Class: Devise::LdapAdapter::LdapConnect

Inherits:
Object
  • Object
show all
Defined in:
lib/devise_ldap_authenticatable/ldap_adapter.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ LdapConnect

Returns a new instance of LdapConnect.



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 73

def initialize(params = {})
  ldap_config = YAML.load(ERB.new(File.read(::Devise.ldap_config || "#{Rails.root}/config/ldap.yml")).result)[Rails.env]
  ldap_options = params
  ldap_config["ssl"] = :simple_tls if ldap_config["ssl"] === true
  ldap_options[:encryption] = ldap_config["ssl"].to_sym if ldap_config["ssl"]

  @ldap = Net::LDAP.new(ldap_options)
  @ldap.host = ldap_config["host"]
  @ldap.port = ldap_config["port"]
  @ldap.base = ldap_config["base"]
  @attribute = ldap_config["attribute"]
  @ldap_auth_username_builder = params[:ldap_auth_username_builder]

  @group_base = ldap_config["group_base"]
  @required_groups = ldap_config["required_groups"]
  @required_attributes = ldap_config["require_attribute"]

  @ldap.auth ldap_config["admin_user"], ldap_config["admin_password"] if params[:admin]

  @login = params[:login]
  @password = params[:password]
  @new_password = params[:new_password]
end

Instance Attribute Details

#ldap ⇒ Object (readonly)

Returns the value of attribute ldap.



71
72
73
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 71

def ldap
  @ldap
end

#login ⇒ Object (readonly)

Returns the value of attribute login.



71
72
73
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 71

def 
  @login
end

Instance Method Details

#authenticate! ⇒ Object 



132
133
134
135
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 132

def authenticate!
  @ldap.auth(dn, @password)
  @ldap.bind
end

#authenticated? ⇒ Boolean

Returns:

  • (Boolean) 


137
138
139
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 137

def authenticated?
  authenticate!
end

#authorized? ⇒ Boolean

Returns:

  • (Boolean) 


141
142
143
144
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 141

def authorized?
  DeviseLdapAuthenticatable::Logger.send("Authorizing user #{dn}")
  authenticated? && in_required_groups? && has_required_attribute?
end

#change_password! ⇒ Object 



146
147
148
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 146

def change_password!
  update_ldap(:userpassword => Net::LDAP::Password.generate(:sha, @new_password))
end

#dn ⇒ Object 



101
102
103
104
105
106
107
108
109
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 101

def dn
  DeviseLdapAuthenticatable::Logger.send("LDAP dn lookup: #{@attribute}=#{@login}")
  ldap_entry = 
  if ldap_entry.nil?
    @ldap_auth_username_builder.call(@attribute,@login,@ldap)
  else
    ldap_entry.dn
  end
end

#has_required_attribute? ⇒ Boolean

Returns:

  • (Boolean) 


189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 189

def has_required_attribute?
  return true unless ::Devise.ldap_check_attributes

  admin_ldap = LdapConnect.admin

  user = find_ldap_user(admin_ldap)

  @required_attributes.each do |key,val|
    unless user[key].include? val
      DeviseLdapAuthenticatable::Logger.send("User #{dn} did not match attribute #{key}:#{val}")
      return false
    end
  end

  return true
end

#in_required_groups? ⇒ Boolean

Returns:

  • (Boolean) 


150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 150

def in_required_groups?
  return true unless ::Devise.ldap_check_group_membership

  ## FIXME set errors here, the ldap.yml isn't set properly.
  return false if @required_groups.nil?

  admin_ldap = LdapConnect.admin

  for group in @required_groups
    if group.is_a?(Array)
      group_attribute, group_name = group
    else
      group_attribute = "uniqueMember"
      group_name = group
    end
    unless ::Devise.ldap_ad_group_check
      admin_ldap.search(:base => group_name, :scope => Net::LDAP::SearchScope_BaseObject) do |entry|
        unless entry[group_attribute].include? dn
          DeviseLdapAuthenticatable::Logger.send("User #{dn} is not in group: #{group_name }")
          return false
        end
      end
    else
      # AD optimization - extension will recursively check sub-groups with one query
      # "(memberof:1.2.840.113556.1.4.1941:=group_name)"
      search_result = admin_ldap.search(:base => dn,
                        :filter => Net::LDAP::Filter.ex("memberof:1.2.840.113556.1.4.1941", group_name),
                        :scope => Net::LDAP::SearchScope_BaseObject)
      # Will return  the user entry if belongs to group otherwise nothing
      unless search_result.length == 1 && search_result[0].dn.eql?(dn)
        DeviseLdapAuthenticatable::Logger.send("User #{dn} is not in group: #{group_name }")
        return false
      end
    end
  end

  return true
end

#ldap_param_value(param) ⇒ Object 



111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 111

def ldap_param_value(param)
  filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
  ldap_entry = nil
  @ldap.search(:filter => filter) {|entry| ldap_entry = entry}

  if ldap_entry
    if ldap_entry[param]
      DeviseLdapAuthenticatable::Logger.send("Requested param #{param} has value #{ldap_entry.send(param)}")
      value = ldap_entry.send(param)
      value = value.first if value.is_a?(Array) and value.count == 1
      value
    else
      DeviseLdapAuthenticatable::Logger.send("Requested param #{param} does not exist")
      value = nil
    end
  else
    DeviseLdapAuthenticatable::Logger.send("Requested ldap entry does not exist")
    value = nil
  end
end

#search_for_login ⇒ Object

Searches the LDAP for the login

Returns:

  • (Object) —

    the LDAP entry found; nil if not found



221
222
223
224
225
226
227
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 221

def 
  DeviseLdapAuthenticatable::Logger.send("LDAP search for login: #{@attribute}=#{@login}")
  filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
  ldap_entry = nil
  @ldap.search(:filter => filter) {|entry| ldap_entry = entry}
  ldap_entry
end

#set_param(param, new_value) ⇒ Object 



97
98
99
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 97

def set_param(param, new_value)
  update_ldap( { param.to_sym => new_value } )
end

#user_groups ⇒ Object 



206
207
208
209
210
211
212
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 206

def user_groups
  admin_ldap = LdapConnect.admin

  DeviseLdapAuthenticatable::Logger.send("Getting groups for #{dn}")
  filter = Net::LDAP::Filter.eq("uniqueMember", dn)
  admin_ldap.search(:filter => filter, :base => @group_base).collect(&:dn)
end

#valid_login? ⇒ Boolean

Returns:

  • (Boolean) 


214
215
216
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 214

def valid_login?
  !.nil?
end