entitlements-app 1.2.10 → 1.2.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a782de54803d00a4afb8383789c796efbe8375eb92641c5537507f77eb4fb192
-  data.tar.gz: 2a53134a1ec22d96647f1739f6263a381d42d3a10620588d9c7561ff49a79e08
+  metadata.gz: 6d261fd97bc7b035820a02ef58cfd54b54678ca97bba95caa68625bfdf3f09a1
+  data.tar.gz: df68e3cf38d4602047b2fcb3e853a2d31ee10e6c5a71ffdead194824ef15f8e8
 SHA512:
-  metadata.gz: 24254d8ce6d94b3c9b011effa5334c173db77dda656b72ce9bf40f82990a32328892b775d150642430d05c23cf0d4c114d4fe63b7455eab07c25465fed873369
-  data.tar.gz: 95e6dc2fafc0df322a9817a245e0c2131daa117a4dc919b4efbcd72d289e8349a09403b2111982e19c9db11c67b8d38090e091d3a71f8cc15168e83d3c118cac
+  metadata.gz: 0cc730a8a9eb5f0cde4c638c9228bedb52c74fd8902d7af54ddee675fda12af8246159a54bfe33ce6440dbce500c3b5d463483d60b34ca23617981eedf265f6c
+  data.tar.gz: b9237fea7006e586a638e16ffeb0b71b8325cbee3126fe2cd5102a3b8ed286d9fccd7cbc4a6e54d01e0e70761cf31d1f957e54db5e5437d8c7a2ab8f46d85505

data/lib/entitlements/data/groups/calculated/base.rb

@@ -107,7 +107,7 @@ module Entitlements
           # members_in - Optionally a set of Entitlements::Models::Person with the currently calculated member set.
           #
           # Returns Set[Entitlements::Models::Person] of all matching members.
-          Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
+          Contract C::None => C::Or[:calculating, Set]
           def filtered_members
             return :calculating if members == :calculating
 

data/lib/entitlements/service/ldap.rb

@@ -84,6 +84,8 @@ module Entitlements
         @person_dn_format = person_dn_format
         @known_existing_dns = {}
         @known_existing_dns_mutex = Mutex.new
+        @search_connections = {}
+        @search_connections_mutex = Mutex.new
       end
 
       # Read a single entry identified by its DN and return the value. Returns nil if
@@ -122,32 +124,32 @@ module Entitlements
         # be consistent no matter what. LDAP is case insensitive after all!
         downcased_attrs = attrs == "*" ? "*" : attrs.map { |a| a.downcase }
 
-        # Outside the retry block: `ldap` retries its own bind, and nesting would multiply attempts.
-        connection = ldap
         result = with_ldap_connection_retries do
-          entries = {}
-          search_succeeded = connection.search(
-            base: base,
-            filter: filter,
-            attributes: downcased_attrs,
-            scope: scope,
-            return_result: false
-          ) do |entry|
-            result_key = index == :dn ? entry.dn : entry[index]
-            unless result_key
-              raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
+          with_search_connection do |connection|
+            entries = {}
+            search_succeeded = connection.search(
+              base: base,
+              filter: filter,
+              attributes: downcased_attrs,
+              scope: scope,
+              return_result: false
+            ) do |entry|
+              result_key = index == :dn ? entry.dn : entry[index]
+              unless result_key
+                raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
+              end
+
+              if entries.key?(result_key)
+                other_entry_dn = entries[result_key].dn
+                raise DuplicateEntryError, "#{entry.dn} and #{other_entry_dn} have the same value of #{index} = #{result_key.inspect}"
+              end
+
+              entries[result_key] = entry
             end
+            remember_existing_dn(base) if search_succeeded
 
-            if entries.key?(result_key)
-              other_entry_dn = entries[result_key].dn
-              raise DuplicateEntryError, "#{entry.dn} and #{other_entry_dn} have the same value of #{index} = #{result_key.inspect}"
-            end
-
-            entries[result_key] = entry
+            entries
           end
-          remember_existing_dn(base) if search_succeeded
-
-          entries
         end
 
         Entitlements.logger.debug "Completed search: #{result.keys.size} result(s)"
@@ -261,24 +263,6 @@ module Entitlements
 
           # Construct the object
           Entitlements.logger.debug "Creating connection to #{uri.host} port #{uri.port}"
-          ldap_options = {
-            host: uri.host,
-            port: uri.port,
-            auth: { method: :simple, username: binddn, password: bindpw }
-          }
-          if uri.scheme == "ldaps"
-            ldap_options[:encryption] = {
-              method: :simple_tls,
-              tls_options: {
-                verify_mode: @disable_ssl_verification ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
-              }
-            }
-          end
-
-          if @ca_file && ldap_options[:encryption].key?(:tls_options)
-            ldap_options[:encryption][:tls_options][:ca_file] = @ca_file
-          end
-
           ldap_object = Net::LDAP.new(ldap_options)
           raise WTFError, "FATAL: can't create LDAP connection object" if ldap_object.nil?
 
@@ -297,6 +281,78 @@ module Entitlements
         end
       end
 
+      def ldap_options
+        uri = URI(addr)
+        options = {
+          host: uri.host,
+          port: uri.port,
+          auth: { method: :simple, username: binddn, password: bindpw }
+        }
+        if uri.scheme == "ldaps"
+          options[:encryption] = {
+            method: :simple_tls,
+            tls_options: {
+              verify_mode: @disable_ssl_verification ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
+            }
+          }
+        end
+
+        if @ca_file && options[:encryption].key?(:tls_options)
+          options[:encryption][:tls_options][:ca_file] = @ca_file
+        end
+
+        options
+      end
+
+      # Searches reuse one bound connection per thread instead of connecting and binding each time.
+      def with_search_connection
+        reused = @search_connections_mutex.synchronize { @search_connections.key?(Thread.current) }
+        yield search_connection
+      rescue SystemCallError, IOError, OpenSSL::SSL::SSLError, Net::LDAP::Error
+        close_search_connection
+        # The server may have dropped an idle connection, so retry once on a new one.
+        reused ? retry : raise
+      end
+
+      def search_connection
+        existing = @search_connections_mutex.synchronize { @search_connections[Thread.current] }
+        return existing.first if existing
+
+        options = ldap_options
+        Entitlements.logger.debug "Creating connection to #{options[:host]} port #{options[:port]}"
+        connection = Net::LDAP::Connection.new(host: options[:host], port: options[:port], encryption: options[:encryption])
+        Entitlements.logger.debug "Binding with user #{binddn.inspect} with simple password authentication"
+        begin
+          result = connection.bind(options[:auth])
+        rescue StandardError
+          close_connection(connection)
+          raise
+        end
+        unless result.result_code == Net::LDAP::ResultCodeSuccess
+          close_connection(connection)
+          message = Net::LDAP.result2string(result.result_code)
+          Entitlements.logger.fatal message
+          raise ConnectionError, "FATAL: #{message}"
+        end
+        Entitlements.logger.debug "Successfully authenticated to #{options[:host]} port #{options[:port]}"
+
+        ldap_object = Net::LDAP.new(options)
+        ldap_object.connection = connection
+        @search_connections_mutex.synchronize { @search_connections[Thread.current] = [ldap_object, connection] }
+        ldap_object
+      end
+
+      def close_search_connection
+        _, connection = @search_connections_mutex.synchronize { @search_connections.delete(Thread.current) }
+        close_connection(connection)
+      end
+
+      def close_connection(connection)
+        connection&.close
+      rescue IOError, SystemCallError, OpenSSL::SSL::SSLError
+        nil
+      end
+
       def with_ldap_connection_retries
         attempts = 0
         begin

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.10"
+    VERSION = "1.2.12"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.10
+  version: 1.2.12
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-06 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby