Class: Cratus::User

Inherits:
Object
  • Object
show all
Includes:
Comparable
Defined in:
lib/cratus/user.rb

Overview

An LDAP User representation

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(username) ⇒ User

Returns a new instance of User.



7
8
9
10
11
 
# File 'lib/cratus/user.rb', line 7

def initialize(username)
  @username = username
  @search_base = self.class.ldap_search_base
  refresh
end

Instance Attribute Details

#search_base ⇒ Object (readonly)

Returns the value of attribute search_base.



5
6
7
 
# File 'lib/cratus/user.rb', line 5

def search_base
  @search_base
end

#username ⇒ Object (readonly)

Returns the value of attribute username.



5
6
7
 
# File 'lib/cratus/user.rb', line 5

def username
  @username
end

Class Method Details

.all ⇒ Object

All the LDAP Users



158
159
160
161
162
163
164
165
166
167
 
# File 'lib/cratus/user.rb', line 158

def self.all
  raw_results = Cratus::LDAP.search(
    "(objectClass=#{ldap_object_class})",
    basedn: ldap_search_base,
    attrs: ldap_dn_attribute
  )
  raw_results.map do |entry|
    new(entry[ldap_dn_attribute.to_sym].last)
  end
end

.ldap_dn_attribute ⇒ Object 



169
170
171
 
# File 'lib/cratus/user.rb', line 169

def self.ldap_dn_attribute
  Cratus.config.user_dn_attribute.to_s
end

.ldap_object_class ⇒ Object 



173
174
175
 
# File 'lib/cratus/user.rb', line 173

def self.ldap_object_class
  Cratus.config.user_objectclass.to_s
end

.ldap_return_attributes ⇒ Object 



177
178
179
180
181
182
183
184
185
186
187
 
# File 'lib/cratus/user.rb', line 177

def self.ldap_return_attributes
  [
    Cratus.config.user_dn_attribute.to_s,
    Cratus.config.user_department_attribute.to_s,
    Cratus.config.user_mail_attribute.to_s,
    Cratus.config.user_displayname_attribute.to_s,
    Cratus.config.user_memberof_attribute.to_s,
    Cratus.config.user_lockout_attribute.to_s,
    Cratus.config..to_s
  ]
end

.ldap_search_base ⇒ Object 



189
190
191
 
# File 'lib/cratus/user.rb', line 189

def self.ldap_search_base
  Cratus.config.user_basedn.to_s
end

Instance Method Details

#<=>(other) ⇒ Object 



153
154
155
 
# File 'lib/cratus/user.rb', line 153

def <=>(other)
  @username <=> other.username
end

#add_to_group(group) ⇒ Object

Add a user to a group



14
15
16
17
18
 
# File 'lib/cratus/user.rb', line 14

def add_to_group(group)
  raise 'InvalidGroup' unless group.respond_to?(:add_user)
  # just be lazy and hand off to the group to do the work...
  group.add_user(self)
end

#department ⇒ Object 



27
28
29
 
# File 'lib/cratus/user.rb', line 27

def department
  @raw_ldap_data[Cratus.config.user_department_attribute].last
end

#disable ⇒ Object

Disables an enabled user



32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/cratus/user.rb', line 32

def disable
  if enabled?
    Cratus::LDAP.replace_attribute(
      dn,
      Cratus.config.,
      ['514']
    )
    refresh
  else
    true
  end
end

#disabled? ⇒ Boolean

Returns:

  • (Boolean) 


45
46
47
48
 
# File 'lib/cratus/user.rb', line 45

def disabled?
  status = @raw_ldap_data[Cratus.config.].last
  status.to_s == '514'
end

#dn ⇒ Object 



50
51
52
 
# File 'lib/cratus/user.rb', line 50

def dn
  @raw_ldap_data[:dn].last
end

#email ⇒ Object 



54
55
56
 
# File 'lib/cratus/user.rb', line 54

def email
  @raw_ldap_data[Cratus.config.user_mail_attribute].last
end

#enable ⇒ Object

Enables a disabled user



59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/cratus/user.rb', line 59

def enable
  if disabled?
    Cratus::LDAP.replace_attribute(
      dn,
      Cratus.config.,
      ['512']
    )
    refresh
  else
    true
  end
end

#enabled? ⇒ Boolean

Returns:

  • (Boolean) 


72
73
74
75
 
# File 'lib/cratus/user.rb', line 72

def enabled?
  status = @raw_ldap_data[Cratus.config.].last
  status.to_s == '512'
end

#fullname ⇒ Object 



77
78
79
 
# File 'lib/cratus/user.rb', line 77

def fullname
  @raw_ldap_data[Cratus.config.user_displayname_attribute].last
end

#locked? ⇒ Boolean

fossies.org/linux/web2ldap/pylib/w2lapp/schema/plugins/activedirectory.py msdn.microsoft.com/en-us/library/windows/desktop/ms676843(v=vs.85).aspx

Returns:

  • (Boolean) 


90
91
92
93
94
95
 
# File 'lib/cratus/user.rb', line 90

def locked?
  return false if lockouttime.zero?
  epoch = 116_444_736_000_000_000
  current = Time.now.to_i * 10_000_000
  current - (lockouttime - epoch) < lockoutduration
end

#lockoutduration ⇒ Object 



97
98
99
100
101
102
103
104
105
 
# File 'lib/cratus/user.rb', line 97

def lockoutduration
  raw_results = Cratus::LDAP.search(
    '(objectClass=domain)',
    basedn: Cratus.config.basedn,
    attrs: 'lockoutDuration',
    scope: 'object'
  ).last
  Integer(raw_results[:lockoutduration].last) * -1
end

#lockouttime ⇒ Object 



81
82
83
84
85
 
# File 'lib/cratus/user.rb', line 81

def lockouttime
  Integer(@raw_ldap_data[Cratus.config.user_lockout_attribute].last.to_s)
rescue => _e
  0 # If we can't determine the value (for instance, if it is empty), just assume 0
end

#member_of ⇒ Object Also known as: groups 



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/cratus/user.rb', line 107

def member_of
  memrof_attr = Cratus.config.user_memberof_attribute
  # TODO: move the search filter to a configurable param
  if Cratus.config.include_distribution_groups
    raw_groups = @raw_ldap_data[memrof_attr]
  else
    raw_groups = @raw_ldap_data[memrof_attr].reject { |g| g.match(/OU=Distribution Groups/) }
  end
  initial_groups = raw_groups.map do |raw_group|
    Group.new(raw_group.match(/^#{Group.ldap_dn_attribute.to_s.upcase}=([^,]+),/)[1])
  end
  all_the_groups = initial_groups
  initial_groups.each do |group|
    all_the_groups.concat(group.member_of)
  end
  all_the_groups.uniq(&:name)
end

#refresh ⇒ Object 



127
128
129
130
131
132
133
 
# File 'lib/cratus/user.rb', line 127

def refresh
  @raw_ldap_data = Cratus::LDAP.search(
    "(#{self.class.ldap_dn_attribute}=#{@username})",
    basedn: @search_base,
    attrs: self.class.ldap_return_attributes
  ).last
end

#remove_from_group(group) ⇒ Object

Remove a user from a group



21
22
23
24
25
 
# File 'lib/cratus/user.rb', line 21

def remove_from_group(group)
  raise 'InvalidGroup' unless group.respond_to?(:remove_user)
  # just be lazy and hand off to the group to do the work...
  group.remove_user(self)
end

#unlock ⇒ Object

Unlocks a user

Returns:

  • ‘true` on success (or if user is already unlocked)

  • ‘false` when the account is disabled (unlocking not permitted)



138
139
140
141
142
143
144
145
146
147
148
149
150
151
 
# File 'lib/cratus/user.rb', line 138

def unlock
  if locked? && enabled?
    Cratus::LDAP.replace_attribute(
      dn,
      Cratus.config.user_lockout_attribute,
      ['0']
    )
    refresh
  elsif disabled?
    false
  else
    true
  end
end