Class: SimpleLdapAuthenticator

Inherits:
Object
  • Object
show all
Defined in:
lib/simple_ldap_authenticator.rb

Overview

Allows for easily authenticating users via LDAP (or LDAPS). If authenticating via LDAP to a server running on localhost, you should only have to configure the login_format.

Can be configured using the following accessors (with examples):

  • login_format = ‘%[email protected]’ # Active Directory, OR

  • login_format = ‘cn=%s,cn=users,o=organization,c=us’ # Other LDAP servers

  • servers = [‘dc1.domain.com’, ‘dc2.domain.com’] # names/addresses of LDAP servers to use

  • use_ssl = true # for logging in via LDAPS

  • port = 3289 # instead of 389 for LDAP or 636 for LDAPS

  • logger = RAILS_DEFAULT_LOGGER # for logging authentication successes/failures

The class is used as a global variable, you are not supposed to create an instance of it. For example:

require 'simple_ldap_authenticator'
SimpleLdapAuthenticator.servers = %w'dc1.domain.com dc2.domain.com'
SimpleLdapAuthenticator.use_ssl = true
SimpleLdapAuthenticator. = '%[email protected]'
SimpleLdapAuthenticator.logger = RAILS_DEFAULT_LOGGER
class LoginController < ApplicationController 
  def 
    return redirect_to(:action=>'try_again') unless SimpleLdapAuthenticator.valid?(params[:username], params[:password])
    session[:username] = params[:username]
  end
end

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.connection ⇒ Object

The connection to the LDAP server. A single connection is made and the connection is only changed if a server returns an error other than invalid password.



71
72
73
 
# File 'lib/simple_ldap_authenticator.rb', line 71

def connection
  @connection
end

.ldap_library ⇒ Object

Returns the value of attribute ldap_library.



38
39
40
 
# File 'lib/simple_ldap_authenticator.rb', line 38

def ldap_library
  @ldap_library
end

.logger ⇒ Object

Returns the value of attribute logger.



38
39
40
 
# File 'lib/simple_ldap_authenticator.rb', line 38

def logger
  @logger
end

.login_format ⇒ Object

Returns the value of attribute login_format.



38
39
40
 
# File 'lib/simple_ldap_authenticator.rb', line 38

def 
  @login_format
end

.port ⇒ Object

The port to use. Defaults to 389 for LDAP and 636 for LDAPS.



82
83
84
 
# File 'lib/simple_ldap_authenticator.rb', line 82

def port
  @port
end

.servers ⇒ Object

Returns the value of attribute servers.



38
39
40
 
# File 'lib/simple_ldap_authenticator.rb', line 38

def servers
  @servers
end

.use_ssl ⇒ Object

Returns the value of attribute use_ssl.



38
39
40
 
# File 'lib/simple_ldap_authenticator.rb', line 38

def use_ssl
  @use_ssl
end

Class Method Details

.load_ldap_library ⇒ Object

Load the required LDAP library, either ‘ldap’ or ‘net/ldap’



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/simple_ldap_authenticator.rb', line 41

def load_ldap_library
  return if @ldap_library_loaded
  if ldap_library
    if ldap_library == 'net/ldap'
      require 'net/ldap'
    else
      require 'ldap'
      require 'ldap/control'
    end
  else
    begin
      require 'ldap'
      require 'ldap/control'
      ldap_library = 'ldap'
    rescue LoadError
      require 'net/ldap'
      ldap_library = 'net/ldap'
    end
  end
  @ldap_library_loaded = true
end

.server ⇒ Object

The next LDAP server to which to connect



64
65
66
 
# File 'lib/simple_ldap_authenticator.rb', line 64

def server
  servers[0]
end

.switch_server ⇒ Object

Disconnect from current LDAP server and use a different LDAP server on the next authentication attempt



88
89
90
91
 
# File 'lib/simple_ldap_authenticator.rb', line 88

def switch_server
  self.connection = nil
  servers << servers.shift
end

.valid?(login, password) ⇒ Boolean

Check the validity of a login/password combination

Returns:

  • (Boolean) 


94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/simple_ldap_authenticator.rb', line 94

def valid?(, password)
  if password.to_s == ''
    false
  elsif ldap_library == 'net/ldap'
    connection.authenticate( % .to_s, password.to_s)
    begin
      if connection.bind
          logger.info("Authenticated #{.to_s} by #{server}") if logger
          true
        else
          logger.info("Error attempting to authenticate #{.to_s} by #{server}: #{connection.get_operation_result.code} #{connection.get_operation_result.message}") if logger
          switch_server unless connection.get_operation_result.code == 49
          false
        end
    rescue Net::LDAP::LdapError => error
      logger.info("Error attempting to authenticate #{.to_s} by #{server}: #{error.message}") if logger
      switch_server
      false
    end
  else
    connection.unbind if connection.bound?
    begin
      connection.bind( % .to_s, password.to_s)
      connection.unbind
      logger.info("Authenticated #{.to_s} by #{server}") if logger
      true
    rescue LDAP::ResultError => error
      connection.unbind if connection.bound?
      logger.info("Error attempting to authenticate #{.to_s} by #{server}: #{error.message}") if logger
      switch_server unless error.message == 'Invalid credentials'
      false
    end
  end
end