class Chaltron::LDAP::Connection

Constants

NET_LDAP_ENCRYPTION_METHOD

Attributes

ldap[R]

Public Class Methods

new(params = {}) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 16
def initialize(params = {})
  @ldap = Net::LDAP.new(adapter_options)
end

Public Instance Methods

auth(login, password) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 20
def auth(login, password)
  filter = Net::LDAP::Filter.eq(uid, login)
  ldap.bind_as(base: base, filter: filter, password: password)
end
find_by_uid(id) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 25
def find_by_uid(id)
  opts = {}
  opts[uid.to_sym] = id
  ret = find_user(opts)
end
find_groups_by_member(entry) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 74
def find_groups_by_member(entry)
  options = {
    base: Chaltron.ldap_group_base || base,
    filter: Chaltron.ldap_group_member_filter.call(entry)
  }
  ldap_search(options)
end
find_user(*args) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 31
def find_user(*args)
  find_users(*args).first
end
find_users(args) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 48
def find_users(args)
  return [] if args.empty?
  limit = args.delete(:limit)
  fields = args.keys

  if fields.include?(:dn)
    options = {
      base: args[:dn],
      scope: Net::LDAP::SearchScope_BaseObject
    }
  else
    filters = fields.map do |field|
      f = translate_field(field)
      Net::LDAP::Filter.eq(f, args[field]) if f
    end
    options = {
      base: base,
      filter: filters.inject { |sum, n| Net::LDAP::Filter.join(sum, n) }
    }
  end
  options.merge!(size: limit) unless limit.nil?
  ldap_search(options).map do |entry|
    Chaltron::LDAP::Person.new(entry, uid) if entry.respond_to? uid
  end.compact
end
update_attributes(dn, args) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 82
def update_attributes(dn, args)
  ldap.modify dn: dn, operations: args.map { |k,v| [:replace, k, v] }
end

Private Instance Methods

adapter_options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 98
def adapter_options
  opts = {
    host: options[:host],
    port: options[:port],
    encryption: encryption_options,
    verbose: true
  }
  opts.merge!(auth_options) if has_auth?
  opts
end
auth_options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 177
def auth_options
  {
    auth: {
      method: :simple,
      username: options[:bind_dn],
      password: options[:password]
    }
  }
end
base() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 109
def base
  options[:base]
end
custom_tls_options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 152
def custom_tls_options
  return {} unless options['tls_options']

  # Dup so we don't overwrite the original value
  custom_options = options['tls_options'].dup.delete_if { |_, value| value.nil? || value.blank? }
  custom_options.symbolize_keys!

  if custom_options[:cert]
    begin
      custom_options[:cert] = OpenSSL::X509::Certificate.new(custom_options[:cert])
    rescue OpenSSL::X509::CertificateError => e
      Rails.logger.error "LDAP TLS Options 'cert' is invalid for provider #{provider}: #{e.message}"
    end
  end

  if custom_options[:key]
    begin
      custom_options[:key] = OpenSSL::PKey.read(custom_options[:key])
    rescue OpenSSL::PKey::PKeyError => e
      Rails.logger.error "LDAP TLS Options 'key' is invalid for provider #{provider}: #{e.message}"
    end
  end
  custom_options
end
encryption_options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 117
def encryption_options
  method = translate_method
  return unless method
  {
    method: method,
    tls_options: tls_options
  }
end
has_auth?() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 187
def has_auth?
  options[:password] || options[:bind_dn]
end
options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 88
def options
  Devise.omniauth_configs[:ldap].options
end
tls_options() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 130
def tls_options
  return @tls_options if defined?(@tls_options)

  method = translate_method
  return unless method

  opts = if options[:disable_verify_certificates]
    # It is important to explicitly set verify_mode for two reasons:
    # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
    # 2. The net-ldap gem implementation verifies the certificate hostname
    #    unless verify_mode is set to VERIFY_NONE.
    { verify_mode: OpenSSL::SSL::VERIFY_NONE }
   else
     # Dup so we don't accidentally overwrite the constant
     OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
   end

  opts.merge!(custom_tls_options)

  @tls_options = opts
end
translate_field(field) click to toggle source
# File lib/chaltron/ldap/connection.rb, line 92
def translate_field field
  return uid if field.to_sym == :uid
  return Chaltron.ldap_field_mappings[field.to_sym] unless Chaltron.ldap_field_mappings[field.to_sym].nil?
  field
end
translate_method() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 126
def translate_method
  NET_LDAP_ENCRYPTION_METHOD[options[:encryption]&.to_sym]
end
uid() click to toggle source
# File lib/chaltron/ldap/connection.rb, line 113
def uid
  options[:uid]
end