Class: ActiveDirectory::Base
- Inherits:
-
Object
- Object
- ActiveDirectory::Base
- Defined in:
- lib/active_directory/base.rb
Overview
Base class for all Ruby/ActiveDirectory Entry Objects (like User and Group)
Constant Summary collapse
- NIL_FILTER =
A Net::LDAP::Filter object that doesn’t do any filtering (outside of check that the CN attribute is present. This is used internally for specifying a ‘no filter’ condition for methods that require a filter object.
Net::LDAP::Filter.pres('cn')
- @@ldap =
nil
- @@ldap_connected =
false
- @@caching =
false
- @@cache =
{}
Class Method Summary collapse
-
.cache? ⇒ Boolean
Check to see if result caching is enabled.
-
.class_name ⇒ Object
Pull the class we’re in This isn’t quite right, as extending the object does funny things to how we lookup objects.
-
.clear_cache ⇒ Object
Clears the cache.
-
.connected? ⇒ Boolean
Check to see if we are connected to the LDAP server This method will try to connect, if we haven’t already.
-
.create(dn, attributes) ⇒ Object
Create a new entry in the Active Record store.
-
.decode_field(name, value) ⇒ Object
:nodoc:.
-
.disable_cache ⇒ Object
Disable caching.
-
.enable_cache ⇒ Object
Enable caching for queries against the DN only This is to prevent membership lookups from hitting the AD unnecessarilly.
-
.encode_field(name, value) ⇒ Object
:nodoc:.
- .error ⇒ Object
-
.error? ⇒ Boolean
Check to see if the last query produced an error Note: Invalid username/password combinations will not produce errors.
-
.error_code ⇒ Object
Return the last errorcode that ldap generated.
-
.exists?(filter_as_hash) ⇒ Boolean
Check to see if any entries matching the passed criteria exists.
-
.filter ⇒ Object
:nodoc:.
-
.find(*args) ⇒ Object
Performs a search on the Active Directory store, with similar syntax to the Rails ActiveRecord#find method.
- .find_all(options) ⇒ Object
-
.find_cached_results(filters) ⇒ Object
Searches the cache and returns the result Returns false on failure, nil on wrong object type.
- .find_first(options) ⇒ Object
- .from_dn(dn) ⇒ Object
-
.get_field_type(name) ⇒ Object
Grabs the field type depending on the class it is called from Takes the field name as a parameter.
-
.make_filter(key, value) ⇒ Object
Makes a single filter from a given key and value It will try to encode an array if there is a process for it Otherwise, it will treat it as an or condition.
-
.make_filter_from_hash(hash) ⇒ Object
:nodoc:.
-
.method_missing(name, *args) ⇒ Object
:nodoc:.
-
.parse_finder_spec(method_name) ⇒ Object
:nodoc:.
-
.required_attributes ⇒ Object
:nodoc:.
-
.setup(settings) ⇒ Object
Configures the connection for the Ruby/ActiveDirectory library.
Instance Method Summary collapse
-
#==(other) ⇒ Object
:nodoc:.
-
#changed? ⇒ Boolean
Whether or not the entry has local changes that have not yet been replicated to the Active Directory server via a call to Base#save.
-
#destroy ⇒ Object
Deletes the entry from the Active Record store and returns true if the operation was successfully.
- #get_attr(name) ⇒ Object (also: #[])
-
#initialize(attributes = {}) ⇒ Base
constructor
FIXME: Need to document the Base::new.
-
#method_missing(name, args = []) ⇒ Object
:nodoc:.
-
#move(new_rdn) ⇒ Object
This method may one day provide the ability to move entries from container to container.
-
#new_record? ⇒ Boolean
Returns true if this entry does not yet exist in Active Directory.
-
#reload ⇒ Object
Refreshes the attributes for the entry with updated data from the domain controller.
-
#save ⇒ Object
Saves any pending changes to the entry by updating the remote entry.
- #set_attr(name, value) ⇒ Object (also: #[]=)
- #sid ⇒ Object
-
#to_ary ⇒ Object
Weird fluke with flattening, probably because of above attribute.
-
#update_attribute(name, value) ⇒ Object
Updates a single attribute (name) with one or more values (value), by immediately contacting the Active Directory server and initiating the update remotely.
-
#update_attributes(attributes_to_update) ⇒ Object
Updates multiple attributes, like ActiveRecord#update_attributes.
- #valid_attribute?(name) ⇒ Boolean
Constructor Details
#initialize(attributes = {}) ⇒ Base
FIXME: Need to document the Base::new
537 538 539 540 541 542 543 544 545 |
# File 'lib/active_directory/base.rb', line 537 def initialize(attributes = {}) # :nodoc: if attributes.is_a? Net::LDAP::Entry @entry = attributes @attributes = {} else @entry = nil @attributes = attributes end end |
Dynamic Method Handling
This class handles dynamic methods through the method_missing method
#method_missing(name, args = []) ⇒ Object
:nodoc:
636 637 638 639 640 641 642 643 644 645 646 |
# File 'lib/active_directory/base.rb', line 636 def method_missing(name, args = []) # :nodoc: name = name.to_s.downcase return set_attr(name.chop, args) if name[-1] == '=' if valid_attribute? name.to_sym get_attr(name) else super end end |
Class Method Details
.cache? ⇒ Boolean
Check to see if result caching is enabled
122 123 124 |
# File 'lib/active_directory/base.rb', line 122 def self.cache? @@caching end |
.class_name ⇒ Object
Pull the class we’re in This isn’t quite right, as extending the object does funny things to how we lookup objects
551 552 553 |
# File 'lib/active_directory/base.rb', line 551 def self.class_name @klass ||= (self.name.include?('::') ? self.name[/.*::(.*)/, 1] : self.name) end |
.clear_cache ⇒ Object
Clears the cache
128 129 130 |
# File 'lib/active_directory/base.rb', line 128 def self.clear_cache @@cache = {} end |
.connected? ⇒ Boolean
Check to see if we are connected to the LDAP server This method will try to connect, if we haven’t already
111 112 113 114 115 116 117 118 |
# File 'lib/active_directory/base.rb', line 111 def self.connected? begin @@ldap_connected ||= @@ldap.bind unless @@ldap.nil? @@ldap_connected rescue Net::LDAP::LdapError => e false end end |
.create(dn, attributes) ⇒ Object
Create a new entry in the Active Record store.
dn is the Distinguished Name for the new entry. This must be a unique identifier, and can be passed as either a Container or a plain string.
attributes is a symbol-keyed hash of attribute_name => value pairs.
463 464 465 466 467 468 469 470 471 472 473 474 475 476 |
# File 'lib/active_directory/base.rb', line 463 def self.create(dn,attributes) return nil if dn.nil? || attributes.nil? begin attributes.merge!(required_attributes) if @@ldap.add(:dn => dn.to_s, :attributes => attributes) ldap_obj= @@ldap.search(:base => dn.to_s) return new(ldap_obj[0]) else return nil end rescue return nil end end |
.decode_field(name, value) ⇒ Object
:nodoc:
567 568 569 570 571 572 573 |
# File 'lib/active_directory/base.rb', line 567 def self.decode_field(name, value) # :nodoc: type = get_field_type name if !type.nil? and ::ActiveDirectory::FieldType::const_defined? type return ::ActiveDirectory::FieldType::const_get(type).decode(value) end return value end |
.disable_cache ⇒ Object
Disable caching
142 143 144 |
# File 'lib/active_directory/base.rb', line 142 def self.disable_cache @@caching = false end |
.enable_cache ⇒ Object
Enable caching for queries against the DN only This is to prevent membership lookups from hitting the AD unnecessarilly
136 137 138 |
# File 'lib/active_directory/base.rb', line 136 def self.enable_cache @@caching = true end |
.encode_field(name, value) ⇒ Object
:nodoc:
575 576 577 578 579 580 581 |
# File 'lib/active_directory/base.rb', line 575 def self.encode_field(name, value) # :nodoc: type = get_field_type name if !type.nil? and ::ActiveDirectory::FieldType::const_defined? type return ::ActiveDirectory::FieldType::const_get(type).encode(value) end return value end |
.error ⇒ Object
90 91 92 |
# File 'lib/active_directory/base.rb', line 90 def self.error "#{@@ldap.get_operation_result.code}: #{@@ldap.get_operation_result.}" end |
.error? ⇒ Boolean
Check to see if the last query produced an error Note: Invalid username/password combinations will not produce errors
104 105 106 |
# File 'lib/active_directory/base.rb', line 104 def self.error? @@ldap.nil? ? false : @@ldap.get_operation_result.code != 0 end |
.error_code ⇒ Object
Return the last errorcode that ldap generated
96 97 98 |
# File 'lib/active_directory/base.rb', line 96 def self.error_code @@ldap.get_operation_result.code end |
.exists?(filter_as_hash) ⇒ Boolean
Check to see if any entries matching the passed criteria exists.
Filters should be passed as a hash of attribute_name => expected_value, like:
User.exists?(
:sn => 'Hunt',
:givenName => 'James'
)
which will return true if one or more User entries have an sn (surname) of exactly ‘Hunt’ and a givenName (first name) of exactly ‘James’.
Partial attribute matches are available. For instance,
Group.exists?(
:description => 'OldGroup_*'
)
would return true if there are any Group objects in Active Directory whose descriptions start with OldGroup_, like OldGroup_Reporting, or OldGroup_Admins.
Note that the * wildcard matches zero or more characters, so the above query would also return true if a group named ‘OldGroup_’ exists.
183 184 185 186 |
# File 'lib/active_directory/base.rb', line 183 def self.exists?(filter_as_hash) criteria = make_filter_from_hash(filter_as_hash) & filter (@@ldap.search(:filter => criteria).size > 0) end |
.filter ⇒ Object
:nodoc:
146 147 148 |
# File 'lib/active_directory/base.rb', line 146 def self.filter # :nodoc: NIL_FILTER end |
.find(*args) ⇒ Object
Performs a search on the Active Directory store, with similar syntax to the Rails ActiveRecord#find method.
The first argument passed should be either :first or :all, to indicate that we want only one (:first) or all (:all) results back from the resultant set.
The second argument should be a hash of attribute_name => expected_value pairs.
User.find(:all, :sn => 'Hunt')
would find all of the User objects in Active Directory that have a surname of exactly ‘Hunt’. As with the Base.exists? method, partial searches are allowed.
This method always returns an array if the caller specifies :all for the search e (first argument). If no results are found, the array will be empty.
If you call find(:first, …), you will either get an object (a User or a Group) back, or nil, if there were no entries matching your filter.
262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 |
# File 'lib/active_directory/base.rb', line 262 def self.find(*args) return false unless connected? = { :filter => (args[1].nil?) ? NIL_FILTER : args[1], :in => (args[1].nil?) ? '' : ( args[1][:in] || '' ) } [:filter].delete(:in) cached_results = find_cached_results(args[1]) return cached_results if cached_results or cached_results.nil? [:in] = [ [:in].to_s, @@settings[:base] ].delete_if { |part| part.empty? }.join(",") if [:filter].is_a? Hash [:filter] = make_filter_from_hash([:filter]) end [:filter] = [:filter] & filter unless self.filter == NIL_FILTER if (args.first == :all) find_all() elsif (args.first == :first) find_first() else raise ArgumentError, 'Invalid specifier (not :all, and not :first) passed to find()' end end |
.find_all(options) ⇒ Object
324 325 326 327 328 329 330 331 332 333 334 335 |
# File 'lib/active_directory/base.rb', line 324 def self.find_all() results = [] ldap_objs = @@ldap.search(:filter => [:filter], :base => [:in]) || [] ldap_objs.each do |entry| ad_obj = new(entry) @@cache[entry.dn] = ad_obj unless ad_obj.instance_of? Base results << ad_obj end results end |
.find_cached_results(filters) ⇒ Object
Searches the cache and returns the result Returns false on failure, nil on wrong object type
295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 |
# File 'lib/active_directory/base.rb', line 295 def self.find_cached_results(filters) return false unless cache? #Check to see if we're only looking for :distinguishedname return false unless filters.is_a? Hash and filters.keys == [:distinguishedname] #Find keys we're looking up dns = filters[:distinguishedname] if dns.kind_of? Array result = [] dns.each do |dn| entry = @@cache[dn] #If the object isn't in the cache just run the query return false if entry.nil? #Only permit objects of the type we're looking for result << entry if entry.kind_of? self end return result else return false unless @@cache.key? dns return @@cache[dns] if @@cache[dns].is_a? self end end |
.find_first(options) ⇒ Object
337 338 339 340 341 342 343 344 |
# File 'lib/active_directory/base.rb', line 337 def self.find_first() ldap_result = @@ldap.search(:filter => [:filter], :base => [:in]) return nil if ldap_result.empty? ad_obj = new(ldap_result[0]) @@cache[ad_obj.dn] = ad_obj unless ad_obj.instance_of? Base return ad_obj end |
.from_dn(dn) ⇒ Object
227 228 229 230 231 232 233 234 |
# File 'lib/active_directory/base.rb', line 227 def self.from_dn(dn) ldap_result = @@ldap.search(:filter => "(objectClass=*)", :base => dn) return nil unless ldap_result ad_obj = new(ldap_result[0]) @@cache[ad_obj.dn] = ad_obj unless ad_obj.instance_of? Base return ad_obj end |
.get_field_type(name) ⇒ Object
Grabs the field type depending on the class it is called from Takes the field name as a parameter
558 559 560 561 562 563 |
# File 'lib/active_directory/base.rb', line 558 def self.get_field_type(name) #Extract class name throw "Invalid field name" if name.nil? type = ::ActiveDirectory.special_fields[class_name.to_sym][name.to_s.downcase.to_sym] type.to_s unless type.nil? end |
.make_filter(key, value) ⇒ Object
Makes a single filter from a given key and value It will try to encode an array if there is a process for it Otherwise, it will treat it as an or condition
200 201 202 203 204 205 206 207 208 209 210 211 212 213 |
# File 'lib/active_directory/base.rb', line 200 def self.make_filter(key, value) #Join arrays using OR condition if value.is_a? Array filter = ~NIL_FILTER value.each do |v| filter |= Net::LDAP::Filter.eq(key, encode_field(key, v).to_s) end else filter = Net::LDAP::Filter.eq(key, encode_field(key, value).to_s) end return filter end |
.make_filter_from_hash(hash) ⇒ Object
:nodoc:
215 216 217 218 219 220 221 222 223 224 225 |
# File 'lib/active_directory/base.rb', line 215 def self.make_filter_from_hash(hash) # :nodoc: return NIL_FILTER if hash.nil? || hash.empty? filter = NIL_FILTER hash.each do |key, value| filter &= make_filter(key, value) end return filter end |
.method_missing(name, *args) ⇒ Object
:nodoc:
346 347 348 349 350 351 352 353 354 355 356 357 |
# File 'lib/active_directory/base.rb', line 346 def self.method_missing(name, *args) # :nodoc: name = name.to_s if (name[0,5] == 'find_') find_spec, attribute_spec = parse_finder_spec(name) raise ArgumentError, "find: Wrong number of arguments (#{args.size} for #{attribute_spec.size})" unless args.size == attribute_spec.size filters = {} [attribute_spec,args].transpose.each { |pr| filters[pr[0]] = pr[1] } find(find_spec, :filter => filters) else super name.to_sym, args end end |
.parse_finder_spec(method_name) ⇒ Object
:nodoc:
359 360 361 362 363 364 365 366 367 368 369 |
# File 'lib/active_directory/base.rb', line 359 def self.parse_finder_spec(method_name) # :nodoc: # FIXME: This is a prime candidate for a # first-class object, FinderSpec method_name = method_name.gsub(/^find_/,'').gsub(/^by_/,'first_by_') find_spec, attribute_spec = *(method_name.split('_by_')) find_spec = find_spec.to_sym attribute_spec = attribute_spec.split('_and_').collect { |s| s.to_sym } return find_spec, attribute_spec end |
.required_attributes ⇒ Object
:nodoc:
150 151 152 |
# File 'lib/active_directory/base.rb', line 150 def self.required_attributes # :nodoc: {} end |
.setup(settings) ⇒ Object
Configures the connection for the Ruby/ActiveDirectory library.
For example:
ActiveDirectory::Base.setup(
:host => 'domain_controller1.example.org',
:port => 389,
:base => 'dc=example,dc=org',
:auth => {
:method => :simple,
:username => '[email protected]',
:password => 'querying_users_password'
}
)
This will configure Ruby/ActiveDirectory to connect to the domain controller at domain_controller1.example.org, using port 389. The domain’s base LDAP dn is expected to be ‘dc=example,dc=org’, and Ruby/ActiveDirectory will try to bind as the [email protected] user, using the supplied password.
Currently, there can be only one active connection per execution context.
For more advanced options, refer to the Net::LDAP.new documentation.
84 85 86 87 88 |
# File 'lib/active_directory/base.rb', line 84 def self.setup(settings) @@settings = settings @@ldap_connected = false @@ldap = Net::LDAP.new(settings) end |
Instance Method Details
#==(other) ⇒ Object
:nodoc:
371 372 373 374 |
# File 'lib/active_directory/base.rb', line 371 def ==(other) # :nodoc: return false if other.nil? other[:objectguid] == get_attr(:objectguid) end |
#changed? ⇒ Boolean
Whether or not the entry has local changes that have not yet been replicated to the Active Directory server via a call to Base#save
192 193 194 |
# File 'lib/active_directory/base.rb', line 192 def changed? !@attributes.empty? end |
#destroy ⇒ Object
Deletes the entry from the Active Record store and returns true if the operation was successfully.
482 483 484 485 486 487 488 489 490 491 492 |
# File 'lib/active_directory/base.rb', line 482 def destroy return false if new_record? if @@ldap.delete(:dn => distinguishedName) @entry = nil @attributes = {} return true else return false end end |
#get_attr(name) ⇒ Object Also known as: []
587 588 589 590 591 592 593 594 595 596 597 598 599 |
# File 'lib/active_directory/base.rb', line 587 def get_attr(name) name = name.to_s.downcase return self.class.decode_field(name, @attributes[name.to_sym]) if @attributes.has_key?(name.to_sym) if @entry.attribute_names.include? name.to_sym value = @entry[name.to_sym] value = value.first if value.kind_of?(Array) && value.size == 1 value = value.to_s if value.nil? || value.size == 1 value = nil.to_s if value.empty? return self.class.decode_field(name, value) end end |
#move(new_rdn) ⇒ Object
This method may one day provide the ability to move entries from container to container. Currently, it does nothing, as we are waiting on the Net::LDAP folks to either document the Net::LDAP#modrdn method, or provide a similar method for moving / renaming LDAP entries.
514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 |
# File 'lib/active_directory/base.rb', line 514 def move(new_rdn) return false if new_record? puts "Moving #{distinguishedName} to RDN: #{new_rdn}" settings = @@settings.dup settings[:port] = 636 settings[:encryption] = { :method => :simple_tls } ldap = Net::LDAP.new(settings) if ldap.rename( :olddn => distinguishedName, :newrdn => new_rdn, :delete_attributes => false ) return true else puts Base.error return false end end |
#new_record? ⇒ Boolean
Returns true if this entry does not yet exist in Active Directory.
379 380 381 |
# File 'lib/active_directory/base.rb', line 379 def new_record? @entry.nil? end |
#reload ⇒ Object
Refreshes the attributes for the entry with updated data from the domain controller.
387 388 389 390 391 392 |
# File 'lib/active_directory/base.rb', line 387 def reload return false if new_record? @entry = @@ldap.search(:filter => Net::LDAP::Filter.eq('distinguishedName',distinguishedName))[0] return !@entry.nil? end |
#save ⇒ Object
Saves any pending changes to the entry by updating the remote entry.
498 499 500 501 502 503 504 505 |
# File 'lib/active_directory/base.rb', line 498 def save if update_attributes(@attributes) @attributes = {} return true else return false end end |
#set_attr(name, value) ⇒ Object Also known as: []=
601 602 603 |
# File 'lib/active_directory/base.rb', line 601 def set_attr(name, value) @attributes[name.to_sym] = self.class.encode_field(name, value) end |
#sid ⇒ Object
617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 |
# File 'lib/active_directory/base.rb', line 617 def sid unless @sid raise "Object has no sid" unless valid_attribute? :objectsid # SID is stored as a binary in the directory # however, Net::LDAP returns an hex string # # As per [1], there seems to be 2 ways to get back binary data. # # [str].pack("H*") # str.gsub(/../) { |b| b.hex.chr } # # [1] : # http://stackoverflow.com/questions/22957688/convert-string-with-hex-ascii-codes-to-characters # @sid = SID.read([get_attr(:objectsid)].pack("H*")) end @sid.to_s end |
#to_ary ⇒ Object
Weird fluke with flattening, probably because of above attribute
614 615 |
# File 'lib/active_directory/base.rb', line 614 def to_ary end |
#update_attribute(name, value) ⇒ Object
Updates a single attribute (name) with one or more values (value), by immediately contacting the Active Directory server and initiating the update remotely.
Entries are always reloaded (via Base.reload) after calling this method.
402 403 404 |
# File 'lib/active_directory/base.rb', line 402 def update_attribute(name, value) update_attributes(name.to_s => value) end |
#update_attributes(attributes_to_update) ⇒ Object
Updates multiple attributes, like ActiveRecord#update_attributes. The updates are immediately sent to the server for processing, and the entry is reloaded after the update (if all went well).
411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 |
# File 'lib/active_directory/base.rb', line 411 def update_attributes(attributes_to_update) return true if attributes_to_update.empty? rename = false operations = [] attributes_to_update.each do |attribute, values| if attribute == :cn rename = true else if values.nil? || values.empty? operations << [ :delete, attribute, nil ] else values = [values] unless values.is_a? Array values = values.collect { |v| v.to_s } current_value = begin @entry[attribute] rescue NoMethodError nil end operations << [ (current_value.nil? ? :add : :replace), attribute, values ] end end end if not operations.empty? @@ldap.modify( :dn => distinguishedName, :operations => operations ) end if rename @@ldap.modify( :dn => distinguishedName, :operations => [[ (name.nil? ? :add : :replace), 'samaccountname', attributes_to_update[:cn] ]] ) @@ldap.rename(:olddn => distinguishedName, :newrdn => "cn=" + attributes_to_update[:cn], :delete_attributes => true) end reload end |
#valid_attribute?(name) ⇒ Boolean
583 584 585 |
# File 'lib/active_directory/base.rb', line 583 def valid_attribute? name @attributes.has_key?(name) || @entry.attribute_names.include?(name) end |