chaltron 0.2.11 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0db5689d36867b5dbe81aed50248c93189c3ed321fab99e007ad1003b40b506
-  data.tar.gz: 29853e9008306cd04372a6e5c2fd332136b6e94e2749bf4c454ee04919552be6
+  metadata.gz: 7b464d3bc81862d834f059858174adf7461d64906a4e4ca665be9e1b7a41808f
+  data.tar.gz: c9c441c67ffa67a0710572821f7080b2865c31b8e70e8a1ab7ec33d566822bec
 SHA512:
-  metadata.gz: 3c68397cbd1118f2ecc124d79146bffffe4428f40cc8a7a257068511d80975d7d8635f41c12cd2f3cafd14015dbcee7ba9083ad5c272cf91a6a6ae93ce2d9c8d
-  data.tar.gz: c6120a6ba5a149bcd84d2f253754a3df5de558f19370b7fe23088815f5400dc57d2639069f23206381dd6c46c7ca4fa44fef39362c4da182188283d94def2765
+  metadata.gz: a2bec8d1c227de443791a47dace2291c4ff18e4302b1f3214ede923660570ffd32d4b00355d042e2743e53a20aacdb75f8a14f0e95ca7ee2fb114f3331ca9039
+  data.tar.gz: 669ccd46e0c625ce65c3695b57afe6a76aef174766613242f63d1be222f9af97f70d7e9bcff1b92c02a35fd47fdaa6ddbb956edac76efa607e64f3b2c836ba84

data/app/controllers/chaltron/ldap_controller.rb

@@ -15,11 +15,11 @@ class Chaltron::LdapController < ApplicationController
     userid = params[:userid]
     if userid.present?
       entry = Chaltron::LDAP::Person.find_by_uid(userid)
-      @entries << entry unless entry.nil?
+      @entries << entry
     else
-      res = Chaltron::LDAP::Person.find_by_fields(find_options)
-      @entries = res
+      @entries = Chaltron::LDAP::Person.find_by_fields(find_options)
     end
+    @entries.compact!
   end
 
   def multi_create
@@ -41,12 +41,12 @@ class Chaltron::LdapController < ApplicationController
   private
   def find_options
     department = params[:department]
-    name       = params[:fullname]
+    name       = params[:lastname]
     limit      = params[:limit].to_i
 
     ret = {}
     ret[:department] = "*#{department}*" unless department.blank?
-    ret[:cn]         = "*#{name}*"       unless name.blank?
+    ret[:last_name]  = "*#{name}*"       unless name.blank?
     ret[:limit]      = limit.zero? ? default_limit : limit
     ret
   end

data/app/controllers/chaltron/omniauth_callbacks_controller.rb

@@ -12,6 +12,7 @@ module Chaltron
       # We only find ourselves here
       # if the authentication to LDAP was successful.
       user = Chaltron::LDAP::User.find_or_create(oauth, Chaltron.ldap_allow_all)
+      user = Chaltron.ldap_after_authenticate.call(user, Chaltron::LDAP::Connection.new)
       if user.nil?
         redirect_to root_url, alert: I18n.t('chaltron.not_allowed_to_sign_in')
       else

data/app/controllers/chaltron/sessions_controller.rb

@@ -1,3 +1,5 @@
+require 'chaltron/ldap/connection'
+
 class Chaltron::SessionsController  < Devise::SessionsController
   after_action :after_login, only: :create
   before_action :before_logout, only: :destroy
@@ -9,6 +11,7 @@ class Chaltron::SessionsController  < Devise::SessionsController
   end
 
   def before_logout
+    Chaltron.ldap_before_logout.call(current_user, Chaltron::LDAP::Connection.new) if current_user.ldap_user?
     info I18n.t('chaltron.logs.logout', user: current_user.display_name)
   end
 end

data/app/models/application_record.rb

@@ -0,0 +1,3 @@
+class ApplicationRecord < ActiveRecord::Base
+  self.abstract_class = true
+end

data/app/models/log.rb

@@ -1,4 +1,4 @@
-class Log < ActiveRecord::Base
+class Log < ApplicationRecord
   Severities = %w( emerg alert crit err warning notice info debug )
 
   validates_presence_of :severity, :message

data/app/models/user.rb

@@ -1,4 +1,4 @@
-class User < ActiveRecord::Base
+class User < ApplicationRecord
   include Authorizable
   # Include default devise modules. Others available are:
   # :registerable, :confirmable, :lockable and :omniauthable
@@ -26,4 +26,8 @@ class User < ActiveRecord::Base
     end
   end
 
+  def ldap_user?
+    provider == 'ldap'
+  end
+
 end

data/app/views/chaltron/ldap/search.html.erb

@@ -4,7 +4,7 @@
   <%= bootstrap_form_tag(url: ldap_multi_new_path, method: :post, layout: :horizontal) do |f| %>
 
     <%= f.text_field :userid, label: t('.name_label'), help: t('.name_help') %>
-    <%= f.text_field :fullname, label: t('.fullname_label'), help: t('.fullname_help') %>
+    <%= f.text_field :lastname, label: t('.lastname_label'), help: t('.lastname_help') %>
     <%= f.text_field :department, label: t('.department_label'), help: t('.department_help') %>
     <%= f.text_field :limit, label: t('.limit_label'), help: t('.limit_help'), value: @limit %>
 

data/app/views/chaltron/users/index.html.erb

@@ -5,7 +5,7 @@
       <%= render partial: 'side_filters', locals: { filters: @filters } %>
       <hr>
 
-      <% if ldap_enabled? %>
+      <% if ldap_enabled? and !Chaltron.ldap_allow_all %>
         <div class='btn-group'>
           <%= content_tag :button, type: 'button', class: 'btn btn-primary dropdown-toggle',
             data: {toggle: 'dropdown'}, aria: {expanded: false} do %>

data/app/views/chaltron/users/show.html.erb

@@ -66,11 +66,11 @@
   <div class='pull-right'>
     <%= link_to edit_user_path(@user), class: 'btn btn-default' do %>
       <%= icon :edit, t('.edit') %>
-    <% end %>
+    <% end if can? :edit, @user %>
     <%= link_to @user, method: :delete, class: 'btn btn-danger',
       disabled: current_user == @user,
       data: { confirm: t('.destroy_confirm', user: @user.username) } do %>
       <%= icon :trash, t('.destroy') %>
-    <% end %>
+    <% end if can? :destroy, @user %>
   </div>
 </div>

data/app/views/locales/en.yml

@@ -70,11 +70,11 @@ en:
         title: Search for LDAP sers
         submit_text: Search
         name_label: User
-        name_help: Search for user-id (exact match)
-        fullname_label: Fullname
-        fullname_help: Search for first name or surname (also partial match)
+        name_help: Search by user-id (exact match)
+        lastname_label: Last name
+        lastname_help: Search by last name or surname (also partial match)
         department_label: Department
-        department_help: Search for department (also partial match)
+        department_help: Search by department (also partial match)
         limit_label: Limit
         limit_help: Max shown results
       multi_new:

data/app/views/locales/it.yml

@@ -71,8 +71,8 @@ it:
         submit_text: Cerca
         name_label: Utente
         name_help: Ricerca per user-id (match esatto)
-        fullname_label: Nome
-        fullname_help: Ricerca per nome o cognome (anche match parziale)
+        lastname_label: Nome
+        lastname_help: Ricerca per cognome (anche match parziale)
         department_label: Funzione
         department_help: Ricerca per sigla di funzione (anche match parziale)
         limit_label: Limite

data/config/chaltron_navigation.rb

@@ -11,12 +11,12 @@ SimpleNavigation::Configuration.run do |navigation|
         admin.item :users,
           { icon: 'fa fa-fw fa-users',
             text: I18n.t('chaltron.menu.users')
-          }, users_path, highlights_on: /\/(users|ldap)(?!\/self_(show|edit|update))/ if can?(:manage, User)
+          }, users_path, highlights_on: /\/(users|ldap)(?!\/self_(show|edit|update))/ if can?(:read, User)
         admin.item :logs,
           { icon: 'fa fa-fw fa-book',
             text: I18n.t('chaltron.menu.logs')
           }, logs_path, highlights_on: /\/logs/ if can?(:read, Log)
-      end if can?(:manage, User) or can?(:read, Log)
+      end if can?(:read, User) or can?(:read, Log)
       primary.item :logged, current_user.display_name.html_safe, nil do |user|
         user.dom_class = 'dropdown-menu-right'
         user.item :self_edit, { icon: 'fa fa-fw fa-user',

data/config/routes.rb

@@ -15,8 +15,9 @@ Rails.application.routes.draw do
   resources :logs, controller: 'chaltron/logs', only: [:index, :show]
 
   # search and create LDAP users
-  get   'ldap/search'       => 'chaltron/ldap#search'
-  post  'ldap/multi_new'    => 'chaltron/ldap#multi_new'
-  post  'ldap/multi_create' => 'chaltron/ldap#multi_create'
-
+  if Devise.omniauth_providers.include?(:ldap) and !Chaltron.ldap_allow_all
+    get   'ldap/search'       => 'chaltron/ldap#search'
+    post  'ldap/multi_new'    => 'chaltron/ldap#multi_new'
+    post  'ldap/multi_create' => 'chaltron/ldap#multi_create'
+  end
 end

data/lib/chaltron.rb

@@ -14,7 +14,7 @@ module Chaltron
   @@default_roles = []
 
   mattr_accessor :ldap_allow_all
-  @@ldap_allow_all = false
+  @@ldap_allow_all = true
 
   mattr_accessor :enable_syslog
   @@enable_syslog = false
@@ -22,6 +22,29 @@ module Chaltron
   mattr_accessor :syslog_facility
   @@syslog_facility = Syslog::LOG_SYSLOG
 
+  mattr_accessor :ldap_field_mappings
+  @@ldap_field_mappings = {
+    first_name: 'givenname',
+    last_name: 'cn',
+    department: 'department',
+    email: 'mail'
+  }
+
+  mattr_accessor :ldap_group_base
+  @@ldap_group_base = nil
+
+  mattr_accessor :ldap_group_member_filter
+  @@ldap_group_member_filter = -> (entry) { "uniquemember=#{entry.dn}" }
+
+  mattr_accessor :ldap_role_mappings
+  @@ldap_role_mappings = {}
+
+  mattr_accessor :ldap_after_authenticate
+  @@ldap_after_authenticate = -> (user, ldap) { user }
+
+  mattr_accessor :ldap_before_logout
+  @@ldap_before_logout = -> (user, ldap) { }
+
   def self.setup
     yield self
   end

data/lib/chaltron/ldap/connection.rb

@@ -4,6 +4,12 @@ require 'chaltron/ldap/person'
 module Chaltron
   module LDAP
     class Connection
+      NET_LDAP_ENCRYPTION_METHOD = {
+        simple_tls: :simple_tls,
+        start_tls:  :start_tls,
+        plain:      nil
+      }.freeze
+
       attr_reader :ldap
 
       def initialize(params = {})
@@ -16,7 +22,9 @@ module Chaltron
       end
 
       def find_by_uid(id)
-        find_user(uid: id)
+        opts = {}
+        opts[uid.to_sym] = id
+        ret = find_user(opts)
       end
 
       def find_user(*args)
@@ -47,35 +55,31 @@ module Chaltron
             scope: Net::LDAP::SearchScope_BaseObject
           }
         else
-          filters = []
-          fields.each do |field|
-            filters << Net::LDAP::Filter.eq(field, args[field])
+          filters = fields.map do |field|
+            f = translate_field(field)
+            Net::LDAP::Filter.eq(f, args[field]) if f
           end
           options = {
             base: base,
             filter: filters.inject { |sum, n| Net::LDAP::Filter.join(sum, n) }
           }
         end
+        options.merge!(size: limit) unless limit.nil?
+        ldap_search(options).map do |entry|
+          Chaltron::LDAP::Person.new(entry, uid) if entry.respond_to? uid
+        end.compact
+      end
 
-#        if config.user_filter.present?
-#          user_filter = Net::LDAP::Filter.construct(config.user_filter)
-
-#          options[:filter] = if options[:filter]
-#                               Net::LDAP::Filter.join(options[:filter], user_filter)
-#                             else
-#                               user_filter
-#                             end
-#        end
-
-        options.merge!(size: limit) if limit.present?
-
-        entries = ldap_search(options).select do |entry|
-          entry.respond_to? uid
-        end
+      def find_groups_by_member(entry)
+        options = {
+          base: Chaltron.ldap_group_base || base,
+          filter: Chaltron.ldap_group_member_filter.call(entry)
+        }
+        ldap_search(options)
+      end
 
-        entries.map do |entry|
-          Chaltron::LDAP::Person.new(entry, uid)
-        end
+      def update_attributes(dn, args)
+        ldap.modify dn: dn, operations: args.map { |k,v| [:replace, k, v] }
       end
 
       private
@@ -84,15 +88,21 @@ module Chaltron
         Devise.omniauth_configs[:ldap].options
       end
 
+      def translate_field field
+        return uid if field.to_sym == :uid
+        return Chaltron.ldap_field_mappings[field.to_sym] unless Chaltron.ldap_field_mappings[field.to_sym].nil?
+        field
+      end
+
       def adapter_options
-        {
+        opts = {
           host: options[:host],
           port: options[:port],
-          encryption: encryption,
+          encryption: encryption_options,
           verbose: true
-        }.tap do |options|
-          options.merge!(auth_options) if has_auth?
-        end
+        }
+        opts.merge!(auth_options) if has_auth?
+        opts
       end
 
       def base
@@ -103,15 +113,64 @@ module Chaltron
         options[:uid]
       end
 
-      def encryption
-        case options[:method].to_s
-        when 'ssl'
-          :simple_tls
-        when 'tls'
-          :start_tls
-        else
-          nil
+      def encryption_options
+        method = translate_method
+        return unless method
+        {
+          method: method,
+          tls_options: tls_options
+        }
+      end
+
+      def translate_method
+        NET_LDAP_ENCRYPTION_METHOD[options[:encryption]&.to_sym]
+      end
+
+      def tls_options
+        return @tls_options if defined?(@tls_options)
+
+        method = translate_method
+        return unless method
+
+        opts = if options[:verify_certificates] && method != 'plain'
+                 # Dup so we don't accidentally overwrite the constant
+                 OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
+               else
+                 # It is important to explicitly set verify_mode for two reasons:
+                 # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
+                 # 2. The net-ldap gem implementation verifies the certificate hostname
+                 #    unless verify_mode is set to VERIFY_NONE.
+                 { verify_mode: OpenSSL::SSL::VERIFY_NONE }
+               end
+
+        opts.merge!(custom_tls_options)
+
+        @tls_options = opts
+      end
+
+      def custom_tls_options
+        return {} unless options['tls_options']
+
+        # Dup so we don't overwrite the original value
+        custom_options = options['tls_options'].dup.delete_if { |_, value| value.nil? || value.blank? }
+        custom_options.symbolize_keys!
+
+        if custom_options[:cert]
+          begin
+            custom_options[:cert] = OpenSSL::X509::Certificate.new(custom_options[:cert])
+          rescue OpenSSL::X509::CertificateError => e
+            Rails.logger.error "LDAP TLS Options 'cert' is invalid for provider #{provider}: #{e.message}"
+          end
+        end
+
+        if custom_options[:key]
+          begin
+            custom_options[:key] = OpenSSL::PKey.read(custom_options[:key])
+          rescue OpenSSL::PKey::PKeyError => e
+            Rails.logger.error "LDAP TLS Options 'key' is invalid for provider #{provider}: #{e.message}"
+          end
         end
+        custom_options
       end
 
       def auth_options

data/lib/chaltron/ldap/person.rb

@@ -44,11 +44,17 @@ module Chaltron
       end
 
       def department
-        entry.department.first rescue nil
+        entry.send(Chaltron.ldap_field_mappings[:department]).first rescue nil
       end
 
       def name
-        entry.cn.first
+        if Chaltron.ldap_field_mappings[:full_name].nil?
+          first_name = entry.send(Chaltron.ldap_field_mappings[:first_name]).first
+          last_name = entry.send(Chaltron.ldap_field_mappings[:last_name]).first
+          "#{first_name} #{last_name}"
+        else
+          entry.send(Chaltron.ldap_field_mappings[:full_name]).first
+        end
       end
 
       def uid
@@ -60,7 +66,7 @@ module Chaltron
       end
 
       def email
-        entry.mail.first rescue nil
+        entry.send(Chaltron.ldap_field_mappings[:email]).first rescue nil
       end
 
       def dn
@@ -71,6 +77,10 @@ module Chaltron
         'ldap'
       end
 
+      def ldap_groups
+        self.class.ldap.find_groups_by_member(self)
+      end
+
       private
 
       def self.ldap

data/lib/chaltron/ldap/user.rb

@@ -20,7 +20,11 @@ module Chaltron
           entry = Chaltron::LDAP::Person.find_by_uid(username)
           if user.nil? and create
             # create user
-            user = entry.create_user Chaltron.default_roles
+            roles = Chaltron.default_roles
+            roles = entry.ldap_groups.map do |e|
+              Chaltron.ldap_role_mappings[e.dn]
+            end.compact if !Chaltron.ldap_role_mappings.blank?
+            user = entry.create_user(roles)
           end
           update_ldap_attributes(user, entry) unless user.nil?
           user

data/lib/chaltron/version.rb

@@ -1,3 +1,3 @@
 module Chaltron
-  VERSION = '0.2.11'.freeze
+  VERSION = '0.3.0'.freeze
 end

data/lib/generators/chaltron/templates/config/initializers/chaltron.rb

@@ -2,13 +2,66 @@ Chaltron.setup do |config|
   # Add new roles to the right and NEVER change role order, or you'll break every role bitmask
   # config.roles = %w( admin user_admin )
 
-  # If ldap enabled (see config/initializers/devise.rb), set this to true to
-  # allow every ldap authenitcated users to access you application
-  # config.ldap_allow_all = false
+  # If LDAP enabled (see config/initializers/devise.rb), chaltron must use
+  # email field and may use first_name, last_name, full_name, department.
+  # Here is the field mapping on you own LDAP server.
+  # Default values are the following:
+  # config.ldap_field_mappings = {
+  #   first_name: 'givenname',
+  #   last_name: 'cn',
+  #   department: 'department',
+  #   email: 'mail'
+  # }
 
-  # Default roles granted to new users (if automatically created)
+  # If LDAP enabled, set this to true to allow every ldap authenitcated
+  # users to access you application
+  # config.ldap_allow_all = true
+
+  # You may set here default roles granted to new users (if automatically created)
   # config.default_roles = []
 
+  # Here you may specify a different base for your LDAP groups
+  # If not specified the :base parameter defined in Devise.omniauth_configs[:ldap] will be used
+  # config.ldap_group_base = 'ou=groups,dc=example,dc=com'
+
+  # Here you may specify a filter to retrieve LDAP group membership
+  # Accept entry (an instance of Chaltron::LDAP::Person) as parameter
+  # Default is
+  # config.ldap_group_member_filter = -> (entry) { "uniquemember=#{entry.dn}" }
+
+  # Roles granted to new users may be retrieved by LDAP group membership.
+  # config.ldap_role_mappings = {
+  #   'DN_of_LDAP_group1' => 'role1',
+  #   'DN_of_LDAP_group2' => 'role2'
+  # }
+
+  # The following callback is called after a successful LDAP authentication
+  # The callback may manipulate the user instance and
+  # must return user if ok, nil if not allowed do login
+  # Takes two parameters:
+  #  - user, current instance of User
+  #  - ldap, a new instance of Chaltron::LDAP::Connection
+  # Default is the following (it does nothing and return user)
+  # config.ldap_after_authenticate =  -> (user, ldap) { user }
+  #
+  # Example:
+  # config.ldap_after_authenticate = -> (user, ldap) {
+  #   ldap.find_by_uid(user.username).entry.enabled == ['true'] ? user : nil
+  # }
+
+  # The following callback is called before logout of an LDAP user
+  # Takes two parameters:
+  #  - user, current instance of User
+  #  - ldap, a new instance of Chaltron::LDAP::Connection
+  # Default is the following (does nothing)
+  # config.ldap_before_logout =  -> (user, ldap) { }
+  #
+  # Example:
+  # config.ldap_before_logout = -> (user, ldap) {
+  #   ldap.update_attributes(user.extern_uid, { lastLogout: Time.now.strftime('%Y%m%d%H%M%S%z') })
+  # }
+  #
+
   # If syslog enabled, all Log records will be available also in syslog flow
   # config.enable_syslog = false
   # config.syslog_facility = Syslog::LOG_SYSLOG

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chaltron
 version: !ruby/object:Gem::Version
-  version: 0.2.11
+  version: 0.3.0
 platform: ruby
 authors:
 - vicvega
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-15 00:00:00.000000000 Z
+date: 2019-04-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -405,6 +405,7 @@ files:
 - app/helpers/chaltron/logs_helper.rb
 - app/helpers/chaltron/users_helper.rb
 - app/helpers/chaltron_helper.rb
+- app/models/application_record.rb
 - app/models/authorizable.rb
 - app/models/locales/en.yml
 - app/models/locales/it.yml