $pconfig['sync_memberof'] = !empty($a_server[$id]['ldap_sync_memberof']);
+            $pconfig['sync_memberof_constraint'] = !empty($a_server[$id]['ldap_sync_memberof_constraint']);
             $pconfig['sync_create_local_users'] = !empty($a_server[$id]['ldap_sync_create_local_users']);
             if (!empty($a_server[$id]['ldap_sync_memberof_groups'])) {
                 $pconfig['sync_memberof_groups'] = explode(",", $a_server[$id]['ldap_sync_memberof_groups']);
@@ -248,6 +250,7 @@
               }
               $server['ldap_read_properties'] = !empty($pconfig['ldap_read_properties']);
               $server['ldap_sync_memberof'] = !empty($pconfig['sync_memberof']);
+              $server['ldap_sync_memberof_constraint'] = !empty($pconfig['sync_memberof_constraint']);
               $server['ldap_sync_memberof_groups'] = !empty($pconfig['sync_memberof_groups']) ? implode(",", $pconfig['sync_memberof_groups']) : [];
               $server['ldap_sync_create_local_users'] = !empty($pconfig['sync_create_local_users']);
           } elseif ($server['type'] == "radius") {
@@ -323,7 +326,7 @@
 $all_authfields = array(
     'type','name','ldap_host','ldap_port','ldap_urltype','ldap_protver','ldap_scope',
     'ldap_basedn','ldap_authcn','ldap_extended_query','ldap_binddn','ldap_bindpw','ldap_attr_user',
-    'ldap_read_properties', 'sync_memberof', 'sync_create_local_users', 'radius_host',
+    'ldap_read_properties', 'sync_memberof', 'sync_memberof_constraint', 'sync_create_local_users', 'radius_host',
     'radius_auth_port','radius_acct_port','radius_secret','radius_timeout','radius_srvcs',
     'password_policy_duration', 'enable_password_policy_constraints',
     'password_policy_complexity', 'password_policy_length'
@@ -496,10 +499,16 @@
     $("#ldap_read_properties, #type").change(function(){
         if ($(this).is(":checked") || $("#type").val() == 'radius' ) {
             $("#sync_memberof").prop('disabled', false);
+            if ($("#type").val() !== 'radius') {
+                $("#sync_memberof_constraint").prop('disabled', false);
+            }
             $("#sync_memberof_groups").prop('disabled', false);
             $("#sync_create_local_users").prop('disabled', false);
         } else {
             $("#sync_memberof").prop('disabled', true);
+            if ($("#type").val() !== 'radius') {
+              $("#sync_memberof_constraint").prop('disabled', true);
+            }
             $("#sync_memberof_groups").prop('disabled', true);
             $("#sync_create_local_users").prop('disabled', true);
         }
@@ -813,6 +822,15 @@
                     </div>
                   </td>
                 </tr>
+                <tr class="auth_ldap auth_ldap-totp auth_options hidden">
+                  <td><a id="help_for_sync_memberof_constraint" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext('Constraint groups'); ?></td>
+                  <td>
+                    <input id="sync_memberof_constraint" name="sync_memberof_constraint" type="checkbox" <?= empty($pconfig['sync_memberof_constraint']) ? '' : 'checked="checked"';?> />
+                    <div class="hidden" data-for="help_for_sync_memberof_constraint">
+                      <?= gettext("Constraint allowed groups to those selected in the container section. This may offer additional security in cases where users are able to inject memberOf attributes in different trees.");?>
+                    </div>
+                  </td>
+                </tr>
                 <tr class="auth_ldap auth_radius auth_ldap-totp auth_options hidden">
                   <td><a id="help_for_sync_memberof_groups" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext('Limit groups'); ?></td>
                   <td>