gitlab_omniauth-ldap 2.0.4 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4d5b4eb5376fab8ef4f9e5e006ba83aa214402e0
-  data.tar.gz: 372d5d8f78a286cfe1328695f11323704a8297b6
+  metadata.gz: 107e59861e46c73e0ef7ecce99aae216a71f9dd1
+  data.tar.gz: 0eee9f8076ecad7e956ddd666e5b921b0fcd55e8
 SHA512:
-  metadata.gz: e2154945f44fa50434692911fafa1fdc098d4758603c6391be558b701ae4f87b712aef88501c98fa00dda0160e74995172067f9c24f97b051da29e8145f4e0bf
-  data.tar.gz: 5d9b8cd9c5e488f1a643c6bae705f79290bcf04588a50e638bc1d6a80e2d67ba3fedfd122d4ca405b32e58a7fa0edcd0f58ef6736dba02876bf7bfdfab122e4e
+  metadata.gz: 91734fda37560214286bfce376042ad99a972f285de2e6c61d189ddab9a81c0ae3d8eab2ff209c41b1eb378e680f1570942e5cb08b1e729f245b65223618ee59
+  data.tar.gz: efe11e7dc19bf70bc74f2ac3e71cf345bf0ac20c8ef36fabceaa01c1066228d48acf5b5226ff9f951249080e0d0d5b31f79ee1c3788f2bf4cd0782e18726dec9

data/CHANGELOG

@@ -1,3 +1,6 @@
+## 2.1.0
+  - Expose `:tls_options` SSL configuration option. Deprecate :ca_file, :ssl_version
+
 ## 2.0.4
   - Improve log message when invalid credentials are used
 

data/README.md

@@ -18,6 +18,10 @@ Use the LDAP strategy as a middleware in your application:
         :name_proc    => Proc.new {|name| name.gsub(/@.*$/,'')}
         :bind_dn      => 'default_bind_dn'
         :password     => 'password'
+        :tls_options  => {
+          :ssl_version => 'TLSv1_2',
+          :ciphers     => ["AES-128-CBC", "AES-128-CBC-HMAC-SHA1", "AES-128-CBC-HMAC-SHA256"]
+        }
 
 All of the listed options are required, with the exception of :title, :name_proc, :bind_dn, and :password.
 
@@ -48,6 +52,10 @@ All of the listed options are required, with the exception of :title, :name_proc
   Use them to initialize a SASL connection to server. If you are not familiar with these authentication methods, 
   please just avoid them.
 
+- `:tls_options` allows you to pass in OpenSSL options like `:ssl_version`,
+  `:ciphers` and more. See http://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/SSL/SSLContext.html
+  for all available options and values.
+
 Direct users to '/auth/ldap' to have them authenticated via your company's LDAP server.
 
 

data/gitlab_omniauth-ldap.gemspec

@@ -6,7 +6,7 @@ Gem::Specification.new do |gem|
   gem.email         = ["ping@intridea.com"]
   gem.description   = %q{A LDAP strategy for OmniAuth.}
   gem.summary       = %q{A LDAP strategy for OmniAuth.}
-  gem.homepage      = "https://github.com/gitlabhq/omniauth-ldap"
+  gem.homepage      = "https://gitlab.com/gitlab-org/omniauth-ldap"
   gem.license       = "MIT"
 
   gem.add_runtime_dependency     'omniauth', '~> 1.3'

data/lib/omniauth-ldap/adaptor.rb

@@ -15,10 +15,12 @@ module OmniAuth
 
       VALID_ADAPTER_CONFIGURATION_KEYS = [
         :hosts, :host, :port, :encryption, :disable_verify_certificates, :bind_dn, :password, :try_sasl,
-        :sasl_mechanisms, :uid, :base, :allow_anonymous, :filter, :ca_file, :ssl_version,
+        :sasl_mechanisms, :uid, :base, :allow_anonymous, :filter, :tls_options,
 
         # Deprecated
-        :method
+        :method,
+        :ca_file,
+        :ssl_version
       ]
 
       # A list of needed keys. Possible alternatives are specified using sub-lists.
@@ -134,19 +136,21 @@ module OmniAuth
       def tls_options(translated_method)
         return {} if translated_method == nil # (plain)
 
-        tls_options = if @disable_verify_certificates
-                        # It is important to explicitly set verify_mode for two reasons:
-                        # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
-                        # 2. The net-ldap gem implementation verifies the certificate hostname
-                        #    unless verify_mode is set to VERIFY_NONE.
-                        { verify_mode: OpenSSL::SSL::VERIFY_NONE }
-                      else
-                        OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
-                      end
-
-        tls_options[:ca_file] = @ca_file if @ca_file
-        tls_options[:ssl_version] = @ssl_version if @ssl_version
-        tls_options
+        options = default_options
+
+        if @tls_options
+          # Prevent blank config values from overwriting SSL defaults
+          configured_options = sanitize_hash_values(@tls_options)
+          configured_options = symbolize_hash_keys(configured_options)
+
+          options.merge!(configured_options)
+        end
+
+        # Retain backward compatibility until deprecated configs are removed.
+        options[:ca_file] = @ca_file if @ca_file
+        options[:ssl_version] = @ssl_version if @ssl_version
+
+        options
       end
 
       def sasl_auths(options={})
@@ -194,6 +198,32 @@ module OmniAuth
         [Net::NTLM::Message::Type1.new.serialize, nego]
       end
 
+      private
+
+      def default_options
+        if @disable_verify_certificates
+          # It is important to explicitly set verify_mode for two reasons:
+          # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
+          # 2. The net-ldap gem implementation verifies the certificate hostname
+          #    unless verify_mode is set to VERIFY_NONE.
+          { verify_mode: OpenSSL::SSL::VERIFY_NONE }
+        else
+          OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
+        end
+      end
+
+      # Removes keys that have blank values
+      def sanitize_hash_values(hash)
+        hash.delete_if { |_, value| value.nil? || value !~ /\S/ }
+      end
+
+      def symbolize_hash_keys(hash)
+        hash.keys.each do |key|
+          hash[key.to_sym] = hash[key]
+        end
+
+        hash
+      end
     end
   end
 end

data/lib/omniauth-ldap/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module LDAP
-    VERSION = "2.0.4"
+    VERSION = "2.1.0"
   end
 end

data/spec/omniauth-ldap/adaptor_spec.rb

@@ -126,6 +126,19 @@ describe OmniAuth::LDAP::Adaptor do
         end
       end
 
+      context 'when tls_options are specified' do
+        it 'should pass the values along with defaults' do
+          adaptor = OmniAuth::LDAP::Adaptor.new({host: "192.168.1.145", encryption: 'ssl', base: 'dc=intridea, dc=com', port: 636, uid: 'sAMAccountName', bind_dn: 'bind_dn', password: 'password', tls_options: { ca_file: '/etc/ca.pem', ssl_version: 'TLSv1_2' }})
+          adaptor.connection.instance_variable_get('@encryption').should include tls_options: OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.merge(ca_file: '/etc/ca.pem', ssl_version: 'TLSv1_2')
+        end
+
+        it 'does not pass nil or blank values' do
+          adaptor = OmniAuth::LDAP::Adaptor.new({host: "192.168.1.145", encryption: 'ssl', base: 'dc=intridea, dc=com', port: 636, uid: 'sAMAccountName', bind_dn: 'bind_dn', password: 'password', tls_options: { ca_file: nil, ssl_version: ' ' }})
+          adaptor.connection.instance_variable_get('@encryption').should include tls_options: OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
+        end
+      end
+
+      # DEPRECATED
       context 'when ca_file is specified' do
         it 'should set the encryption tls_options ca_file' do
           adaptor = OmniAuth::LDAP::Adaptor.new({host: "192.168.1.145", encryption: 'ssl', base: 'dc=intridea, dc=com', port: 636, uid: 'sAMAccountName', bind_dn: 'bind_dn', password: 'password', ca_file: '/etc/ca.pem'})
@@ -133,6 +146,7 @@ describe OmniAuth::LDAP::Adaptor do
         end
       end
 
+      # DEPRECATED
       context 'when ssl_version is specified' do
         it 'should overwrite the encryption tls_options ssl_version' do
           adaptor = OmniAuth::LDAP::Adaptor.new({host: "192.168.1.145", encryption: 'ssl', base: 'dc=intridea, dc=com', port: 636, uid: 'sAMAccountName', bind_dn: 'bind_dn', password: 'password', ssl_version: 'TLSv1_2'})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab_omniauth-ldap
 version: !ruby/object:Gem::Version
-  version: 2.0.4
+  version: 2.1.0
 platform: ruby
 authors:
 - Ping Yu
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-10 00:00:00.000000000 Z
+date: 2018-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -152,7 +152,7 @@ files:
 - spec/omniauth-ldap/adaptor_spec.rb
 - spec/omniauth/strategies/ldap_spec.rb
 - spec/spec_helper.rb
-homepage: https://github.com/gitlabhq/omniauth-ldap
+homepage: https://gitlab.com/gitlab-org/omniauth-ldap
 licenses:
 - MIT
 metadata: {}
@@ -172,7 +172,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.8
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: A LDAP strategy for OmniAuth.