Module: ThecoreAuthCommons

Defined in:
lib/thecore_auth_commons.rb,
lib/thecore_auth_commons/engine.rb,
lib/thecore_auth_commons/version.rb

Defined Under Namespace

Classes: Engine

Constant Summary collapse

VERSION = 
"3.5.14".freeze

Class Method Summary collapse

Class Method Details

.align_user(email, entry, server) ⇒ Object 



89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/thecore_auth_commons.rb', line 89

def self.align_user(email, entry, server)
  user = User.find_or_initialize_by(email: email)
  user.auth_source = "ldap #{server.id}"

  # Password don't need to be changed, just created, otherwise it will invalidate the current user session if it's logged in
  user.password = user.password_confirmation = ThecoreAuthCommons.generate_secure_password if user.new_record?

  # Eventuale mapping LDAP -> campi User
  user.name = entry[server.name]&.first if user.respond_to?(:name) && server.name.present?
  user.surname = entry[server.surname]&.first if user.respond_to?(:surname) && server.surname.present?
  user.phone = entry[server.phone]&.first if user.respond_to?(:phone) && server.phone.present?
  user.code = entry[server.code]&.first if user.respond_to?(:code) && server.code.present?

  # Recupera dalla entry i gruppi di cui fa parte l'utente e crea i relativi record in Role assegnandoli all'utente corrente
  is_admin = false
  entry[:memberOf].each do |group|
    group_name = group.split(",").first.split("=").last
    # Se il gruppo è un admin, assegna il ruolo admin
    is_admin = true if ["Administrators", "Domain Admins", "Schema Admins", "Enterprise Admins", "admins", "administrators"].include?(group_name)

    role = Role.find_or_create_by(name: group_name)
    user.roles << role unless user.roles.include?(role)
  end

  user.admin = is_admin if user.respond_to?(:admin) && !user.admin # Se l'utente è già admin non revocargli l'admin, altrimenti se è nuovo o non era admin assegnagli l'admin se è presente nei gruppi admin
  # Se l'utente è nuovo o ha cambiato qualcosa, salvalo
  puts "Cannot save user #{email} with errors: #{user.errors.full_messages.join(", ")}" unless user.save(:validate => false) # if user.new_record? || user.changed? || user.roles_changed?
  user
end

.check_user(email, name, surname, provider) ⇒ Object

Controlla se l'utente esiste, altrimenti lo crea con una password casuale e lo restituisce. Se l'utente esiste già, lo restituisce senza modificarlo.



36
37
38
39
40
41
42
43
44
45
 
# File 'lib/thecore_auth_commons.rb', line 36

def self.check_user(email, name, surname, provider)
  u = User.find_or_initialize_by(email: email)
  u.name = name
  u.surname = surname
  u.password = u.password_confirmation = generate_secure_password
  u.auth_source = provider # 'google' or 'microsoft'
  u.admin = true
  u.save if u.changed?
  u
end

.entra_id_vars? ⇒ Boolean

Returns:

  • (Boolean) 


25
26
27
 
# File 'lib/thecore_auth_commons.rb', line 25

def self.entra_id_vars?
  ENV["ENTRA_CLIENT_ID"].present? && ENV["ENTRA_CLIENT_SECRET"].present? && ENV["ENTRA_TENANT_ID"].present?
end

.generate_secure_password(length = 20) ⇒ Object

Raises:

  • (ArgumentError) 


119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
 
# File 'lib/thecore_auth_commons.rb', line 119

def self.generate_secure_password(length = 20)
  raise ArgumentError, "Length must be at least 4" if length < 4

  # Caratteri da cui attingere
  lowercase = ("a".."z").to_a
  uppercase = ("A".."Z").to_a
  numbers = ("0".."9").to_a
  symbols = ["!", "@", "#", "$", "%", "&", "*", "?", "-", "_", "+", "="]

  # Obbliga almeno un carattere da ogni gruppo
  password = [
    lowercase.sample,
    uppercase.sample,
    numbers.sample,
    symbols.sample,
  ]

  # Caratteri restanti scelti a caso tra tutti
  all_characters = lowercase + uppercase + numbers + symbols
  (length - 4).times { password << all_characters.sample }

  # Mischia per evitare ordine prevedibile
  password.shuffle.join
end

.google_oauth2_vars? ⇒ Boolean

Returns:

  • (Boolean) 


29
30
31
 
# File 'lib/thecore_auth_commons.rb', line 29

def self.google_oauth2_vars?
  ENV["GOOGLE_CLIENT_ID"].present? && ENV["GOOGLE_CLIENT_SECRET"].present?
end

.import_ldap_users_task ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/thecore_auth_commons.rb', line 47

def self.import_ldap_users_task
  puts "== Avvio sincronizzazione utenti da LDAP =="

  imported_count = 0

  LdapServer.all.each do |server|
    puts "Contatto server LDAP: #{server.host} (priorità: #{server.priority})"

    ldap = Net::LDAP.new(
      host: server.host,
      port: server.port,
      encryption: server.use_ssl ? :simple_tls : nil,
      auth: {
        method: :simple,
        username: server.admin_user,
        password: server.admin_password,
      },
    )

    unless ldap.bind
      puts "❌ Connessione fallita a #{server.host}"
      next
    end

    filter = Net::LDAP::Filter.present(server.auth_field)
    treebase = server.base_dn

    ldap.search(base: treebase, filter: filter) do |entry|
      email = entry[server.auth_field]&.first
      next unless email

      puts "Importando utente: #{email}"

      # Password must contain at least one uppercase letter, one lowercase letter, one number and one special character
      ThecoreAuthCommons.align_user email, entry, server
      imported_count += 1
    end
  end

  puts "== Completato. Utenti importati: #{imported_count} =="
end

.oauth_vars? ⇒ Boolean

Returns:

  • (Boolean) 


21
22
23
 
# File 'lib/thecore_auth_commons.rb', line 21

def self.oauth_vars?
  entra_id_vars? || google_oauth2_vars?
end