dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): re-query LDAP group membership for active sessions (#46)

Browse Source 
Auth 0.5.0 (all five packages) adds the passwordless ILdapGroupLookup. A new
singleton DirectoryGroupRefresher asks it for a session's current groups once
the new zb:lastgrouprefresh anchor (stamped at login) is older than
ScadaBridge:Security:LdapGroupRefresh:IntervalMinutes (default 15, Enabled
default true, CacheSeconds 60 per-node answer reuse). CookieSessionValidator
replaces the stored groups and re-maps roles; this reaches HTTP and live
circuits (once per interval, independent of the 10 s circuit refresh).

Failure policy: directory unavailable keeps the stored groups (warn, all paths
incl. fail-closed mutation checks); user not found / disabled / ambiguous /
no groups ends the session. Inert under BindMode=User (NotSupported),
LDAP disabled, or DisableLogin.

Auth 0.4.4 ApiKeyFailure.StoreUnavailable now answers 503 SERVICE_UNAVAILABLE
on the inbound API instead of a misleading 401.

Docs: Component-Security.md, components/Security.md, Component-Host.md,
register row 23 closed.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
This commit is contained in:
Joseph Doherty
2026-11-12 20:31:51 -05:00
parent 139a43fb25
commit 9b0720af9c
16 changed files with 919 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Directory.Packages.props
+5 -5
View File
@@ -111,11 +111,11 @@
<PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.2.1" />
<PackageVersion Include="ZB.MOM.WW.MxGateway.Contracts" Version="0.2.1" />
<PackageVersion Include="ZB.MOM.WW.Configuration" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.Abstractions" Version="0.4.1" />
<PackageVersion Include="ZB.MOM.WW.Auth.Ldap" Version="0.4.1" />
<PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.4.1" />
<PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys.SqlServer" Version="0.4.1" />
<PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.4.1" />
<PackageVersion Include="ZB.MOM.WW.Auth.Abstractions" Version="0.5.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.Ldap" Version="0.5.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.5.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys.SqlServer" Version="0.5.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.5.0" />
<PackageVersion Include="ZB.MOM.WW.Audit" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Theme" Version="0.5.3" />
<PackageVersion Include="ZB.MOM.WW.Secrets" Version="0.6.2" />