devise_ldap_authenticatable 0.8.1 → 0.8.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 83f8abeb23a6a4f7ba011a20858268cc9bc1b0f8
-  data.tar.gz: dca093640944a95c13037086cc74c94a39f9af02
+SHA256:
+  metadata.gz: 7044550949ddebd6ea7cc11cf8ed2256b892f2c27dd2fc316a7c5a2b4bdcf685
+  data.tar.gz: ba36af309f585a37a6e2775810b62bc95a4c5d4203e9b2f7d174418c20a39e07
 SHA512:
-  metadata.gz: 65d9174c9f3d1231a895da94b731662a1fc5f4b3018b7626c95e71c94d739520d2737dd3ce27a999e60d9f64503b95fb3c68224fcdcb3da842570ec18fd43af6
-  data.tar.gz: 7cf26b625215614e7527745d3a32f449e592b56f7957cbad0a40cc253de4ccd63f6ef419d6854dcf8be28a555d25dd03c5de38eccef1e8279a56d9ece833099a
+  metadata.gz: d076e9ed84c61fc77dfd9f7006b594a2c841a600491d3b0c92d5bde42832b4df3324ebbb6df447221078f3d0dd5b91540d2882cec2c1e9d41bc5c84117a019e6
+  data.tar.gz: 9f2f642e37bf8a51db04a01aa58d93f96ceea8daf91ef7b0af3e0357c5289962c4e583aef57fb10a1f496b55d54012176b42086a3e417e482932733ace47b40f

data/.gitignore

@@ -7,4 +7,5 @@ test/ldap/openldap-data/*
 test/ldap/openldap-data/run/slapd.*
 test/rails_app/tmp
 pkg/*
-*.gem
+*.gem
+.vscode

data/README.md

@@ -1,8 +1,8 @@
 Devise LDAP Authenticatable
 ===========================
-[![Gem Version](https://badge.fury.io/rb/devise_ldap_authenticatable.png)](http://badge.fury.io/rb/devise_ldap_authenticatable)
-[![Code Climate](https://codeclimate.com/github/cschiewek/devise_ldap_authenticatable.png)](https://codeclimate.com/github/cschiewek/devise_ldap_authenticatable)
-[![Dependency Status](https://gemnasium.com/cschiewek/devise_ldap_authenticatable.png)](https://gemnasium.com/cschiewek/devise_ldap_authenticatable)
+
+[![Gem Version](https://badge.fury.io/rb/devise_ldap_authenticatable.svg)](http://badge.fury.io/rb/devise_ldap_authenticatable)
+[![Code Climate](https://codeclimate.com/github/cschiewek/devise_ldap_authenticatable.svg)](https://codeclimate.com/github/cschiewek/devise_ldap_authenticatable)
 
 Devise LDAP Authenticatable is a LDAP based authentication strategy for the [Devise](http://github.com/plataformatec/devise) authentication framework.
 
@@ -10,25 +10,29 @@ If you are building applications for use within your organization which require
 
 Devise LDAP Authenticatable works in replacement of Database Authenticatable. This devise plugin has not been tested with DatabaseAuthenticatable enabled at the same time. This is meant as a drop in replacement for DatabaseAuthenticatable allowing for a semi single sign on approach.
 
-For a screencast with an example application, please visit: [http://random-rails.blogspot.com/2010/07/ldap-authentication-with-devise.html](http://random-rails.blogspot.com/2010/07/ldap-authentication-with-devise.html)
+For a screencast with an example application, please visit: [http://corrupt.net/2010/07/05/LDAP-Authentication-With-Devise/](http://corrupt.net/2010/07/05/LDAP-Authentication-With-Devise/)
 
 Prerequisites
 -------------
  * devise ~> 3.0.0 (which requires rails ~> 4.0)
- * net-ldap ~> 0.3.1
+ * net-ldap ~> 0.6.0
 
 Note: Rails 3.x / Devise 2.x has been moved to the 0.7 branch.  All 0.7.x gems will support Rails 3, where as 0.8.x will support Rails 4.
 
+If you are transitioning from having Devise manage your users' passwords in the database to using LDAP auth, you may have to update your `users` table to make `encrypted_password` nullable, or else the LDAP user insert will fail.
+
 Usage
 -----
 In the Gemfile for your application:
 
-    gem "devise_ldap_authenticatable"
-
+```ruby
+gem "devise_ldap_authenticatable"
+```
 To get the latest version, pull directly from github instead of the gem:
 
-    gem "devise_ldap_authenticatable", :git => "git://github.com/cschiewek/devise_ldap_authenticatable.git"
-
+```ruby
+gem "devise_ldap_authenticatable", :git => "git://github.com/cschiewek/devise_ldap_authenticatable.git"
+```
 
 Setup
 -----
@@ -41,7 +45,7 @@ Run the rails generator for `devise_ldap_authenticatable`
 
     rails generate devise_ldap_authenticatable:install [options]
 
-This will install the sample.yml, update the devise.rb initializer, and update your user model. There are some options you can pass to it:
+This will install the ldap.yml, update the devise.rb initializer, and update your user model. There are some options you can pass to it:
 
 Options:
 
@@ -57,13 +61,13 @@ Querying LDAP
 -------------
 Given that `ldap_create_user` is set to true and you are authenticating with username, you can query an LDAP server for other attributes.
 
-in your user model:
-
-    before_save :get_ldap_email
+in your user model you have to simply define `ldap_before_save` method:
 
-    def get_ldap_email
-      self.email = Devise::LdapAdapter.get_ldap_param(self.username,"mail")
-    end
+```ruby
+def ldap_before_save
+  self.email = Devise::LDAP::Adapter.get_ldap_param(self.username,"mail").first
+end
+```
 
 Configuration
 -------------
@@ -71,25 +75,22 @@ In initializer  `config/initializers/devise.rb` :
 
 * `ldap_logger` _(default: true)_
   * If set to true, will log LDAP queries to the Rails logger.
-
 * `ldap_create_user` _(default: false)_
-  * If set to true, all valid LDAP users will be allowed to login and an appropriate user record will be created.
-      If set to false, you will have to create the user record before they will be allowed to login.
-
+  * If set to true, all valid LDAP users will be allowed to login and an appropriate user record will be created. If set to false, you will have to create the user record before they will be allowed to login.
 * `ldap_config` _(default: #{Rails.root}/config/ldap.yml)_
-	* Where to find the LDAP config file. Commented out to use the default, change if needed.
-
+  * Where to find the LDAP config file. Commented out to use the default, change if needed.
 * `ldap_update_password` _(default: true)_
   * When doing password resets, if true will update the LDAP server. Requires admin password in the ldap.yml
-
 * `ldap_check_group_membership` _(default: false)_
   * When set to true, the user trying to login will be checked to make sure they are in all of groups specified in the ldap.yml file.
-
 * `ldap_check_attributes` _(default: false)_
-  * When set to true, the user trying to login will be checked to make sure they have all of the attributes in the ldap.yml file.
-
+  * When set to true, the user trying to login will be checked to make sure their attributes match those specified in the ldap.yml file.
+* `ldap_check_attributes_presence` _(default: false)_
+  * When set to true, the user trying to login will be checked against all `require_attribute_presence` attributes in the ldap.yml file, either present _(attr: true)_,or not present _(attr: false)_.
 * `ldap_use_admin_to_bind` _(default: false)_
   * When set to true, the admin user will be used to bind to the LDAP server during authentication.
+* `ldap_check_group_membership_without_admin` _(default: false)_
+  * When set to true, the group membership check is done with the user's own credentials rather than with admin credentials. Since these credentials are only available to the Devise user model during the login flow, the group check function will not work if a group check is performed when this option is true outside of the login flow (e.g., before particular actions).
 
 Advanced Configuration
 ----------------------
@@ -97,10 +98,12 @@ These parameters will be added to `config/initializers/devise.rb` when you pass
 
 * `ldap_auth_username_builder` _(default: `Proc.new() {|attribute, login, ldap| "#{attribute}=#{login},#{ldap.base}" }`)_
   * You can pass a proc to the username option to explicitly specify the format that you search for a users' DN on your LDAP server.
+* `ldap_auth_password_build` _(default: `Proc.new() {|new_password| Net::LDAP::Password.generate(:sha, new_password) }`)_
+  * Optionally you can define a proc to create custom password encrption when user reset password
 
 Troubleshooting
 --------------
-**Using a "username" instead of an "email":** The field that is used for logins is the first key that's configured in the `config/devise.rb` file under `config.authentication_keys`, which by default is email. For help changing this, please see the [Railscast](http://railscasts.com/episodes/210-customizing-devise) that goes through how to customize Devise.
+**Using a "username" instead of an "email":** The field that is used for logins is the first key that's configured in the `config/initializers/devise.rb` file under `config.authentication_keys`, which by default is email. For help changing this, please see the [Railscast](http://railscasts.com/episodes/210-customizing-devise) that goes through how to customize Devise. Also, this [documentation](https://github.com/plataformatec/devise/wiki/How-To%3a-Allow-users-to-sign-in-using-their-username-or-email-address) from Devise can be very helpful.
 
 **SSL certificate invalid:** If you're using a test LDAP server running a self-signed SSL certificate, make sure the appropriate root certificate is installed on your system. Alternately, you may temporarily disable certificate checking for SSL by modifying your system LDAP configuration (e.g., `/etc/openldap/ldap.conf` or `/etc/ldap/ldap.conf`) to read `TLS_REQCERT never`.
 
@@ -111,13 +114,14 @@ For additional support, questions or discussions, please see the discussion foru
 
 Development guide
 ------------
-To contribute to `devise_ldap_authentication`, you should be able to run a test OpenLDAP server. Specifically, you need the `slapd`, `ldapadd`, and `ldapmodify` binaries.
 
-This seems to come out of the box with Mac OS X 10.6.
+Devise LDAP Authenticatable uses a running OpenLDAP server to do automated acceptance tests. You'll need the executables `slapd`, `ldapadd`, and `ldapmodify`.
+
+On OS X, this is available out of the box.
 
-On Ubuntu (tested on 12.04 and 12.10), you can run `sudo apt-get install slapd ldap-utils`. You will also likely have to add the `spec/ldap` directory of your local git clone to the slapd [apparmor](https://wiki.ubuntu.com/DebuggingApparmor) profile `/etc/apparmor.d/usr.sbin.slapd` if you get permissions errors. Something like this should do:
+On Ubuntu, you can install OpenLDAP with `sudo apt-get install slapd ldap-utils`. If slapd runs under AppArmor, add an exception like this to `/etc/apparmor.d/local/usr.sbin.slapd` to let slapd read our configs (reload using `sudo service apparmor reload` afterwards).
 
-    /path/to/devise_ldap_authenticatable/spec/ldap/** rw,$
+    /path/to/devise_ldap_authenticatable/spec/ldap/** rw,
 
 To start hacking on `devise_ldap_authentication`, clone the github repository, start the test LDAP server, and run the rake test task:
 
@@ -128,7 +132,7 @@ To start hacking on `devise_ldap_authentication`, clone the github repository, s
     # in a separate console or backgrounded
     ./spec/ldap/run-server
 
-    bundle exec rake db:migrate # first time only
+    RAILS_ENV=test bundle exec rake db:migrate # first time only
     bundle exec rake spec
 
 References

data/devise_ldap_authenticatable.gemspec

@@ -18,16 +18,16 @@ Gem::Specification.new do |s|
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
-  s.add_dependency('devise', '>= 3.0')
-  s.add_dependency('net-ldap', '>= 0.3.1', '< 0.6.0')
+  s.add_dependency 'devise', '>= 3.4.1'
+  s.add_dependency 'net-ldap', '>= 0.16.0'
 
-  s.add_development_dependency('rake', '>= 0.9')
-  s.add_development_dependency('rdoc', '>= 3')
-  s.add_development_dependency('rails', '>= 4.0')
-  s.add_development_dependency('sqlite3')
-  s.add_development_dependency('factory_girl_rails', '~> 1.0')
-  s.add_development_dependency('factory_girl', '~> 2.0')
-  s.add_development_dependency('rspec-rails')
+  s.add_development_dependency 'rake', '>= 0.9'
+  s.add_development_dependency 'rdoc', '>= 3'
+  s.add_development_dependency 'rails', '>= 4.0'
+  s.add_development_dependency 'sqlite3'
+  s.add_development_dependency 'factory_girl_rails', '~> 1.0'
+  s.add_development_dependency 'factory_girl', '~> 2.0'
+  s.add_development_dependency 'rspec-rails'
 
   %w{database_cleaner capybara launchy}.each do |dep|
     s.add_development_dependency(dep)

data/lib/devise_ldap_authenticatable.rb

@@ -1,5 +1,6 @@
 # encoding: utf-8
 require 'devise'
+require 'net/ldap'
 
 require 'devise_ldap_authenticatable/exception'
 require 'devise_ldap_authenticatable/logger'
@@ -11,29 +12,40 @@ module Devise
   # Allow logging
   mattr_accessor :ldap_logger
   @@ldap_logger = true
-  
+
   # Add valid users to database
   mattr_accessor :ldap_create_user
   @@ldap_create_user = false
-  
+
+  # A path to YAML config file or a Proc that returns a
+  # configuration hash
   mattr_accessor :ldap_config
   # @@ldap_config = "#{Rails.root}/config/ldap.yml"
-  
+
   mattr_accessor :ldap_update_password
   @@ldap_update_password = true
-  
+
   mattr_accessor :ldap_check_group_membership
   @@ldap_check_group_membership = false
-  
+
+  mattr_accessor :ldap_check_group_membership_without_admin
+  @@ldap_check_group_membership_without_admin = false
+
   mattr_accessor :ldap_check_attributes
   @@ldap_check_role_attribute = false
-  
+
+  mattr_accessor :ldap_check_attributes_presence
+  @@ldap_check_attributes_presence = false
+
   mattr_accessor :ldap_use_admin_to_bind
   @@ldap_use_admin_to_bind = false
-  
+
   mattr_accessor :ldap_auth_username_builder
   @@ldap_auth_username_builder = Proc.new() {|attribute, login, ldap| "#{attribute}=#{login},#{ldap.base}" }
 
+  mattr_accessor :ldap_auth_password_builder
+  @@ldap_auth_password_builder = Proc.new() {|new_password| Net::LDAP::Password.generate(:sha, new_password) }
+
   mattr_accessor :ldap_ad_group_check
   @@ldap_ad_group_check = false
 end
@@ -44,4 +56,4 @@ Devise.add_module(:ldap_authenticatable,
                   :route => :session, ## This will add the routes, rather than in the routes.rb
                   :strategy   => true,
                   :controller => :sessions,
-                  :model  => 'devise_ldap_authenticatable/model')
+                  :model  => 'devise_ldap_authenticatable/model')

data/lib/devise_ldap_authenticatable/ldap/adapter.rb

@@ -15,6 +15,16 @@ module Devise
         resource.authorized?
       end
 
+      def self.expired_valid_credentials?(login, password_plaintext)
+        options = {:login => login,
+                   :password => password_plaintext,
+                   :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
+                   :admin => ::Devise.ldap_use_admin_to_bind}
+
+        resource = Devise::LDAP::Connection.new(options)
+        resource.expired_valid_credentials?
+      end
+
       def self.update_password(login, new_password)
         options = {:login => login,
                    :new_password => new_password,
@@ -26,7 +36,7 @@ module Devise
       end
 
       def self.update_own_password(login, new_password, current_password)
-        set_ldap_param(login, :userpassword, Net::LDAP::Password.generate(:sha, new_password), current_password)
+        set_ldap_param(login, :userPassword, ::Devise.ldap_auth_password_builder.call(new_password), current_password)
       end
 
       def self.ldap_connect(login)
@@ -34,7 +44,7 @@ module Devise
                    :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
                    :admin => ::Devise.ldap_use_admin_to_bind}
 
-        resource = Devise::LDAP::Connection.new(options)
+        Devise::LDAP::Connection.new(options)
       end
 
       def self.valid_login?(login)
@@ -54,18 +64,18 @@ module Devise
       end
 
       def self.set_ldap_param(login, param, new_value, password = nil)
-        options = { :login => login,
-                    :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
-                    :password => password }
+        options = {:login => login,
+                   :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
+                   :password => password }
 
         resource = Devise::LDAP::Connection.new(options)
         resource.set_param(param, new_value)
       end
 
       def self.delete_ldap_param(login, param, password = nil)
-        options = { :login => login,
-                    :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
-                    :password => password }
+        options = {:login => login,
+                   :ldap_auth_username_builder => ::Devise.ldap_auth_username_builder,
+                   :password => password }
 
         resource = Devise::LDAP::Connection.new(options)
         resource.delete_param(param)
@@ -79,9 +89,6 @@ module Devise
       def self.get_ldap_entry(login)
         self.ldap_connect(login).search_for_login
       end
-
     end
-
   end
-
-end
+end

data/lib/devise_ldap_authenticatable/ldap/connection.rb

@@ -4,22 +4,34 @@ module Devise
       attr_reader :ldap, :login
 
       def initialize(params = {})
-        ldap_config = YAML.load(ERB.new(File.read(::Devise.ldap_config || "#{Rails.root}/config/ldap.yml")).result)[Rails.env]
+        if ::Devise.ldap_config.is_a?(Proc)
+          ldap_config = ::Devise.ldap_config.call
+        else
+          ldap_config = YAML.load(ERB.new(File.read(::Devise.ldap_config || "#{Rails.root}/config/ldap.yml")).result)[Rails.env]
+        end
         ldap_options = params
+
+        # Allow `ssl: true` shorthand in YAML, but enable more control with `encryption`
         ldap_config["ssl"] = :simple_tls if ldap_config["ssl"] === true
         ldap_options[:encryption] = ldap_config["ssl"].to_sym if ldap_config["ssl"]
+        ldap_options[:encryption] = ldap_config["encryption"] if ldap_config["encryption"]
 
         @ldap = Net::LDAP.new(ldap_options)
         @ldap.host = ldap_config["host"]
         @ldap.port = ldap_config["port"]
         @ldap.base = ldap_config["base"]
         @attribute = ldap_config["attribute"]
+        @allow_unauthenticated_bind = ldap_config["allow_unauthenticated_bind"]
+
         @ldap_auth_username_builder = params[:ldap_auth_username_builder]
 
         @group_base = ldap_config["group_base"]
         @check_group_membership = ldap_config.has_key?("check_group_membership") ? ldap_config["check_group_membership"] : ::Devise.ldap_check_group_membership
+        @check_group_membership_without_admin = ldap_config.has_key?("check_group_membership_without_admin") ? ldap_config["check_group_membership_without_admin"] : ::Devise.ldap_check_group_membership_without_admin
         @required_groups = ldap_config["required_groups"]
+        @group_membership_attribute = ldap_config.has_key?("group_membership_attribute") ? ldap_config["group_membership_attribute"] : "uniqueMember"
         @required_attributes = ldap_config["require_attribute"]
+        @required_attributes_presence = ldap_config["require_attribute_presence"]
 
         @ldap.auth ldap_config["admin_user"], ldap_config["admin_password"] if params[:admin]
 
@@ -37,19 +49,19 @@ module Devise
       end
 
       def dn
-        DeviseLdapAuthenticatable::Logger.send("LDAP dn lookup: #{@attribute}=#{@login}")
-        ldap_entry = search_for_login
-        if ldap_entry.nil?
-          @ldap_auth_username_builder.call(@attribute,@login,@ldap)
-        else
-          ldap_entry.dn
+        @dn ||= begin
+          DeviseLdapAuthenticatable::Logger.send("LDAP dn lookup: #{@attribute}=#{@login}")
+          ldap_entry = search_for_login
+          if ldap_entry.nil?
+            @ldap_auth_username_builder.call(@attribute,@login,@ldap)
+          else
+            ldap_entry.dn
+          end
         end
       end
 
       def ldap_param_value(param)
-        filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
-        ldap_entry = nil
-        @ldap.search(:filter => filter) {|entry| ldap_entry = entry}
+        ldap_entry = search_for_login
 
         if ldap_entry
           unless ldap_entry[param].empty?
@@ -67,6 +79,7 @@ module Devise
       end
 
       def authenticate!
+        return false unless (@password.present? || @allow_unauthenticated_bind)
         @ldap.auth(dn, @password)
         @ldap.bind
       end
@@ -75,10 +88,25 @@ module Devise
         authenticate!
       end
 
+      def last_message_bad_credentials?
+        @ldap.get_operation_result.error_message.to_s.include? 'AcceptSecurityContext error, data 52e'
+      end
+
+      def last_message_expired_credentials?
+        @ldap.get_operation_result.error_message.to_s.include? 'AcceptSecurityContext error, data 773'
+      end
+
       def authorized?
         DeviseLdapAuthenticatable::Logger.send("Authorizing user #{dn}")
         if !authenticated?
-          DeviseLdapAuthenticatable::Logger.send("Not authorized because not authenticated.")
+          if last_message_bad_credentials?
+            DeviseLdapAuthenticatable::Logger.send("Not authorized because of invalid credentials.")
+          elsif last_message_expired_credentials?
+            DeviseLdapAuthenticatable::Logger.send("Not authorized because of expired credentials.")
+          else
+            DeviseLdapAuthenticatable::Logger.send("Not authorized because not authenticated.")
+          end
+
           return false
         elsif !in_required_groups?
           DeviseLdapAuthenticatable::Logger.send("Not authorized because not in required groups.")
@@ -86,17 +114,26 @@ module Devise
         elsif !has_required_attribute?
           DeviseLdapAuthenticatable::Logger.send("Not authorized because does not have required attribute.")
           return false
+        elsif !has_required_attribute_presence?
+          DeviseLdapAuthenticatable::Logger.send("Not authorized because does not have required attribute present.")
+          return false
         else
           return true
         end
       end
 
+      def expired_valid_credentials?
+        DeviseLdapAuthenticatable::Logger.send("Authorizing user #{dn}")
+
+        !authenticated? && last_message_expired_credentials?
+      end
+
       def change_password!
-        update_ldap(:userpassword => Net::LDAP::Password.generate(:sha, @new_password))
+        update_ldap(:userPassword => ::Devise.ldap_auth_password_builder.call(@new_password))
       end
 
       def in_required_groups?
-        return true unless @check_group_membership
+        return true unless @check_group_membership || @check_group_membership_without_admin
 
         ## FIXME set errors here, the ldap.yml isn't set properly.
         return false if @required_groups.nil?
@@ -114,23 +151,29 @@ module Devise
       def in_group?(group_name, group_attribute = LDAP::DEFAULT_GROUP_UNIQUE_MEMBER_LIST_KEY)
         in_group = false
 
-        admin_ldap = Connection.admin
+        if @check_group_membership_without_admin
+          group_checking_ldap = @ldap
+        else
+          group_checking_ldap = Connection.admin
+        end
 
         unless ::Devise.ldap_ad_group_check
-          admin_ldap.search(:base => group_name, :scope => Net::LDAP::SearchScope_BaseObject) do |entry|
+          group_checking_ldap.search(:base => group_name, :scope => Net::LDAP::SearchScope_BaseObject) do |entry|
             if entry[group_attribute].include? dn
               in_group = true
+              DeviseLdapAuthenticatable::Logger.send("User #{dn} IS included in group: #{group_name}")
             end
           end
         else
           # AD optimization - extension will recursively check sub-groups with one query
           # "(memberof:1.2.840.113556.1.4.1941:=group_name)"
-          search_result = admin_ldap.search(:base => dn,
+          search_result = group_checking_ldap.search(:base => dn,
                             :filter => Net::LDAP::Filter.ex("memberof:1.2.840.113556.1.4.1941", group_name),
                             :scope => Net::LDAP::SearchScope_BaseObject)
           # Will return  the user entry if belongs to group otherwise nothing
           if search_result.length == 1 && search_result[0].dn.eql?(dn)
             in_group = true
+            DeviseLdapAuthenticatable::Logger.send("User #{dn} IS included in group: #{group_name}")
           end
         end
 
@@ -145,11 +188,11 @@ module Devise
         return true unless ::Devise.ldap_check_attributes
 
         admin_ldap = Connection.admin
-
         user = find_ldap_user(admin_ldap)
 
         @required_attributes.each do |key,val|
-          unless user[key].include? val
+          matching_attributes = user[key] & Array(val)
+          unless (matching_attributes).any?
             DeviseLdapAuthenticatable::Logger.send("User #{dn} did not match attribute #{key}:#{val}")
             return false
           end
@@ -158,11 +201,28 @@ module Devise
         return true
       end
 
+      def has_required_attribute_presence?
+        return true unless ::Devise.ldap_check_attributes_presence
+
+        user = search_for_login
+
+        @required_attributes_presence.each do |key,val|
+          if val && !user.attribute_names.include?(key.to_sym)
+            DeviseLdapAuthenticatable::Logger.send("User #{dn} doesn't include attribute #{key}")
+            return false
+          elsif !val && user.attribute_names.include?(key.to_sym)
+            DeviseLdapAuthenticatable::Logger.send("User #{dn} includes attribute #{key}")
+            return false
+          end
+        end
+
+        return true
+      end
+
       def user_groups
         admin_ldap = Connection.admin
-
         DeviseLdapAuthenticatable::Logger.send("Getting groups for #{dn}")
-        filter = Net::LDAP::Filter.eq("uniqueMember", dn)
+        filter = Net::LDAP::Filter.eq(@group_membership_attribute, dn)
         admin_ldap.search(:filter => filter, :base => @group_base).collect(&:dn)
       end
 
@@ -174,13 +234,19 @@ module Devise
       #
       # @return [Object] the LDAP entry found; nil if not found
       def search_for_login
-        DeviseLdapAuthenticatable::Logger.send("LDAP search for login: #{@attribute}=#{@login}")
-        filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
-        ldap_entry = nil
-        match_count = 0
-        @ldap.search(:filter => filter) {|entry| ldap_entry = entry; match_count+=1}
-        DeviseLdapAuthenticatable::Logger.send("LDAP search yielded #{match_count} matches")
-        ldap_entry
+        @login_ldap_entry ||= begin
+          DeviseLdapAuthenticatable::Logger.send("LDAP search for login: #{@attribute}=#{@login}")
+          filter = Net::LDAP::Filter.eq(@attribute.to_s, @login.to_s)
+          ldap_entry = nil
+          match_count = 0
+          @ldap.search(:filter => filter) {|entry| ldap_entry = entry; match_count+=1}
+          op_result= @ldap.get_operation_result
+          if op_result.code!=0 then
+            DeviseLdapAuthenticatable::Logger.send("LDAP Error #{op_result.code}: #{op_result.message}")
+          end
+          DeviseLdapAuthenticatable::Logger.send("LDAP search yielded #{match_count} matches")
+          ldap_entry
+        end
       end
 
       private
@@ -223,4 +289,4 @@ module Devise
       end
     end
   end
-end
+end