ldap_fluff 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6a3d7c2ebc986e4ff3738e42f1539a93611fedff9eb399a6fc606f14f11a40a
-  data.tar.gz: 9d53b1528ff20d5c44d547b3fc6dec041d3aa6bb6e915d8d7e96186fc77ec04d
+  metadata.gz: '0269885f166972ce577c89c74a20c50f09d0e82c50682a4852cd190be88ddb5c'
+  data.tar.gz: 9d1d464804379a4f9f73b049960e0c54e622a092e017b371f308e15326c4badb
 SHA512:
-  metadata.gz: 85a888d7da528bfe2f4f2dfe4dea9793c5adf9812fe054c3467eba3873b9fa838dde18a44844a888beea02bf178b0f2b71b4de3c1d79444e4bf513c2c9c185af
-  data.tar.gz: 19076c83f5ef10f0e334f430d9393b2f4bb855bedc1e2a601ccd9e59ead89600957f3469508caee8fb6b04e5a255fad3f17eae068fa41fb732fbc25bfc3eb2c2
+  metadata.gz: fe5f1ec44f4467341fdbdc243e30c69e36a6456e05e82f178d758e979dbf25075d23a99904f396dcc3ef06d4b1ac649649fd147ef38783500377917b3565d6ed
+  data.tar.gz: 105064929ca817a02117cc1781135ca81e3cd5d24056518d488b5e97571105542f3b7b03ea3e49ff228018cd546e0d5405bf1fe498b5cab00f764fa99a141b01

data/README.rdoc

@@ -53,6 +53,8 @@ Your global configuration must provide information about your LDAP host to funct
   group_base: # base DN for your LDAP groups, eg ou=Groups,dc=redhat,dc=com
   use_netgroups: # false by default, use true if you want to use netgroup triples,
                  # supported only for server type :free_ipa and :posix
+  use_rfc4519_group_membership: # false by default, use true if you want to use group membership extensions from RFC4519. Typically you may want to use this if your LDAP server is based on 389DS.
+                                # supported only for server type :posix
   server_type: # type of server. default == :posix. :active_directory, :posix, :free_ipa
   ad_domain: # domain for your users if using active directory, eg redhat.com
   service_user: # service account for authenticating LDAP calls. required unless you enable anon

data/lib/ldap_fluff/config.rb

@@ -4,7 +4,7 @@ require 'active_support/core_ext/hash'
 class LdapFluff::Config
   ATTRIBUTES = %w[host port encryption base_dn group_base server_type service_user
                   service_pass anon_queries attr_login search_filter
-                  instrumentation_service use_netgroups].freeze
+                  instrumentation_service use_netgroups use_rfc4519_group_membership].freeze
   ATTRIBUTES.each { |attr| attr_reader attr.to_sym }
 
   DEFAULT_CONFIG = { 'port' => 389,
@@ -14,7 +14,8 @@ class LdapFluff::Config
                      'server_type' => :free_ipa,
                      'anon_queries' => false,
                      'instrumentation_service' => nil,
-                     'use_netgroups' => false }.freeze
+                     'use_netgroups' => false,
+                     'use_rfc4519_group_membership' => false }.freeze
 
   def initialize(config)
     raise ArgumentError unless config.respond_to?(:to_hash)

data/lib/ldap_fluff/generic.rb

@@ -14,6 +14,7 @@ class LdapFluff::Generic
     @base       = config.base_dn
     @group_base = (config.group_base.empty? ? config.base_dn : config.group_base)
     @use_netgroups = config.use_netgroups
+    @use_rfc4519_group_membership = config.use_rfc4519_group_membership
     @member_service = create_member_service(config)
   end
 

data/lib/ldap_fluff/posix.rb

@@ -19,10 +19,14 @@ class LdapFluff::Posix < LdapFluff::Generic
     filter = if @use_netgroups
                Net::LDAP::Filter.eq('objectClass', 'nisNetgroup')
              else
-               Net::LDAP::Filter.eq('objectClass', 'posixGroup') |
-                 Net::LDAP::Filter.eq('objectClass', 'organizationalunit') |
-                 Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames') |
-                 Net::LDAP::Filter.eq('objectClass', 'groupOfNames')
+               filter = Net::LDAP::Filter.eq('objectClass', 'posixGroup') |
+                        Net::LDAP::Filter.eq('objectClass', 'organizationalunit')
+               if @use_rfc4519_group_membership
+                 filter = filter |
+                          Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames') |
+                          Net::LDAP::Filter.eq('objectClass', 'groupOfNames')
+               end
+               filter
              end
     groups = @ldap.search(:base => search.dn, :filter => filter)
     members = groups.map { |group| group.send(method) }.flatten.uniq

data/lib/ldap_fluff/posix_member_service.rb

@@ -4,6 +4,7 @@ require 'net/ldap'
 class LdapFluff::Posix::MemberService < LdapFluff::GenericMemberService
   def initialize(ldap, config)
     @attr_login = (config.attr_login || 'memberuid')
+    @use_rfc4519_group_membership = config.use_rfc4519_group_membership
     super
   end
 
@@ -16,8 +17,9 @@ class LdapFluff::Posix::MemberService < LdapFluff::GenericMemberService
   # return an ldap user with groups attached
   # note : this method is not particularly fast for large ldap systems
   def find_user_groups(uid)
+    user = find_user(uid).first
     @ldap.search(
-      :filter => Net::LDAP::Filter.eq('memberuid', uid),
+      :filter => user_group_filter(uid, user[:dn].first),
       :base => @group_base, :attributes => ["cn"]
     ).map { |entry| entry[:cn][0] }
   end
@@ -27,4 +29,17 @@ class LdapFluff::Posix::MemberService < LdapFluff::GenericMemberService
 
   class GIDNotFoundException < LdapFluff::Error
   end
+
+  private
+
+  def user_group_filter(uid, user_dn)
+    by_member = Net::LDAP::Filter.eq('memberuid', uid)
+    return by_member unless @use_rfc4519_group_membership
+
+    by_name = Net::LDAP::Filter.eq('member', user_dn) &
+              Net::LDAP::Filter.eq('objectClass', 'groupOfNames')
+    by_unique_name = Net::LDAP::Filter.eq('uniquemember', user_dn) &
+                     Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames')
+    by_member | by_name | by_unique_name
+  end
 end

data/test/lib/ldap_test_helper.rb

@@ -121,7 +121,7 @@ module LdapTestHelper
   end
 
   def posix_user_payload
-    [{ :cn => ["john"] }]
+    [{ :cn => ["john"], :dn => ["cn=john,ou=people,dc=internet,dc=com"] }]
   end
 
   def posix_group_payload

data/test/netiq_test.rb

@@ -128,9 +128,7 @@ class TestNetIQ < Minitest::Test
       [nested_group],
       [{ :base => group.dn,
          :filter => Net::LDAP::Filter.eq('objectClass', 'posixGroup') |
-                    Net::LDAP::Filter.eq('objectClass', 'organizationalunit') |
-                    Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames') |
-                    Net::LDAP::Filter.eq('objectClass', 'groupOfNames') }])
+                    Net::LDAP::Filter.eq('objectClass', 'organizationalunit') }])
     @netiq.ldap = @ldap
 
     md = Minitest::Mock.new

data/test/posix_member_services_test.rb

@@ -18,21 +18,54 @@ class TestPosixMemberService < Minitest::Test
   end
 
   def test_find_user_groups
-    user = posix_group_payload
-    @ldap.expect(:search, user, [:filter => @ms.name_filter('john'),
+    group = posix_group_payload
+    user = posix_user_payload
+    username = 'john'
+
+    @ldap.expect(:search, user, [:filter => @ms.name_filter(username),
+                                 :base => config.base_dn])
+    filter = Net::LDAP::Filter.eq('memberuid', username)
+    @ldap.expect(:search, group, [:filter => filter,
                                  :base => config.group_base,
                                  :attributes => ["cn"]])
     @ms.ldap = @ldap
-    assert_equal ['broze'], @ms.find_user_groups('john')
+    assert_equal ['broze'], @ms.find_user_groups(username)
+    @ldap.verify
+  end
+
+  def test_find_user_groups_rfc4519
+    @ms.instance_variable_set('@use_rfc4519_group_membership', true)
+
+    group = posix_group_payload
+    user = posix_user_payload
+    username = 'john'
+
+    @ldap.expect(:search, user, [:filter => @ms.name_filter(username),
+                                 :base => config.base_dn])
+    filter = [Net::LDAP::Filter.eq('memberuid', username),
+              Net::LDAP::Filter.eq('member', user.first[:dn].first) & Net::LDAP::Filter.eq('objectClass', 'groupOfNames'),
+              Net::LDAP::Filter.eq('uniquemember', user.first[:dn].first) & Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames')
+             ].reduce(&:|)
+
+    @ldap.expect(:search, group, [:filter => filter,
+                                 :base => config.group_base,
+                                 :attributes => ["cn"]])
+    @ms.ldap = @ldap
+    assert_equal ['broze'], @ms.find_user_groups(username)
     @ldap.verify
   end
 
   def test_find_no_groups
-    @ldap.expect(:search, [], [:filter => @ms.name_filter("john"),
+    user = posix_user_payload
+    username = 'john'
+    @ldap.expect(:search, user, [:filter => @ms.name_filter(username),
+                                 :base => config.base_dn])
+    filter = @ms.send(:user_group_filter, username, user.first[:dn].first)
+    @ldap.expect(:search, [], [:filter => filter,
                                :base => config.group_base,
                                :attributes => ["cn"]])
     @ms.ldap = @ldap
-    assert_equal [], @ms.find_user_groups('john')
+    assert_equal [], @ms.find_user_groups(username)
     @ldap.verify
   end
 

data/test/posix_test.rb

@@ -119,13 +119,40 @@ class TestPosix < Minitest::Test
     nested_group = Net::LDAP::Entry.new('CN=katellers,CN=foremaners,DC=example,DC=com')
     nested_group[:memberuid] = ['testuser']
 
+    @ldap.expect(:search,
+      [nested_group],
+      [{ :base => group.dn,
+         :filter => Net::LDAP::Filter.eq('objectClass', 'posixGroup') |
+                    Net::LDAP::Filter.eq('objectClass', 'organizationalunit') }])
+    @posix.ldap = @ldap
+
+    md = Minitest::Mock.new
+    2.times { md.expect(:find_group, [group], ['foremaners']) }
+    @posix.member_service = md
+
+    assert_equal @posix.users_for_gid('foremaners'), ['testuser']
+
+    md.verify
+    @ldap.verify
+  end
+
+  def test_find_users_in_nested_groups_with_rfc4519
+    @posix.instance_variable_set('@use_rfc4519_group_membership', true)
+
+    service_bind
+    group = Net::LDAP::Entry.new('CN=foremaners,DC=example,DC=com')
+    group[:memberuid] = ['katellers']
+    nested_group = Net::LDAP::Entry.new('CN=katellers,CN=foremaners,DC=example,DC=com')
+    nested_group[:memberuid] = ['testuser']
+
     @ldap.expect(:search,
       [nested_group],
       [{ :base => group.dn,
          :filter => Net::LDAP::Filter.eq('objectClass', 'posixGroup') |
                     Net::LDAP::Filter.eq('objectClass', 'organizationalunit') |
                     Net::LDAP::Filter.eq('objectClass', 'groupOfUniqueNames') |
-                    Net::LDAP::Filter.eq('objectClass', 'groupOfNames')}])
+                    Net::LDAP::Filter.eq('objectClass', 'groupOfNames')
+       }])
     @posix.ldap = @ldap
 
     md = Minitest::Mock.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ldap_fluff
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Jordan O'Mara
@@ -10,10 +10,9 @@ authors:
 - Adam Price
 - Marek Hulan
 - Dominic Cleal
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -94,8 +93,8 @@ email:
 executables: []
 extensions: []
 extra_rdoc_files:
-- README.rdoc
 - LICENSE
+- README.rdoc
 files:
 - LICENSE
 - README.rdoc
@@ -132,7 +131,6 @@ homepage: https://github.com/theforeman/ldap_fluff
 licenses:
 - GPL-2.0-only
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -150,8 +148,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
-signing_key: 
+rubygems_version: 3.6.7
 specification_version: 4
 summary: LDAP querying tools for Active Directory, FreeIPA and POSIX-style
 test_files: