##// END OF EJS Templates
jro_apps » redmine
RSS
LDAP authentication: only ask for the user's DN if on-the-fly registration is disabled...
Jean-Philippe Lang -
r869:308118ce9724
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,81 +1,82
1 # redMine - project management software
1 # redMine - project management software
2 # Copyright (C) 2006 Jean-Philippe Lang
2 # Copyright (C) 2006 Jean-Philippe Lang
3 #
3 #
4 # This program is free software; you can redistribute it and/or
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
7 # of the License, or (at your option) any later version.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU General Public License
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
17
18 require 'net/ldap'
18 require 'net/ldap'
19 require 'iconv'
19 require 'iconv'
20
20
21 class AuthSourceLdap < AuthSource
21 class AuthSourceLdap < AuthSource
22 validates_presence_of :host, :port, :attr_login
22 validates_presence_of :host, :port, :attr_login
23 validates_presence_of :attr_firstname, :attr_lastname, :attr_mail, :if => Proc.new { |a| a.onthefly_register? }
23 validates_presence_of :attr_firstname, :attr_lastname, :attr_mail, :if => Proc.new { |a| a.onthefly_register? }
24
24
25 def after_initialize
25 def after_initialize
26 self.port = 389 if self.port == 0
26 self.port = 389 if self.port == 0
27 end
27 end
28
28
29 def authenticate(login, password)
29 def authenticate(login, password)
30 attrs = []
30 attrs = []
31 # get user's DN
31 # get user's DN
32 ldap_con = initialize_ldap_con(self.account, self.account_password)
32 ldap_con = initialize_ldap_con(self.account, self.account_password)
33 login_filter = Net::LDAP::Filter.eq( self.attr_login, login )
33 login_filter = Net::LDAP::Filter.eq( self.attr_login, login )
34 object_filter = Net::LDAP::Filter.eq( "objectClass", "*" )
34 object_filter = Net::LDAP::Filter.eq( "objectClass", "*" )
35 dn = String.new
35 dn = String.new
36 ldap_con.search( :base => self.base_dn,
36 ldap_con.search( :base => self.base_dn,
37 :filter => object_filter & login_filter,
37 :filter => object_filter & login_filter,
38 :attributes=> ['dn', self.attr_firstname, self.attr_lastname, self.attr_mail]) do |entry|
38 # only ask for the DN if on-the-fly registration is disabled
39 :attributes=> (onthefly_register? ? ['dn', self.attr_firstname, self.attr_lastname, self.attr_mail] : ['dn'])) do |entry|
39 dn = entry.dn
40 dn = entry.dn
40 attrs = [:firstname => AuthSourceLdap.get_attr(entry, self.attr_firstname),
41 attrs = [:firstname => AuthSourceLdap.get_attr(entry, self.attr_firstname),
41 :lastname => AuthSourceLdap.get_attr(entry, self.attr_lastname),
42 :lastname => AuthSourceLdap.get_attr(entry, self.attr_lastname),
42 :mail => AuthSourceLdap.get_attr(entry, self.attr_mail),
43 :mail => AuthSourceLdap.get_attr(entry, self.attr_mail),
43 :auth_source_id => self.id ] if onthefly_register?
44 :auth_source_id => self.id ] if onthefly_register?
44 end
45 end
45 return nil if dn.empty?
46 return nil if dn.empty?
46 logger.debug "DN found for #{login}: #{dn}" if logger && logger.debug?
47 logger.debug "DN found for #{login}: #{dn}" if logger && logger.debug?
47 # authenticate user
48 # authenticate user
48 ldap_con = initialize_ldap_con(dn, password)
49 ldap_con = initialize_ldap_con(dn, password)
49 return nil unless ldap_con.bind
50 return nil unless ldap_con.bind
50 # return user's attributes
51 # return user's attributes
51 logger.debug "Authentication successful for '#{login}'" if logger && logger.debug?
52 logger.debug "Authentication successful for '#{login}'" if logger && logger.debug?
52 attrs
53 attrs
53 rescue Net::LDAP::LdapError => text
54 rescue Net::LDAP::LdapError => text
54 raise "LdapError: " + text
55 raise "LdapError: " + text
55 end
56 end
56
57
57 # test the connection to the LDAP
58 # test the connection to the LDAP
58 def test_connection
59 def test_connection
59 ldap_con = initialize_ldap_con(self.account, self.account_password)
60 ldap_con = initialize_ldap_con(self.account, self.account_password)
60 ldap_con.open { }
61 ldap_con.open { }
61 rescue Net::LDAP::LdapError => text
62 rescue Net::LDAP::LdapError => text
62 raise "LdapError: " + text
63 raise "LdapError: " + text
63 end
64 end
64
65
65 def auth_method_name
66 def auth_method_name
66 "LDAP"
67 "LDAP"
67 end
68 end
68
69
69 private
70 private
70 def initialize_ldap_con(ldap_user, ldap_password)
71 def initialize_ldap_con(ldap_user, ldap_password)
71 Net::LDAP.new( {:host => self.host,
72 Net::LDAP.new( {:host => self.host,
72 :port => self.port,
73 :port => self.port,
73 :auth => { :method => :simple, :username => ldap_user, :password => ldap_password },
74 :auth => { :method => :simple, :username => ldap_user, :password => ldap_password },
74 :encryption => (self.tls ? :simple_tls : nil)}
75 :encryption => (self.tls ? :simple_tls : nil)}
75 )
76 )
76 end
77 end
77
78
78 def self.get_attr(entry, attr_name)
79 def self.get_attr(entry, attr_name)
79 entry[attr_name].is_a?(Array) ? entry[attr_name].first : entry[attr_name]
80 entry[attr_name].is_a?(Array) ? entry[attr_name].first : entry[attr_name]
80 end
81 end
81 end
82 end
General Comments 0
You need to be logged in to leave comments. Login now