Bridge agent JavaScript Plugins

# Example docker-compose.yml
version: "3"

services:
    verify-bridge:
         image: icr.io/isv-saas/verify-bridge:latest


         container_name: bridge_agent
         volumes:
                - ./jsconfig:/go/src/jsconfig:ro
                - ./jsplugins:/go/src/jsplugins:ro
                - ./cert/:/cert:ro

         environment:
                TRACE: "true"
                LICENSE_ACCEPT: "yes"
                TENANT_URI: "https://tenant.verify.ibm.com"
                CLIENT_ID: "12345678-1234-1234-1234-123456789012"
                CLIENT_SECRET: "ABCDEFGHIJ"
          
                
        restart: always

- ./jsconfig:/go/src/jsconfig:ro
- ./jsplugins:/go/src/jsplugins:ro
- ./cert/:/cert:ro

{
  "pluginName": "ldap",
  "pluginType": "ldap",
  "executionOrder": 2,
  "hardFail": false,
  "authenticationSource": {
    "isAuthenticationSource": false,
    "disablePrimaryLDAPLookup": false
  },
  "bindingConfig": {
    "bindDn": "cn=admin,dc=ibm,dc=com",
    "bindPassword": "pass",
    "uris": ["ldaps://host.docker.internal:8636", "http://localhost:8389"],
    "maxPoolSize": 50,
    "agedTimeout": 60,
    "connectTimeout": 5,
    "filter": "(|(|(objectclass=ePerson)(objectclass=person))(objectclass=User))",
    "userObjectClasses": "top,Person,organizationalPerson,inetOrgPerson",
    "selector": "objectClass,cn,sn,givenName,userPassword,streetAddress,seeAlso,mobile",
    "baseDn": "dc=ibm,dc=com"
    "tlsConfig": {
      "caCert": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIB...\n-----END CERTIFICATE-----\n",
      "insecureSkipVerify": false,
      "tlsMinVersion": 771,
      "clientCertLabel": "ldap.client"
    }
  }
}

{
  "pluginName": "PgPlug",
  "pluginType": "postgres",
  "executionOrder": 1,
  "hardFail": true,
  "authenticationSource": {
    "isAuthenticationSource": true,
    "disablePrimaryLDAPLookup": true
  },
  "bindingConfig": {
    "connectionString": "host=host.docker.internal port=8788 dbname=postgres user=postgres password=postgrespassword connect_timeout=5",
    "maxPoolSize": 50,
    "minPoolSize": 10,
    "agedTimeout": 60,
    "maxIdleTime": 10
  },
  "custom": {
    "table": "users"
  }
}

let rp = JSON.parse(requestParameters);
let wo = JSON.parse(workingObject);
let pc = JSON.parse(pluginConfig);

{
  "addressedTo": "ldapauth",
  "enqueuedTime": "2023-10-15 05:15:36.769",
  "id": "jobUuId",
  "operation": "password-verify",
  "parameters": { 
       "password": "Passw0rd", 
       "username": "Scott" 
   }
}

{
  "addressedTo": "ldapauth",
  "enqueuedTime": "2023-10-15 05:15:36.769",
  "id": "jobUuId",
  "operation": "password-change",
  "parameters": { 
       "oldpassword": "OldPassw0rd", 
       "newpassword": "NewPassw0rd", 
       "username": "Scott" 
   }
}

{
  "groups": [],
  "user": {
    "dn": ["uid=scott,ou=Verify,dc=ibm,dc=com"],
    "mail": ["[email protected]"],
    "mobile": ["+61 2345 6789"],
    "sn": ["Administrator"],
    "uid": ["scott"]
  }
}

// pluginConfig value that will be passed to the PgPlug.js plugin
{
  "pluginName": "PgPlug",
  "pluginType": "postgres",
  "executionOrder": 1,
  "hardFail": true,
  "authenticationSource": {
    "isAuthenticationSource": true,
    "disablePrimaryLDAPLookup": true
  },
  "bindingConfig": {
    "connectionString": "host=host.docker.internal port=8788 dbname=postgres user=postgres password=postgrespassword connect_timeout=5",
    "maxPoolSize": 50,
    "minPoolSize": 10,
    "agedTimeout": 60,
    "maxIdleTime": 10
  },
  "userAttributes": [ // These attributes sourced from ISV
       "phone",
       "address",
       "sn" 
  ]
  "custom": {
    "table": "users"
  }
}

let pc = JSON.parse(pluginConfig);
let requestedAttributes = pc.userAttributes; // Array of attributes requested for this user

importClass(logger);

importClass(logger); // Import logger at the top of your plugin script

// Log with logging level info
logger.info(`Plugin script logging with level info`)

time="2023-10-24T11:15:47Z" level=<log level> msg="log message" func=pkg.binding.logger.log

// Place this at the top of your Plugin.js file
importClass(database);

database.query(serverName, query); 

{
       "sql": "query string", 
       "args": [
              ["argument 1", "argument 2"]
       ]
}

// Db2 style substitution using the `?` symbol
result = database.query(serverName, {
       "sql": "SELECT * FROM USERS WHERE ID = ? AND PASSWORD = ?",
       "args": [
              ["scott", "Password"]
       ]
}); 

// Postgres style substitution using the `$1` symbol
result = database.query(serverName, {
       "sql": "SELECT * FROM USERS WHERE ID = $1 AND PASSWORD = $1",
       "args": [
              ["scott", "Password"]
       ]
}); 

{
  "rowsAffected": 0, // Rows changed
  "rows": [          // Array of objects representing each row. Each property represents a column and its value
    {
      "CREATED_ON": "2023-11-02T00:00:00Z",
      "EMAIL": "[email protected]",
      "ISLOCKED": false,
      "LAST_LOGIN": "2023-10-24T00:00:00Z",
      "PASSWORD": "scottpass",
      "PGATTR": "scottpsec1234",
      "USERNAME": "Scott",
      "USER_ID": 2
    }
  ]
}

{"rowsAffected":0,"rows":null}

{ "error": "the error string" }

result = database.execute(serverName, query)

result = database.execute(serverName,
  {
    "sql": "DELETE FROM TEST_DB_BINDING WHERE ID = ?",
    "args": [
      ["test_key001"],
      ["test_key002"]
    ]
  }
);

result = database.ping(serverName);

{"rowsAffected":0,"rows":null}

importClass(ldapUserLookupHelper);

// Initialize new user lookup helper
let pc = JSON.parse(pluginConfig);
let configName = `${pc.pluginName}_config`
let userLookupHelper = new UserLookupHelper(configName);

let ulh = new UserLookupHelper(configName);
user = ulh.getUser(`Scott`) // returned user is a User object for the user with id `Scott`

// Add import to the top of your javascript plugin
importClass(ldapAttributeUtil);

// Initialize attribute util
let pc = JSON.parse(pluginConfig);
let configName = `${pc.pluginName}_config`
let attrUtil = new LdapAttributeUtil(configName);

// createSubContext(dn, attributes)
attrUtil.createSubContext("ou=newOu1", {"objectClass": ["top", "organizationalUnit"]}

{
  "name": "attributeName", // The attribute name
  "attrs": [] // Array of attribute values
}

// Define this object at the end of your plugin script
outputData = {
  status: {
    result: "Success",
    message: "",
  },
  parameters: {
    groups: [
      {
        name: "AGroup1",
        id: "AGroup1Id1",
      },
      {
        name: "AGroup2",
        id: "AGroup2Id2",
      },
    ],
    user: {
      attribute1: ["value for attribute 1"],
      attribute2: ["value for attribute 2"],
    },
  },
};

curl --request GET \
  --url https://tenant.verify.ibm.com/v2.0/Groups \
  --header 'authorization: Bearer <token>'

// Response from /v2.0/Groups
{
  "displayName": "developer",
  "meta": {
    "created": "2023-03-15T04:52:32Z",
    "lastModified": "2023-03-15T05:06:57Z"
  },
  "id": "60500081MT",
  "urn:ietf:params:scim:schemas:extension:ibm:2.0:Group": {
    "totalMembers": 1,
    "groupType": "reserved",
    "description": ""
  }
}

// LDAP minimal scaffold

// Import binding functions
importClass(logger);
importClass(ldapUserLookupHelper);

// Parse Input Objects
let rp = JSON.parse(requestParameters);
let wo = JSON.parse(workingObject);
let pc = JSON.parse(pluginConfig);

// Initialize the UserLookupHelper
let configName = `${pc.pluginName}_config`;
let userLookupHelper = new UserLookupHelper(configName);

// Define the output object to be returned
let output = {
  status: {
    result: "",
    message: "",
  },
  parameters: {
    groups: [],
    user: {},
  },
};

// Inserting main logic inside a function allows for `return` to be used in order to break execution
let process = () => {
  // TODO: Insert plugin logic here
};
process();

// End script by defining the outputData object
let outputData = output;

// simpleLdapLookup.js - Simple 

// Import binding functions
importClass(logger);
importClass(ldapUserLookupHelper);

// Parse Input Objects
let rp = JSON.parse(requestParameters);
let wo = JSON.parse(workingObject);
let pc = JSON.parse(pluginConfig);

// Initialize the UserLookupHelper
let configName = `${pc.pluginName}_config`;
let userLookupHelper = new UserLookupHelper(configName);

// Define the output object to be returned
let output = {
  status: {
    result: "",
    message: "",
  },
  parameters: {
    groups: [],
    user: {},
  },
};

// Inserting main logic inside a function allows for `return` to be used in order to break execution
let process = () => {
  // Get the requested user
  let userName = rp.parameters.username;

  // Get the requested attributes
  let requestedAttributes = pc.userAttributes;
  if (!Array.isArray(requestedAttributes)) {
    requestedAttributes = Array.from([requestedAttributes]);
  }

  // Get the user
  let user = userLookupHelper.getUser(userName);

  // Check if user has error
  if (user.hasError()) {
    // Get the error object
    let errorString = user.getError();

    // Log error
    logger.info(`Unable to get user: ${errorString}`);

    // Update the output object with the error
    output.status.result = "ERROR";
    output.status.message = errorString;

    // Return will break execution and cause the output object to return with the above error
    return;
  }

  // Get the requested attributes
  requestedAttributes.forEach((attrName) => {
    // Retrieve this attribute from the user
    output.parameters.user[attrName] = user.getAttribute(attrName);
  });

  // Set the status to successful
  output.status.result = "SUCCESS";
};
process();

// End script by defining the outputData object
let outputData = output;

// simpleLdapAuth_config.json
"authenticationSource": {
  "isAuthenticationSource": true,
  "disablePrimaryLDAPLookup": true
},

// simpleLdapAuth.js

// Import binding functions
importClass(logger);
importClass(ldapUserLookupHelper);

// Parse Input Objects
let rp = JSON.parse(requestParameters);
let wo = JSON.parse(workingObject);
let pc = JSON.parse(pluginConfig);

// Initialize the UserLookupHelper
let configName = `${pc.pluginName}_config`;
let userLookupHelper = new UserLookupHelper(configName);

// Define the output object to be returned
let output = {
  status: {
    result: "",
    message: "",
  },
  parameters: {
    groups: [],
    user: {},
  },
};

// Inserting main logic inside a function allows for `return` to be used in order to break execution
let process = () => {
  // Get the requested user
  let userName = rp.parameters.username;
  let password = rp.parameters.password;

  // Get the requested attributes
  let requestedAttributes = pc.userAttributes;
  if (!Array.isArray(requestedAttributes)) {
    requestedAttributes = Array.from([requestedAttributes]);
  }

  // Get the user
  let user = userLookupHelper.getUser(userName);

  // Check if user has error
  if (user.hasError()) {
    // Get the error object
    let errorString = user.getError();

    // Log error
    logger.info(`Unable to get user: ${errorString}`);

    // Update the output object with the error
    output.status.result = "ERROR";
    output.status.message = errorString;

    // Return will break execution and cause the output object to return with the above error
    return;
  }

  // Perform authentication
  if (user.authenticate(password) !== true) {
    output.status.result = "PASSWORD_NOT_VALID";
    output.status.message = "Invalid user password";
    return;
  }

  // Get the requested attributes
  requestedAttributes.forEach((attrName) => {
    // Retrieve this attribute from the user
    output.parameters.user[attrName] = user.getAttribute(attrName);
  });

  // Set the status to successful
  output.status.result = "SUCCESS";
};
process();

// End script by defining the outputData object
let outputData = output;

// Perform authentication
if (user.authenticate(password) !== true) {
  output.status.result = "PASSWORD_NOT_VALID";
  output.status.message = "Invalid user password";
  return;
}

// LdapAttributeUtil Example

// Import binding functions
importClass(logger);
importClass(ldapUserLookupHelper);
importClass(ldapAttributeUtil);


// Parse Input Objects
let rp = JSON.parse(requestParameters);
let wo = JSON.parse(workingObject);
let pc = JSON.parse(pluginConfig);

// Initialize the UserLookupHelper
let configName = `${pc.pluginName}_config`;
let userLookupHelper = new UserLookupHelper(configName);
let attrUtil = new LdapAttributeUtil(configName)


// Define the output object to be returned
let output = {
  status: {
    result: "",
    message: "",
  },
  parameters: {
    groups: [],
    user: {},
  },
};

// Inserting main logic inside a function allows for `return` to be used in order to break execution
let process = () => {

  if (!attrUtil.isReady()) {
    output.status.result = "ERROR";
    output.status.message = "Attribute Utility failed healthcheck";
    return;
  }

  // Random integer for sub context
  let rand = Math.floor(Math.random() * 100);
  let newOu = `ou=newOu${rand}`;

  // Create a new sub context
  let resultCreateSubContextErr = attrUtil.createSubContext(newOu, {"objectClass": ["top", "organizationalUnit"]});
  if (resultCreateSubContextErr.hasError()) {
    let error = resultCreateSubContextErr.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Created sub context entry ${newOu}`);

  // Create an attribute
  let attributeName = "description";
  let attributeValue = "1234";
  let attributeValue2 = "4567";
  let resultAddAttributeValue = attrUtil.addAttributeValue(newOu, attributeName, attributeValue);
  if (resultAddAttributeValue.hasError()) {
    let error = resultAddAttributeValue.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Added attribute ${attributeName} with value ${attributeValue} to the entry ${newOu}`);

  // Validate that the entry has been written successfully by retrieving the value
  let resultGetAttributeValue = attrUtil.getAttributeValue(newOu, ['description']);
  if (resultGetAttributeValue.hasError()) {
    let error = resultGetAttributeValue.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }

  // Check value is correct
  let retrievedAttr = resultGetAttributeValue.getAttributes().get(attributeName).get(0); 
  if (retrievedAttr !== attributeValue) {
    let error = `Retrieved attribute ${retrievedAttr}, expected ${attributeValue}`;
    logger.info(error);
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Retrieved attribute ${retrievedAttr}, matches expected ${attributeValue}`);

  // Modify the new entries description value
  let resultSetAttributeValue = attrUtil.setAttributeValue(newOu, attributeName, attributeValue2);
  if (resultSetAttributeValue.hasError()) {
    let error = resultSetAttributeValue.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Set entry ${newOu} attribute ${attributeName} to value ${attributeValue2}`);

  // Remove the description value
  let resultRemoveAttribute = attrUtil.removeAttribute(newOu, attributeName, attributeValue2);
  if (resultRemoveAttribute.hasError()) {
    let error = resultRemoveAttribute.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Removed attribute ${attributeName} with value ${attributeValue2} from entry ${newOu}`);

  // Perform a search
  let resultSearch = attrUtil.search(newOu, "(objectclass=top)");
  if (resultSearch.hasError()) {
    let error = resultSearch.getError();
    output.status.result = "ERROR";
    output.status.message = error;
    return;
  }
  logger.info(`Removed attribute ${attributeName} with value ${attributeValue2} from entry ${newOu}`);

  // Enumerate through the search results
  let searchEnumerator = resultSearch.getNamingEnumeration();
  let i = 0;
  while (searchEnumerator.hasMore()) {
    let searchResult = searchEnumerator.next();
    logger.info(`Search results [${i}]: ${searchResult.getName()}`);
  }


  // Set the status to successful
  output.status.result = "SUCCESS";
};
process();

// End script by defining the outputData object
let outputData = output;