Class: Devise::LdapAdapter::LdapConnect

Inherits:
Object
  • Object
show all
Defined in:
lib/devise_ldap_authenticatable/ldap_adapter.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ LdapConnect

Returns a new instance of LdapConnect.



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 86

def initialize(params = {})
  ldap_config = YAML.load(ERB.new(File.read(::Devise.ldap_config || "#{Rails.root}/config/ldap.yml")).result)[Rails.env]
  ldap_options = params
  ldap_config["ssl"] = :simple_tls if ldap_config["ssl"] === true
  ldap_options[:encryption] = ldap_config["ssl"].to_sym if ldap_config["ssl"]

  @ldap = Net::LDAP.new(ldap_options)
  @ldap.host = ldap_config["host"]
  @ldap.port = ldap_config["port"]
  @ldap.base = ldap_config["base"]
  @attribute = ldap_config["attribute"]
  @ldap_auth_username_builder = params[:ldap_auth_username_builder]

  @group_base = ldap_config["group_base"]
  @check_group_membership = ldap_config.has_key?("check_group_membership") ? ldap_config["check_group_membership"] : ::Devise.ldap_check_group_membership
  @required_groups = ldap_config["required_groups"]
  @required_attributes = ldap_config["require_attribute"]

  @ldap.auth ldap_config["admin_user"], ldap_config["admin_password"] if params[:admin]

  @login = params[:login]
  @password = params[:password]
  @new_password = params[:new_password]
end

Instance Attribute Details

#ldap ⇒ Object (readonly)

Returns the value of attribute ldap.



84
85
86
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 84

def ldap
  @ldap
end

#login ⇒ Object (readonly)

Returns the value of attribute login.



84
85
86
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 84

def 
  @login
end

Instance Method Details

#authenticate! ⇒ Object 



150
151
152
153
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 150

def authenticate!
  @ldap.auth(dn, @password)
  @ldap.bind
end

#authenticated? ⇒ Boolean

Returns:

  • (Boolean) 


155
156
157
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 155

def authenticated?
  authenticate!
end

#authorized? ⇒ Boolean

Returns:

  • (Boolean) 


159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 159

def authorized?
  DeviseLdapAuthenticatable::Logger.send("Authorizing user #{dn}")
  if !authenticated?
    DeviseLdapAuthenticatable::Logger.send("Not authorized because not authenticated.")
    return false
  elsif !in_required_groups?
    DeviseLdapAuthenticatable::Logger.send("Not authorized because not in required groups.")
    return false
  elsif !has_required_attribute?
    DeviseLdapAuthenticatable::Logger.send("Not authorized because does not have required attribute.")
    return false
  else
    return true
  end
end

#change_password! ⇒ Object 



175
176
177
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 175

def change_password!
  update_ldap(:userpassword => Net::LDAP::Password.generate(:sha, @new_password))
end

#delete_param(param) ⇒ Object 



111
112
113
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 111

def delete_param(param)
  update_ldap [[:delete, param.to_sym, nil]]
end

#dn ⇒ Object 



119
120
121
122
123
124
125
126
127
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 119

def dn
  DeviseLdapAuthenticatable::Logger.send("LDAP dn lookup: #{@attribute}=#{@login}")
  ldap_entry = 
  if ldap_entry.nil?
    @ldap_auth_username_builder.call(@attribute,@login,@ldap)
  else
    ldap_entry.dn
  end
end

#has_required_attribute? ⇒ Boolean

Returns:

  • (Boolean) 


225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 225

def has_required_attribute?
  return true unless ::Devise.ldap_check_attributes

  admin_ldap = LdapConnect.admin

  user = find_ldap_user(admin_ldap)

  @required_attributes.each do |key,val|
    unless user[key].include? val
      DeviseLdapAuthenticatable::Logger.send("User #{dn} did not match attribute #{key}:#{val}")
      return false
    end
  end

  return true
end

#in_group?(group_name, group_attribute = DEFAULT_GROUP_UNIQUE_MEMBER_LIST_KEY) ⇒ Boolean

Returns:

  • (Boolean) 


195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 195

def in_group?(group_name, group_attribute = DEFAULT_GROUP_UNIQUE_MEMBER_LIST_KEY)
  in_group = false

  admin_ldap = LdapConnect.admin

  unless ::Devise.ldap_ad_group_check
    admin_ldap.search(:base => group_name, :scope => Net::LDAP::SearchScope_BaseObject) do |entry|
      if entry[group_attribute].include? dn
        in_group = true
      end
    end
  else
    # AD optimization - extension will recursively check sub-groups with one query
    # "(memberof:1.2.840.113556.1.4.1941:=group_name)"
    search_result = admin_ldap.search(:base => dn,
                      :filter => Net::LDAP::Filter.ex("memberof:1.2.840.113556.1.4.1941", group_name),
                      :scope => Net::LDAP::SearchScope_BaseObject)
    # Will return  the user entry if belongs to group otherwise nothing
    if search_result.length == 1 && search_result[0].dn.eql?(dn)
      in_group = true
    end
  end

  unless in_group
    DeviseLdapAuthenticatable::Logger.send("User #{dn} is not in group: #{group_name}")
  end

  return in_group
end

#in_required_groups? ⇒ Boolean

Returns:

  • (Boolean) 


179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 179

def in_required_groups?
  return true unless @check_group_membership

  ## FIXME set errors here, the ldap.yml isn't set properly.
  return false if @required_groups.nil?

  for group in @required_groups
    if group.is_a?(Array)
      return false unless in_group?(group[1], group[0])
    else
      return false unless in_group?(group)
    end
  end
  return true
end

#ldap_param_value(param) ⇒ Object 



129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 129

def ldap_param_value(param)
  filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
  ldap_entry = nil
  @ldap.search(:filter => filter) {|entry| ldap_entry = entry}

  if ldap_entry
    if ldap_entry[param]
      DeviseLdapAuthenticatable::Logger.send("Requested param #{param} has value #{ldap_entry.send(param)}")
      value = ldap_entry.send(param)
      value = value.first if value.is_a?(Array) and value.count == 1
      value
    else
      DeviseLdapAuthenticatable::Logger.send("Requested param #{param} does not exist")
      value = nil
    end
  else
    DeviseLdapAuthenticatable::Logger.send("Requested ldap entry does not exist")
    value = nil
  end
end

#search_for_login ⇒ Object

Searches the LDAP for the login

Returns:

  • (Object) —

    the LDAP entry found; nil if not found



257
258
259
260
261
262
263
264
265
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 257

def 
  DeviseLdapAuthenticatable::Logger.send("LDAP search for login: #{@attribute}=#{@login}")
  filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
  ldap_entry = nil
  match_count = 0
  @ldap.search(:filter => filter) {|entry| ldap_entry = entry; match_count+=1}
  DeviseLdapAuthenticatable::Logger.send("LDAP search yielded #{match_count} matches")
  ldap_entry
end

#set_param(param, new_value) ⇒ Object 



115
116
117
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 115

def set_param(param, new_value)
  update_ldap( { param.to_sym => new_value } )
end

#user_groups ⇒ Object 



242
243
244
245
246
247
248
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 242

def user_groups
  admin_ldap = LdapConnect.admin

  DeviseLdapAuthenticatable::Logger.send("Getting groups for #{dn}")
  filter = Net::LDAP::Filter.eq("uniqueMember", dn)
  admin_ldap.search(:filter => filter, :base => @group_base).collect(&:dn)
end

#valid_login? ⇒ Boolean

Returns:

  • (Boolean) 


250
251
252
 
# File 'lib/devise_ldap_authenticatable/ldap_adapter.rb', line 250

def valid_login?
  !.nil?
end