jro_apps/redmine Commit - r9748:3b207ee77caf

Adds a configurable timeout for LDAP authentication (#8978)....

Jean-Philippe Lang -

r9748:3b207ee77caf

parent child

Context file:

r9748:3b207ee77caf

Collapse all files

db/migrate/20120707064544_add_auth_sources_timeout.rb created 644 +9 0

@@ -0,0 +1,9
	1	class AddAuthSourcesTimeout < ActiveRecord::Migration
	2	def up
	3	add_column :auth_sources, :timeout, :integer
	4	end
	5
	6	def self.down
	7	remove_column :auth_sources, :timeout
	8	end
	9	end

app/models/auth_source.rb +1 0

             # Generic exception for when the AuthSource can not be reached
             # (eg. can not connect to the LDAP)
             class AuthSourceException < Exception; end
+            class AuthSourceTimeoutException < AuthSourceException; end
             class AuthSource < ActiveRecord::Base
               include Redmine::SubclassFactory

app/models/auth_source_ldap.rb +25 -9

             require 'iconv'
             require 'net/ldap'
             require 'net/ldap/dn'
+            require 'timeout'
             class AuthSourceLdap < AuthSource
               validates_presence_of :host, :port, :attr_login
               validates_length_of :account, :account_password, :base_dn, :filter, :maximum => 255, :allow_blank => true
               validates_length_of :attr_login, :attr_firstname, :attr_lastname, :attr_mail, :maximum => 30, :allow_nil => true
               validates_numericality_of :port, :only_integer => true
+              validates_numericality_of :timeout, :only_integer => true, :allow_blank => true
               validate :validate_filter
               before_validation :strip_ldap_attributes
               def authenticate(login, password)
                 return nil if login.blank? || password.blank?
-                attrs = get_user_dn(login, password)
-                if attrs && attrs[:dn] && authenticate_dn(attrs[:dn], password)
+                with_timeout do
-                  logger.debug "Authentication successful for '#{login}'" if logger && logger.debug?
+                  attrs = get_user_dn(login, password)
-                  return attrs.except(:dn)
+                  if attrs && attrs[:dn] && authenticate_dn(attrs[:dn], password)
+                    logger.debug "Authentication successful for '#{login}'" if logger && logger.debug?
+                    return attrs.except(:dn)
+                  end
                 end
-              rescue  Net::LDAP::LdapError => e
+              rescue Net::LDAP::LdapError => e
                 raise AuthSourceException.new(e.message)
               end
               # test the connection to the LDAP
               def test_connection
-                ldap_con = initialize_ldap_con(self.account, self.account_password)
+                with_timeout do
-                ldap_con.open { }
+                  ldap_con = initialize_ldap_con(self.account, self.account_password)
-              rescue  Net::LDAP::LdapError => e
+                  ldap_con.open { }
-                raise "LdapError: " + e.message
+                end
+              rescue Net::LDAP::LdapError => e
+                raise AuthSourceException.new(e.message)
               end
               def auth_method_name
               private
+              def with_timeout(&block)
+                timeout = self.timeout
+                timeout = 20 unless timeout && timeout > 0
+                Timeout.timeout(timeout) do
+                  return yield
+                end
+              rescue Timeout::Error => e
+                raise AuthSourceTimeoutException.new(e.message)
+              end
               def ldap_filter
                 if filter.present?
                   Net::LDAP::Filter.construct(filter)

app/views/auth_sources/_form_auth_source_ldap.html.erb +3 0

             <p><label for="auth_source_custom_filter"><%=l(:field_ldap_filter)%></label>
             <%= text_field 'auth_source', 'filter', :size => 60 %></p>
+            <p><label for="auth_source_timeout"><%=l(:field_timeout)%></label>
+            <%= text_field 'auth_source', 'timeout', :size => 4 %></p>
             <p><label for="auth_source_onthefly_register"><%=l(:field_onthefly)%></label>
             <%= check_box 'auth_source', 'onthefly_register' %></p>
             </div>

config/locales/en.yml +1 0

               field_multiple: Multiple values
               field_ldap_filter: LDAP filter
               field_core_fields: Standard fields
+              field_timeout: "Timeout (in seconds)"
               setting_app_title: Application title
               setting_app_subtitle: Application subtitle

config/locales/fr.yml +1 0

               field_multiple: Valeurs multiples
               field_ldap_filter: Filtre LDAP
               field_core_fields: Champs standards
+              field_timeout: "Timeout (en secondes)"
               setting_app_title: Titre de l'application
               setting_app_subtitle: Sous-titre de l'application

test/unit/auth_source_ldap_test.rb +10 0

@@ -114,6 +114,16 class AuthSourceLdapTest < ActiveSupport::TestCase
114	end	114	end
115	end	115	end
116	end	116	end
		117
		118	def test_authenticate_should_timeout
		119	auth_source = AuthSourceLdap.find(1)
		120	auth_source.timeout = 1
		121	def auth_source.initialize_ldap_con(*args); sleep(5); end
		122
		123	assert_raise AuthSourceTimeoutException do
		124	auth_source.authenticate 'example1', '123456'
		125	end
		126	end
117	else	127	else
118	puts '(Test LDAP server not configured)'	128	puts '(Test LDAP server not configured)'
119	end	129	end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages