omniauth-ldap 2.0.0 → 2.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. checksums.yaml +5 -5
  2. checksums.yaml.gz.sig +0 -0
  3. data/CHANGELOG.md +202 -0
  4. data/CITATION.cff +20 -0
  5. data/CODE_OF_CONDUCT.md +134 -0
  6. data/CONTRIBUTING.md +213 -0
  7. data/FUNDING.md +66 -0
  8. data/LICENSE.txt +23 -0
  9. data/README.md +813 -67
  10. data/REEK +0 -0
  11. data/RUBOCOP.md +71 -0
  12. data/SECURITY.md +21 -0
  13. data/lib/omniauth/strategies/ldap.rb +159 -53
  14. data/lib/omniauth-ldap/adaptor.rb +162 -54
  15. data/lib/omniauth-ldap/version.rb +4 -1
  16. data/lib/omniauth-ldap.rb +6 -1
  17. data/sig/omniauth/ldap/adaptor.rbs +54 -0
  18. data/sig/omniauth/ldap/version.rbs +11 -0
  19. data/sig/omniauth/strategies/ldap.rbs +32 -0
  20. data/sig/omniauth-ldap.rbs +5 -0
  21. data/sig/rbs/net-ldap.rbs +19 -0
  22. data/sig/rbs/net-ntlm.rbs +16 -0
  23. data/sig/rbs/sasl.rbs +12 -0
  24. data.tar.gz.sig +0 -0
  25. metadata +332 -47
  26. metadata.gz.sig +0 -0
  27. data/.gitignore +0 -3
  28. data/.rspec +0 -1
  29. data/Gemfile +0 -11
  30. data/Guardfile +0 -11
  31. data/Rakefile +0 -9
  32. data/omniauth-ldap.gemspec +0 -26
  33. data/spec/omniauth/strategies/ldap_spec.rb +0 -200
  34. data/spec/omniauth-ldap/adaptor_spec.rb +0 -86
  35. data/spec/spec_helper.rb +0 -14
data/README.md CHANGED
@@ -1,71 +1,817 @@
1
- # OmniAuth LDAP
1
+ | 📍 NOTE |
2
+ |-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
3
+ | RubyGems (the [GitHub org][rubygems-org], not the website) [suffered][draper-security] a [hostile takeover][ellen-takeover] in September 2025. |
4
+ | Ultimately [4 maintainers][simi-removed] were [hard removed][martin-removed] and a reason has been given for only 1 of those, while 2 others resigned in protest. |
5
+ | It is a [complicated story][draper-takeover] which is difficult to [parse quickly][draper-lies]. |
6
+ | I'm adding notes like this to gems because I [don't condone theft][draper-theft] of repositories or gems from their rightful owners. |
7
+ | If a similar theft happened with my repos/gems, I'd hope some would stand up for me. |
8
+ | Disenfranchised former-maintainers have started [gem.coop][gem-coop]. |
9
+ | Once available I will publish there exclusively; unless RubyCentral makes amends with the community. |
10
+ | The ["Technology for Humans: Joel Draper"][reinteractive-podcast] podcast episode by [reinteractive][reinteractive] is the most cogent summary I'm aware of. |
11
+ | See [here][gem-naming], [here][gem-coop] and [here][martin-ann] for more info on what comes next. |
12
+ | What I'm doing: A (WIP) proposal for [bundler/gem scopes][gem-scopes], and a (WIP) proposal for a federated [gem server][gem-server]. |
2
13
 
3
- == LDAP
14
+ [rubygems-org]: https://github.com/rubygems/
15
+ [draper-security]: https://joel.drapper.me/p/ruby-central-security-measures/
16
+ [draper-takeover]: https://joel.drapper.me/p/ruby-central-takeover/
17
+ [ellen-takeover]: https://pup-e.com/blog/goodbye-rubygems/
18
+ [simi-removed]: https://www.reddit.com/r/ruby/s/gOk42POCaV
19
+ [martin-removed]: https://bsky.app/profile/martinemde.com/post/3m3occezxxs2q
20
+ [draper-lies]: https://joel.drapper.me/p/ruby-central-fact-check/
21
+ [draper-theft]: https://joel.drapper.me/p/ruby-central/
22
+ [reinteractive]: https://reinteractive.com/ruby-on-rails
23
+ [gem-coop]: https://gem.coop
24
+ [gem-naming]: https://github.com/gem-coop/gem.coop/issues/12
25
+ [martin-ann]: https://martinemde.com/2025/10/05/announcing-gem-coop.html
26
+ [gem-scopes]: https://github.com/galtzo-floss/bundle-namespace
27
+ [gem-server]: https://github.com/galtzo-floss/gem-server
28
+ [reinteractive-podcast]: https://youtu.be/_H4qbtC5qzU?si=BvuBU90R2wAqD2E6
29
+
30
+ [![Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0][🖼️galtzo-i]][🖼️galtzo-discord] [![ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5][🖼️ruby-lang-i]][🖼️ruby-lang] [![omniauth Logo (presumed to be) by tomeara, (presumed to be) MIT License][🖼️omniauth-i]][🖼️omniauth]
31
+
32
+ [🖼️galtzo-i]: https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg
33
+ [🖼️galtzo-discord]: https://discord.gg/3qme4XHNKN
34
+ [🖼️ruby-lang-i]: https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg
35
+ [🖼️ruby-lang]: https://www.ruby-lang.org/
36
+ [🖼️omniauth-i]: https://logos.galtzo.com/assets/images/omniauth/avatar-192px.png
37
+ [🖼️omniauth]: https://github.com/omniauth/omniauth-ldap
38
+
39
+ # 📁 OmniAuth LDAP
40
+
41
+ [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![Open Source Helpers][👽oss-helpi]][👽oss-help] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
42
+
43
+ `if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][🖼️galtzo-discord], as I may have missed the [discord notification][🖼️galtzo-discord].
44
+
45
+ ---
46
+
47
+ `if ci_badges.map(&:color).all? { it == "green"}` 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.
48
+
49
+ [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
50
+
51
+ ## 🌻 Synopsis
4
52
 
5
53
  Use the LDAP strategy as a middleware in your application:
6
54
 
7
- use OmniAuth::Strategies::LDAP,
8
- :title => "My LDAP",
9
- :host => '10.101.10.1',
10
- :port => 389,
11
- :method => :plain,
12
- :base => 'dc=intridea, dc=com',
13
- :uid => 'sAMAccountName',
14
- :name_proc => Proc.new {|name| name.gsub(/@.*$/,'')},
15
- :bind_dn => 'default_bind_dn',
16
- # Or, alternatively:
17
- #:filter => '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))'
18
- :name_proc => Proc.new {|name| name.gsub(/@.*$/,'')}
19
- :bind_dn => 'default_bind_dn'
20
- :password => 'password'
21
-
22
- All of the listed options are required, with the exception of :title, :name_proc, :bind_dn, and :password.
23
- Allowed values of :method are: :plain, :ssl, :tls.
24
-
25
- :bind_dn and :password is the default credentials to perform user lookup.
26
- most LDAP servers require that you supply a complete DN as a binding-credential, along with an authenticator
27
- such as a password. But for many applications, you often don’t have a full DN to identify the user.
28
- You usually get a simple identifier like a username or an email address, along with a password.
29
- Since many LDAP servers don't allow anonymous access, search function will require a bound connection,
30
- :bind_dn and :password will be required for searching on the username or email to retrieve the DN attribute
31
- for the user. If the LDAP server allows anonymous access, you don't need to provide these two parameters.
32
-
33
- :uid is the LDAP attribute name for the user name in the login form.
34
- typically AD would be 'sAMAccountName' or 'UserPrincipalName', while OpenLDAP is 'uid'.
35
-
36
- :filter is the LDAP filter used to search the user entry. It can be used in place of :uid for more flexibility.
37
- `%{username}` will be replaced by the user name processed by :name_proc.
38
-
39
- :name_proc allows you to match the user name entered with the format of the :uid attributes.
40
- For example, value of 'sAMAccountName' in AD contains only the windows user name. If your user prefers using
41
- email to login, a name_proc as above will trim the email string down to just the windows login name.
42
- In summary, use :name_proc to fill the gap between the submitted username and LDAP uid attribute value.
43
-
44
- :try_sasl and :sasl_mechanisms are optional. :try_sasl [true | false], :sasl_mechanisms ['DIGEST-MD5' | 'GSS-SPNEGO']
45
- Use them to initialize a SASL connection to server. If you are not familiar with these authentication methods,
46
- please just avoid them.
47
-
48
- Direct users to '/auth/ldap' to have them authenticated via your company's LDAP server.
49
-
50
-
51
- ## License
52
-
53
- Copyright (C) 2011 by Ping Yu and Intridea, Inc.
54
-
55
- Permission is hereby granted, free of charge, to any person obtaining a copy
56
- of this software and associated documentation files (the "Software"), to deal
57
- in the Software without restriction, including without limitation the rights
58
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
59
- copies of the Software, and to permit persons to whom the Software is
60
- furnished to do so, subject to the following conditions:
61
-
62
- The above copyright notice and this permission notice shall be included in
63
- all copies or substantial portions of the Software.
64
-
65
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
66
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
67
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
68
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
69
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
70
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
71
- THE SOFTWARE.
55
+ ```ruby
56
+ use OmniAuth::Strategies::LDAP,
57
+ title: "My LDAP",
58
+ host: "10.101.10.1",
59
+ port: 389,
60
+ encryption: :plain,
61
+ base: "dc=intridea,dc=com",
62
+ uid: "sAMAccountName",
63
+ name_proc: proc { |name| name.gsub(/@.*$/, "") },
64
+ bind_dn: "default_bind_dn",
65
+ password: "password",
66
+ tls_options: {
67
+ ssl_version: "TLSv1_2",
68
+ ciphers: ["AES-128-CBC", "AES-128-CBC-HMAC-SHA1", "AES-128-CBC-HMAC-SHA256"],
69
+ }
70
+ # Or, alternatively:
71
+ # use OmniAuth::Strategies::LDAP, filter: '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))'
72
+ ```
73
+
74
+ All of the listed options are required, with the exception of `:title`, `:name_proc`, `:bind_dn`, and `:password`.
75
+
76
+ ## 💡 Info you can shake a stick at
77
+
78
+ | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
79
+ |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
80
+ | Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
81
+ | Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
82
+ | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
83
+ | Works with MRI Ruby 2 | ![Ruby 2.0 Compat][💎ruby-2.0i] ![Ruby 2.1 Compat][💎ruby-2.1i] ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
84
+ | Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor] |
85
+ | Source | [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
86
+ | Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
87
+ | Compliance | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
88
+ | Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
89
+ | Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto] |
90
+ | `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
91
+
92
+ ### Compatibility
93
+
94
+ Compatible with MRI Ruby 2.0+, and concordant releases of JRuby, and TruffleRuby.
95
+
96
+ | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚 |
97
+ |------------------------------------------------|--------------------------------------------------------|
98
+ | 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
99
+
100
+ ### Enterprise Support [![Tidelift](https://tidelift.com/badges/package/rubygems/omniauth-ldap)](https://tidelift.com/subscription/pkg/rubygems-omniauth-ldap?utm_source=rubygems-omniauth-ldap&utm_medium=referral&utm_campaign=readme)
101
+
102
+ Available as part of the Tidelift Subscription.
103
+
104
+ <details>
105
+ <summary>Need enterprise-level guarantees?</summary>
106
+
107
+ The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
108
+
109
+ [![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]
110
+
111
+ - 💡Subscribe for support guarantees covering _all_ your FLOSS dependencies
112
+ - 💡Tidelift is part of [Sonar][🏙️entsup-tidelift-sonar]
113
+ - 💡Tidelift pays maintainers to maintain the software you depend on!<br/>📊`@`Pointy Haired Boss: An [enterprise support][🏙️entsup-tidelift] subscription is "[never gonna let you down][🧮kloc]", and *supports* open source maintainers
114
+
115
+ Alternatively:
116
+
117
+ - [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
118
+ - [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork]
119
+ - [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]
120
+
121
+ </details>
122
+
123
+ ## ✨ Installation
124
+
125
+ Install the gem and add to the application's Gemfile by executing:
126
+
127
+ ```console
128
+ bundle add omniauth-ldap
129
+ ```
130
+
131
+ If bundler is not being used to manage dependencies, install the gem by executing:
132
+
133
+ ```console
134
+ gem install omniauth-ldap
135
+ ```
136
+
137
+ ### 🔒 Secure Installation
138
+
139
+ <details>
140
+ <summary>For Medium or High Security Installations</summary>
141
+
142
+ This gem is cryptographically signed, and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
143
+ [stone_checksums][💎stone_checksums]. Be sure the gem you install hasn’t been tampered with
144
+ by following the instructions below.
145
+
146
+ Add my public key (if you haven’t already, expires 2045-04-29) as a trusted certificate:
147
+
148
+ ```console
149
+ gem cert --add <(curl -Ls https://raw.github.com/galtzo-floss/certs/main/pboling.pem)
150
+ ```
151
+
152
+ You only need to do that once. Then proceed to install with:
153
+
154
+ ```console
155
+ gem install omniauth-ldap -P HighSecurity
156
+ ```
157
+
158
+ The `HighSecurity` trust profile will verify signed gems, and not allow the installation of unsigned dependencies.
159
+
160
+ If you want to up your security game full-time:
161
+
162
+ ```console
163
+ bundle config set --global trust-policy MediumSecurity
164
+ ```
165
+
166
+ `MediumSecurity` instead of `HighSecurity` is necessary if not all the gems you use are signed.
167
+
168
+ NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
169
+
170
+ </details>
171
+
172
+ ## ⚙️ Configuration
173
+
174
+ The following options are available for configuring the OmniAuth LDAP strategy:
175
+
176
+ ### Required Options
177
+
178
+ - `:host` - The hostname or IP address of the LDAP server.
179
+ - `:port` - The port number of the LDAP server (default: 389).
180
+ - `:method` - The connection method. Allowed values: `:plain`, `:ssl`, `:tls` (default: `:plain`).
181
+ - `:base` - The base DN for the LDAP search.
182
+ - `:uid` or `:filter` - Either `:uid` (the LDAP attribute for username, default: "sAMAccountName") or `:filter` (LDAP filter for searching user entries). If `:filter` is provided, `:uid` is not required. Note: This `:uid` option is the search attribute, not the top-level `auth.uid` in the OmniAuth result.
183
+
184
+ ### Optional Options
185
+
186
+ - `:title` - The title for the authentication form (default: "LDAP Authentication").
187
+ - `:bind_dn` - The DN to bind with for searching users (required if anonymous access is not allowed).
188
+ - `:password` - The password for the bind DN.
189
+ - `:name_proc` - A proc to process the username before using it in the search (default: identity proc that returns the username unchanged).
190
+ - `:try_sasl` - Whether to use SASL authentication (default: false).
191
+ - `:sasl_mechanisms` - Array of SASL mechanisms to use (e.g., ["DIGEST-MD5", "GSS-SPNEGO"]).
192
+ - `:allow_anonymous` - Whether to allow anonymous binding (default: false).
193
+ - `:logger` - A logger instance for debugging (optional, for internal use).
194
+
195
+ ### Auth Hash UID vs LDAP :uid (search attribute)
196
+
197
+ - By design, the top-level `auth.uid` returned by this strategy is the entry's Distinguished Name (DN).
198
+ - The configuration option `:uid` controls which LDAP attribute is used to locate the entry (or to build the filter), not the value exposed as `auth.uid`.
199
+ - Your LDAP "account name" (for example, `sAMAccountName` on Active Directory or `uid` on many schemas) is exposed via `auth.info.nickname` and is also available in `auth.extra.raw_info`.
200
+
201
+ Why DN for `auth.uid`?
202
+
203
+ - DN is the canonical, globally unique identifier for an LDAP entry and is always present in search results. See LDAPv3 and DN syntax: [RFC 4511][rfc4511] (LDAP protocol) and [RFC 4514][rfc4514] (String Representation of Distinguished Names).
204
+ - Attributes like `uid` (defined in [RFC 4519][rfc4519]) or `sAMAccountName` (Active Directory–specific) may be absent, duplicated across parts of the DIT, or vary between directories. Using DN ensures consistent behavior across AD, OpenLDAP, and other servers.
205
+ - This trade-off favors cross-directory interoperability and stability for apps that need a unique identifier.
206
+
207
+ Where to find the "username"-style value
208
+
209
+ - `auth.info.nickname` maps from the first present of: `uid`, `userid`, or `sAMAccountName`.
210
+ - You can also read the raw attribute from `auth.extra.raw_info` (a `Net::LDAP::Entry`):
211
+
212
+ ```ruby
213
+ get "/auth/ldap/callback" do
214
+ auth = request.env["omniauth.auth"]
215
+ dn = auth.uid # => "cn=alice,ou=users,dc=example,dc=com"
216
+ username = auth.info.nickname # => "alice" (from uid/sAMAccountName)
217
+ # Or, directly from raw_info (case-insensitive keys):
218
+ sams = auth.extra.raw_info[:samaccountname]
219
+ sam = sams.first if sams
220
+ # ...
221
+ end
222
+ ```
223
+
224
+ If you need top-level `auth.uid` to be something other than the DN (for example, `sAMAccountName`), you'll currently need to read it from `auth.info.nickname` (or `raw_info`) in your app. Changing the top-level `uid` mapping would be a breaking behavior change for existing users; if you have a use-case, please open an issue to discuss a configurable mapping.
225
+
226
+ ## 🔧 Basic Usage
227
+
228
+ The strategy exposes a simple Rack middleware and can be used in plain Rack apps, Sinatra, or Rails.
229
+ Direct users to `/auth/ldap` to start authentication and handle the callback at `/auth/ldap/callback`.
230
+
231
+ Below are several concrete examples to get you started.
232
+
233
+ ### Minimal Rack setup
234
+
235
+ ```ruby
236
+ # config.ru
237
+ require "rack"
238
+ require "omniauth-ldap"
239
+
240
+ use Rack::Session::Cookie, secret: "change_me"
241
+ use OmniAuth::Builder do
242
+ provider :ldap,
243
+ host: "ldap.example.com",
244
+ port: 389,
245
+ method: :plain,
246
+ base: "dc=example,dc=com",
247
+ uid: "uid",
248
+ title: "Example LDAP"
249
+ end
250
+
251
+ run lambda { |env| [404, {"Content-Type" => "text/plain"}, [env.key?("omniauth.auth").to_s]] }
252
+ ```
253
+
254
+ Visit `GET /auth/ldap` to initiate authentication (the middleware will render a login form unless you POST to `/auth/ldap`).
255
+
256
+ ### Sinatra example
257
+
258
+ ```ruby
259
+ require "sinatra"
260
+ require "omniauth-ldap"
261
+
262
+ use Rack::Session::Cookie, secret: "change_me"
263
+ use OmniAuth::Builder do
264
+ provider :ldap,
265
+ title: "Company LDAP",
266
+ host: "ldap.company.internal",
267
+ base: "dc=company,dc=local",
268
+ uid: "sAMAccountName",
269
+ name_proc: proc { |username| username.gsub(/@.*$/, "") }
270
+ end
271
+
272
+ get "/" do
273
+ '<a href="/auth/ldap">Sign in with LDAP</a>'
274
+ end
275
+
276
+ get "/auth/ldap/callback" do
277
+ auth = request.env["omniauth.auth"]
278
+ "Hello, #{auth.info["name"]}"
279
+ end
280
+ ```
281
+
282
+ ### Rails (initializer) example
283
+
284
+ Create `config/initializers/omniauth.rb`:
285
+
286
+ ```ruby
287
+ Rails.application.config.middleware.use(OmniAuth::Builder) do
288
+ provider :ldap,
289
+ title: "Acme LDAP",
290
+ host: "ldap.acme.internal",
291
+ port: 389,
292
+ base: "dc=acme,dc=corp",
293
+ uid: "uid",
294
+ bind_dn: "cn=search,dc=acme,dc=corp",
295
+ password: ENV["LDAP_SEARCH_PASSWORD"],
296
+ name_proc: proc { |n| n.split("@").first }
297
+ end
298
+ ```
299
+
300
+ Then link users to `/auth/ldap` in your app (for example, in a Devise sign-in page).
301
+
302
+ ### Using a custom filter
303
+
304
+ If you need to restrict authentication to a group or use a more complex lookup, pass `:filter`. Use `%{username}` — it will be replaced with the processed username (after `:name_proc`).
305
+
306
+ ```ruby
307
+ provider :ldap,
308
+ host: "ldap.example.com",
309
+ base: "dc=example,dc=com",
310
+ filter: "(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))",
311
+ bind_dn: "cn=search,dc=example,dc=com",
312
+ password: ENV["LDAP_SEARCH_PASSWORD"]
313
+ ```
314
+
315
+ What `:filter` actually does
316
+
317
+ - If `:filter` is provided, the strategy constructs an LDAP filter string by substituting `%{username}` with the submitted username after applying `:name_proc`, escaping special characters per RFC 4515, and passes it to the directory search.
318
+ - In the normal password flow, a successful search returns the user's DN and we then bind as that DN with the submitted password.
319
+ - In trusted header SSO flow (`header_auth: true`), we only perform the search and skip the user password bind; if the search returns no entry, authentication fails.
320
+ - If `:filter` is not provided, the strategy falls back to a simple equality filter using `:uid` (e.g. `(uid=alice)`).
321
+
322
+ Notes on escaping and safety
323
+
324
+ - We escape the interpolated username with `Net::LDAP::Filter.escape`, which protects against LDAP injection and handles special characters like `(`, `)`, `*`, and `\`.
325
+ - Your static filter text is used as-is — keep it to a valid LDAP filter expression and only use `%{username}` for substitution.
326
+
327
+ Group-based recipes
328
+
329
+ - Active Directory (simple group):
330
+
331
+ ```text
332
+ (&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))
333
+ ```
334
+
335
+ - Active Directory (nested groups via matchingRuleInChain):
336
+
337
+ ```text
338
+ (&(sAMAccountName=%{username})(memberOf:1.2.840.113556.1.4.1941:=cn=myapp-users,ou=groups,dc=example,dc=com))
339
+ ```
340
+
341
+ - OpenLDAP (groupOfNames):
342
+
343
+ ```text
344
+ (&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))
345
+ ```
346
+
347
+ or, if you can't use `memberOf` overlays, filter on the group and member DN:
348
+
349
+ ```text
350
+ (&(uid=%{username})(|(uniqueMember=uid=%{username},ou=people,dc=example,dc=com)(member=uid=%{username},ou=people,dc=example,dc=com)))
351
+ ```
352
+
353
+ Username normalization examples
354
+
355
+ - If your users sign in with an email but the directory expects a short name, combine `:name_proc` with `:filter`:
356
+
357
+ ```ruby
358
+ provider :ldap,
359
+ name_proc: proc { |n| n.split("@").first },
360
+ filter: "(&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))"
361
+ # other settings...
362
+ ```
363
+
364
+ Discourse plugin (jonmbake/discourse-ldap-auth)
365
+
366
+ - That plugin forwards its `filter` setting to this gem. You can therefore paste the same filter strings shown above.
367
+ - Example (allow only members of `forum-users`):
368
+
369
+ ```text
370
+ (&(uid=%{username})(memberOf=cn=forum-users,ou=groups,dc=example,dc=com))
371
+ ```
372
+
373
+ - If users type an email address but your directory matches on a short user id, also configure `name_proc` accordingly in your app (or the plugin, if supported).
374
+
375
+ ### SASL (advanced)
376
+
377
+ SASL enables alternative bind mechanisms. Only enable if you understand the server-side requirements.
378
+
379
+ ```ruby
380
+ provider :ldap,
381
+ host: "ldap.example.com",
382
+ base: "dc=example,dc=com",
383
+ try_sasl: true,
384
+ sasl_mechanisms: ["DIGEST-MD5"],
385
+ uid: "uid"
386
+ ```
387
+
388
+ Supported mechanisms include "DIGEST-MD5" and "GSS-SPNEGO" depending on your environment and gems.
389
+
390
+ ### Name processing and examples
391
+
392
+ If users log in with an email but LDAP expects a short username, use `:name_proc` to normalize the submitted value:
393
+
394
+ ```ruby
395
+ provider :ldap,
396
+ host: "ldap.example.com",
397
+ base: "dc=example,dc=com",
398
+ uid: "sAMAccountName",
399
+ name_proc: proc { |name| name.gsub(/@.*$/, "") }
400
+ ```
401
+
402
+ This trims `alice@example.com` to `alice` before searching.
403
+
404
+ ### Trusted header SSO (REMOTE_USER and friends)
405
+
406
+ Some deployments terminate SSO at a reverse proxy or portal and forward the already-authenticated user identity via an HTTP header such as `REMOTE_USER`.
407
+ When you enable this mode, the LDAP strategy will trust the upstream header, perform a directory lookup for that user, and complete OmniAuth without asking the user for a password.
408
+
409
+ Important: Only enable this behind a trusted front-end that strips and sets the header itself. Never enable on a public endpoint without such a gateway, or an attacker could spoof the header.
410
+
411
+ Configuration options:
412
+
413
+ - `:header_auth` (Boolean, default: false) — Enable trusted header SSO.
414
+ - `:header_name` (String, default: "REMOTE_USER") — The env/header key to read. The strategy checks both `env["REMOTE_USER"]` and the Rack variant `env["HTTP_REMOTE_USER"]`.
415
+ - `:name_proc` is applied to the header value before search (e.g., to strip a domain part).
416
+ - Search is done using your configured `:uid` or `:filter` and the service bind (`:bind_dn`/`:password`) or anonymous bind if allowed.
417
+
418
+ Minimal Rack example:
419
+
420
+ ```ruby
421
+ use OmniAuth::Builder do
422
+ provider :ldap,
423
+ host: "ldap.example.com",
424
+ base: "dc=example,dc=com",
425
+ uid: "uid",
426
+ bind_dn: "cn=search,dc=example,dc=com",
427
+ password: ENV["LDAP_SEARCH_PASSWORD"],
428
+ header_auth: true, # trust REMOTE_USER
429
+ header_name: "REMOTE_USER", # default
430
+ name_proc: proc { |n| n.split("@").first }
431
+ end
432
+ ```
433
+
434
+ Rails initializer example:
435
+
436
+ ```ruby
437
+ Rails.application.config.middleware.use(OmniAuth::Builder) do
438
+ provider :ldap,
439
+ title: "Acme LDAP",
440
+ host: "ldap.acme.internal",
441
+ base: "dc=acme,dc=corp",
442
+ uid: "sAMAccountName",
443
+ bind_dn: "cn=search,dc=acme,dc=corp",
444
+ password: ENV["LDAP_SEARCH_PASSWORD"],
445
+ header_auth: true,
446
+ header_name: "REMOTE_USER",
447
+ # Optionally restrict with a group filter while using the header value
448
+ filter: "(&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=acme,dc=corp))",
449
+ name_proc: proc { |n| n.gsub(/@.*$/, "") }
450
+ end
451
+ ```
452
+
453
+ Flow:
454
+
455
+ - If `header_auth` is on and the header is present when the request hits `/auth/ldap`, the strategy immediately redirects to `/auth/ldap/callback`.
456
+ - In the callback, the strategy searches the directory for that user and maps their attributes; no user password bind is attempted.
457
+ - If the header is missing (or `header_auth` is false), the normal username/password form flow is used.
458
+
459
+ Security checklist:
460
+
461
+ - Ensure your reverse proxy strips user-controlled copies of the header and sets the canonical `REMOTE_USER` itself.
462
+ - Prefer TLS-secured internal links between the proxy and your app.
463
+ - Consider also restricting with a group-based `:filter` so only authorized users can sign in.
464
+
465
+ ## 🦷 FLOSS Funding
466
+
467
+ While these tools are free software and will always be, the project would benefit immensely from some funding.
468
+ Raising a monthly budget of... "dollars" would make the project more sustainable.
469
+
470
+ We welcome both individual and corporate sponsors! We also offer a
471
+ wide array of funding channels to account for your preferences.
472
+ Currently, [GitHub Sponsors][🖇sponsor], and [Liberapay][⛳liberapay] are our preferred funding platforms.
473
+
474
+ **If you're working in a company that's making significant use of omniauth tools we'd
475
+ appreciate it if you suggest to your company to become a omniauth sponsor.**
476
+
477
+ You can support me in development of OmniAuth tools via
478
+ [GitHub Sponsors][🖇sponsor],
479
+ [Liberapay][⛳liberapay],
480
+ [PayPal][🖇paypal],
481
+ and [Tidelift][🏙️entsup-tidelift].
482
+
483
+ | 📍 NOTE |
484
+ |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
485
+ | If doing a sponsorship in the form of donation is problematic for your company <br/> from an accounting standpoint, we'd recommend the use of Tidelift, <br/> where you can get a support-like subscription instead. |
486
+
487
+ ### Another way to support open-source
488
+
489
+ I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
490
+
491
+ If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
492
+
493
+ I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.
494
+
495
+ **[Floss-Funding.dev][🖇floss-funding.dev]: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags**
496
+
497
+ [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
498
+
499
+ ## 🔐 Security
500
+
501
+ See [SECURITY.md][🔐security].
502
+
503
+ ## 🤝 Contributing
504
+
505
+ If you need some ideas of where to help, you could work on adding more code coverage,
506
+ or if it is already 💯 (see [below](#code-coverage)) check [reek](REEK), [issues][🤝gh-issues], or [PRs][🤝gh-pulls],
507
+ or use the gem and think about how it could be better.
508
+
509
+ We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
510
+
511
+ See [CONTRIBUTING.md][🤝contributing] for more detailed instructions.
512
+
513
+ ### 🚀 Release Instructions
514
+
515
+ See [CONTRIBUTING.md][🤝contributing].
516
+
517
+ ### Code Coverage
518
+
519
+ [![Coverage Graph][🏀codecov-g]][🏀codecov]
520
+
521
+ [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
522
+
523
+ [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
524
+
525
+ ### 🪇 Code of Conduct
526
+
527
+ Everyone interacting with this project's codebases, issue trackers,
528
+ chat rooms and mailing lists agrees to follow the [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct].
529
+
530
+ ## 🌈 Contributors
531
+
532
+ [![Contributors][🖐contributors-img]][🖐contributors]
533
+
534
+ Made with [contributors-img][🖐contrib-rocks].
535
+
536
+ <details>
537
+ <summary>⭐️ Star History</summary>
538
+
539
+ <a href="https://star-history.com/#omniauth/omniauth-ldap&Date">
540
+ <picture>
541
+ <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=omniauth/omniauth-ldap&type=Date&theme=dark" />
542
+ <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=omniauth/omniauth-ldap&type=Date" />
543
+ <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=omniauth/omniauth-ldap&type=Date" />
544
+ </picture>
545
+ </a>
546
+
547
+ </details>
548
+
549
+ ## 📌 Versioning
550
+
551
+ This Library adheres to [![Semantic Versioning 2.0.0][📌semver-img]][📌semver].
552
+ Violations of this scheme should be reported as bugs.
553
+ Specifically, if a minor or patch version is released that breaks backward compatibility,
554
+ a new version should be immediately released that restores compatibility.
555
+ Breaking changes to the public API will only be introduced with new major versions.
556
+
557
+ > dropping support for a platform is both obviously and objectively a breaking change <br/>
558
+ >—Jordan Harband ([@ljharb](https://github.com/ljharb), maintainer of SemVer) [in SemVer issue 716][📌semver-breaking]
559
+
560
+ I understand that policy doesn't work universally ("exceptions to every rule!"),
561
+ but it is the policy here.
562
+ As such, in many cases it is good to specify a dependency on this library using
563
+ the [Pessimistic Version Constraint][📌pvc] with two digits of precision.
564
+
565
+ For example:
566
+
567
+ ```ruby
568
+ spec.add_dependency("omniauth-ldap", "~> 1.0")
569
+ ```
570
+
571
+ <details>
572
+ <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
573
+
574
+ SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
575
+ is a *breaking change* to an API.
576
+ It is obvious to many, but not all, and since the spec is silent, the bike shedding is endless.
577
+
578
+ To get a better understanding of how SemVer is intended to work over a project's lifetime,
579
+ read this article from the creator of SemVer:
580
+
581
+ - ["Major Version Numbers are Not Sacred"][📌major-versions-not-sacred]
582
+
583
+ </details>
584
+
585
+ See [CHANGELOG.md][📌changelog] for a list of releases.
586
+
587
+ ## 📄 License
588
+
589
+ The gem is available as open source under the terms of
590
+ the [MIT License][📄license] [![License: MIT][📄license-img]][📄license-ref].
591
+ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright-notice-explainer].
592
+
593
+ ### © Copyright
594
+
595
+ <ul>
596
+ <li>
597
+ Copyright (c) 2025 Peter H. Boling, of
598
+ <a href="https://discord.gg/3qme4XHNKN">
599
+ Galtzo.com
600
+ <picture>
601
+ <img src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-128px-blank.svg" alt="Galtzo.com Logo (Wordless) by Aboling0, CC BY-SA 4.0" width="24">
602
+ </picture>
603
+ </a>, and omniauth-ldap contributors.
604
+ </li>
605
+ <li>
606
+ Copyright (c) 2011 by Ping Yu and Intridea, Inc.
607
+ </li>
608
+ </ul>
609
+
610
+ ## 🤑 A request for help
611
+
612
+ Maintainers have teeth and need to pay their dentists.
613
+ After getting laid off in an RIF in March, and encountering difficulty finding a new one,
614
+ I began spending most of my time building open source tools.
615
+ I'm hoping to be able to pay for my kids' health insurance this month,
616
+ so if you value the work I am doing, I need your support.
617
+ Please consider sponsoring me or the project.
618
+
619
+ To join the community or get help 👇️ Join the Discord.
620
+
621
+ [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
622
+
623
+ To say "thanks!" ☝️ Join the Discord or 👇️ send money.
624
+
625
+ [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
626
+
627
+ ### Please give the project a star ⭐ ♥.
628
+
629
+ Thanks for RTFM. ☺️
630
+
631
+ [⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&color=a51611&style=flat
632
+ [⛳liberapay-bottom-img]: https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&logo=liberapay&color=a51611
633
+ [⛳liberapay]: https://liberapay.com/pboling/donate
634
+ [🖇sponsor-img]: https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&logo=github
635
+ [🖇sponsor-bottom-img]: https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&logo=github
636
+ [🖇sponsor]: https://github.com/sponsors/pboling
637
+ [🖇polar-img]: https://img.shields.io/badge/polar-donate-a51611.svg?style=flat
638
+ [🖇polar]: https://polar.sh/pboling
639
+ [🖇kofi-img]: https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat
640
+ [🖇kofi]: https://ko-fi.com/O5O86SNP4
641
+ [🖇patreon-img]: https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat
642
+ [🖇patreon]: https://patreon.com/galtzo
643
+ [🖇buyme-small-img]: https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat
644
+ [🖇buyme-img]: https://img.buymeacoffee.com/button-api/?text=Buy%20me%20a%20latte&emoji=&slug=pboling&button_colour=FFDD00&font_colour=000000&font_family=Cookie&outline_colour=000000&coffee_colour=ffffff
645
+ [🖇buyme]: https://www.buymeacoffee.com/pboling
646
+ [🖇paypal-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&logo=paypal
647
+ [🖇paypal-bottom-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&logo=paypal&color=0A0A0A
648
+ [🖇paypal]: https://www.paypal.com/paypalme/peterboling
649
+ [🖇floss-funding.dev]: https://floss-funding.dev
650
+ [🖇floss-funding-gem]: https://github.com/galtzo-floss/floss_funding
651
+ [✉️discord-invite]: https://discord.gg/3qme4XHNKN
652
+ [✉️discord-invite-img-ftb]: https://img.shields.io/discord/1373797679469170758?style=for-the-badge&logo=discord
653
+ [✉️ruby-friends-img]: https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&logo=dailydotdev&logoColor=white
654
+ [✉️ruby-friends]: https://app.daily.dev/squads/rubyfriends
655
+
656
+ [✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
657
+ [⛳️gem-namespace]: https://github.com/omniauth/omniauth-ldap
658
+ [⛳️namespace-img]: https://img.shields.io/badge/namespace-Omniauth::Ldap-3C2D2D.svg?style=square&logo=ruby&logoColor=white
659
+ [⛳️gem-name]: https://bestgems.org/gems/omniauth-ldap
660
+ [⛳️name-img]: https://img.shields.io/badge/name-omniauth--ldap-3C2D2D.svg?style=square&logo=rubygems&logoColor=red
661
+ [⛳️tag-img]: https://img.shields.io/github/tag/omniauth/omniauth-ldap.svg
662
+ [⛳️tag]: http://github.com/omniauth/omniauth-ldap/releases
663
+ [🚂maint-blog]: http://www.railsbling.com/tags/omniauth-ldap
664
+ [🚂maint-blog-img]: https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&logo=rubyonrails&logoColor=orange
665
+ [🚂maint-contact]: http://www.railsbling.com/contact
666
+ [🚂maint-contact-img]: https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&logo=rubyonrails&logoColor=red
667
+ [💖🖇linkedin]: http://www.linkedin.com/in/peterboling
668
+ [💖🖇linkedin-img]: https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&logo=newjapanprowrestling
669
+ [💖✌️wellfound]: https://wellfound.com/u/peter-boling
670
+ [💖✌️wellfound-img]: https://img.shields.io/badge/peter--boling-orange?style=flat&logo=wellfound
671
+ [💖💲crunchbase]: https://www.crunchbase.com/person/peter-boling
672
+ [💖💲crunchbase-img]: https://img.shields.io/badge/peter--boling-purple?style=flat&logo=crunchbase
673
+ [💖🐘ruby-mast]: https://ruby.social/@galtzo
674
+ [💖🐘ruby-mast-img]: https://img.shields.io/mastodon/follow/109447111526622197?domain=https://ruby.social&style=flat&logo=mastodon&label=Ruby%20@galtzo
675
+ [💖🦋bluesky]: https://bsky.app/profile/galtzo.com
676
+ [💖🦋bluesky-img]: https://img.shields.io/badge/@galtzo.com-0285FF?style=flat&logo=bluesky&logoColor=white
677
+ [💖🌳linktree]: https://linktr.ee/galtzo
678
+ [💖🌳linktree-img]: https://img.shields.io/badge/galtzo-purple?style=flat&logo=linktree
679
+ [💖💁🏼‍♂️devto]: https://dev.to/galtzo
680
+ [💖💁🏼‍♂️devto-img]: https://img.shields.io/badge/dev.to-0A0A0A?style=flat&logo=devdotto&logoColor=white
681
+ [💖💁🏼‍♂️aboutme]: https://about.me/peter.boling
682
+ [💖💁🏼‍♂️aboutme-img]: https://img.shields.io/badge/about.me-0A0A0A?style=flat&logo=aboutme&logoColor=white
683
+ [💖🧊berg]: https://codeberg.org/pboling
684
+ [💖🐙hub]: https://github.org/pboling
685
+ [💖🛖hut]: https://sr.ht/~galtzo/
686
+ [💖🧪lab]: https://gitlab.com/pboling
687
+ [👨🏼‍🏫expsup-upwork]: https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share
688
+ [👨🏼‍🏫expsup-upwork-img]: https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&logo=Upwork&logoColor=white
689
+ [👨🏼‍🏫expsup-codementor]: https://www.codementor.io/peterboling?utm_source=github&utm_medium=button&utm_term=peterboling&utm_campaign=github
690
+ [👨🏼‍🏫expsup-codementor-img]: https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&logo=CodeMentor&logoColor=white
691
+ [🏙️entsup-tidelift]: https://tidelift.com/subscription/pkg/rubygems-omniauth-ldap?utm_source=rubygems-omniauth-ldap&utm_medium=referral&utm_campaign=readme
692
+ [🏙️entsup-tidelift-img]: https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&logo=sonar&logoColor=white
693
+ [🏙️entsup-tidelift-sonar]: https://blog.tidelift.com/tidelift-joins-sonar
694
+ [💁🏼‍♂️peterboling]: http://www.peterboling.com
695
+ [🚂railsbling]: http://www.railsbling.com
696
+ [📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&logo=Github&logoColor=green
697
+ [📜src-gh]: https://github.com/omniauth/omniauth-ldap
698
+ [📜docs-cr-rd-img]: https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
699
+ [📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
700
+ [📜gh-wiki]: https://github.com/omniauth/omniauth-ldap/wiki
701
+ [📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
702
+ [👽dl-rank]: https://bestgems.org/gems/omniauth-ldap
703
+ [👽dl-ranki]: https://img.shields.io/gem/rd/omniauth-ldap.svg
704
+ [👽oss-help]: https://www.codetriage.com/omniauth/omniauth-ldap
705
+ [👽oss-helpi]: https://www.codetriage.com/omniauth/omniauth-ldap/badges/users.svg
706
+ [👽version]: https://bestgems.org/gems/omniauth-ldap
707
+ [👽versioni]: https://img.shields.io/gem/v/omniauth-ldap.svg
708
+ [🏀qlty-mnt]: https://qlty.sh/gh/omniauth/projects/omniauth-ldap
709
+ [🏀qlty-mnti]: https://qlty.sh/gh/omniauth/projects/omniauth-ldap/maintainability.svg
710
+ [🏀qlty-cov]: https://qlty.sh/gh/omniauth/projects/omniauth-ldap/metrics/code?sort=coverageRating
711
+ [🏀qlty-covi]: https://qlty.sh/gh/omniauth/projects/omniauth-ldap/coverage.svg
712
+ [🏀codecov]: https://codecov.io/gh/omniauth/omniauth-ldap
713
+ [🏀codecovi]: https://codecov.io/gh/omniauth/omniauth-ldap/graph/badge.svg
714
+ [🏀coveralls]: https://coveralls.io/github/omniauth/omniauth-ldap?branch=main
715
+ [🏀coveralls-img]: https://coveralls.io/repos/github/omniauth/omniauth-ldap/badge.svg?branch=main
716
+ [🖐codeQL]: https://github.com/omniauth/omniauth-ldap/security/code-scanning
717
+ [🖐codeQL-img]: https://github.com/omniauth/omniauth-ldap/actions/workflows/codeql-analysis.yml/badge.svg
718
+ [🚎1-an-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/ancient.yml
719
+ [🚎1-an-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/ancient.yml/badge.svg
720
+ [🚎2-cov-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/coverage.yml
721
+ [🚎2-cov-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/coverage.yml/badge.svg
722
+ [🚎3-hd-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/heads.yml
723
+ [🚎3-hd-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/heads.yml/badge.svg
724
+ [🚎4-lg-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/legacy.yml
725
+ [🚎4-lg-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/legacy.yml/badge.svg
726
+ [🚎5-st-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/style.yml
727
+ [🚎5-st-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/style.yml/badge.svg
728
+ [🚎6-s-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/supported.yml
729
+ [🚎6-s-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/supported.yml/badge.svg
730
+ [🚎7-us-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/unsupported.yml
731
+ [🚎7-us-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/unsupported.yml/badge.svg
732
+ [🚎8-ho-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/hoary.yml
733
+ [🚎8-ho-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/hoary.yml/badge.svg
734
+ [🚎9-t-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/truffle.yml
735
+ [🚎9-t-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/truffle.yml/badge.svg
736
+ [🚎10-j-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/jruby.yml
737
+ [🚎10-j-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/jruby.yml/badge.svg
738
+ [🚎11-c-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/current.yml
739
+ [🚎11-c-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/current.yml/badge.svg
740
+ [🚎12-crh-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/dep-heads.yml
741
+ [🚎12-crh-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/dep-heads.yml/badge.svg
742
+ [🚎13-🔒️-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/locked_deps.yml
743
+ [🚎13-🔒️-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/locked_deps.yml/badge.svg
744
+ [🚎14-🔓️-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/unlocked_deps.yml
745
+ [🚎14-🔓️-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/unlocked_deps.yml/badge.svg
746
+ [🚎15-🪪-wf]: https://github.com/omniauth/omniauth-ldap/actions/workflows/license-eye.yml
747
+ [🚎15-🪪-wfi]: https://github.com/omniauth/omniauth-ldap/actions/workflows/license-eye.yml/badge.svg
748
+ [💎ruby-2.0i]: https://img.shields.io/badge/Ruby-2.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=white
749
+ [💎ruby-2.1i]: https://img.shields.io/badge/Ruby-2.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=white
750
+ [💎ruby-2.2i]: https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=white
751
+ [💎ruby-2.3i]: https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
752
+ [💎ruby-2.4i]: https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
753
+ [💎ruby-2.5i]: https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
754
+ [💎ruby-2.6i]: https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
755
+ [💎ruby-2.7i]: https://img.shields.io/badge/Ruby-2.7-DF00CA?style=for-the-badge&logo=ruby&logoColor=white
756
+ [💎ruby-3.0i]: https://img.shields.io/badge/Ruby-3.0-CC342D?style=for-the-badge&logo=ruby&logoColor=white
757
+ [💎ruby-3.1i]: https://img.shields.io/badge/Ruby-3.1-CC342D?style=for-the-badge&logo=ruby&logoColor=white
758
+ [💎ruby-3.2i]: https://img.shields.io/badge/Ruby-3.2-CC342D?style=for-the-badge&logo=ruby&logoColor=white
759
+ [💎ruby-3.3i]: https://img.shields.io/badge/Ruby-3.3-CC342D?style=for-the-badge&logo=ruby&logoColor=white
760
+ [💎ruby-c-i]: https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&logo=ruby&logoColor=green
761
+ [💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&logo=ruby&logoColor=blue
762
+ [💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
763
+ [💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
764
+ [💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
765
+ [💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
766
+ [💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&logo=ruby&logoColor=blue
767
+ [💎jruby-9.1i]: https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=red
768
+ [💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=red
769
+ [💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=red
770
+ [💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&logo=ruby&logoColor=red
771
+ [💎jruby-c-i]: https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&logo=ruby&logoColor=green
772
+ [💎jruby-headi]: https://img.shields.io/badge/JRuby-HEAD-FBE742?style=for-the-badge&logo=ruby&logoColor=blue
773
+ [🤝gh-issues]: https://github.com/omniauth/omniauth-ldap/issues
774
+ [🤝gh-pulls]: https://github.com/omniauth/omniauth-ldap/pulls
775
+ [🤝contributing]: CONTRIBUTING.md
776
+ [🏀codecov-g]: https://codecov.io/gh/omniauth/omniauth-ldap/graphs/tree.svg
777
+ [🖐contrib-rocks]: https://contrib.rocks
778
+ [🖐contributors]: https://github.com/omniauth/omniauth-ldap/graphs/contributors
779
+ [🖐contributors-img]: https://contrib.rocks/image?repo=omniauth/omniauth-ldap
780
+ [🪇conduct]: CODE_OF_CONDUCT.md
781
+ [🪇conduct-img]: https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg
782
+ [📌pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
783
+ [📌semver]: https://semver.org/spec/v2.0.0.html
784
+ [📌semver-img]: https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat
785
+ [📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
786
+ [📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
787
+ [📌changelog]: CHANGELOG.md
788
+ [📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
789
+ [📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
790
+ [📌gitmoji]: https://gitmoji.dev
791
+ [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
792
+ [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
793
+ [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.233-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
794
+ [🔐security]: SECURITY.md
795
+ [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
796
+ [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
797
+ [📄license]: LICENSE.txt
798
+ [📄license-ref]: https://opensource.org/licenses/MIT
799
+ [📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
800
+ [📄license-compat]: https://dev.to/galtzo/how-to-check-license-compatibility-41h0
801
+ [📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&logo=Apache
802
+ [📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
803
+ [📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
804
+ [🚎yard-current]: http://rubydoc.info/gems/omniauth-ldap
805
+ [🚎yard-head]: https://omniauth-ldap.galtzo.com
806
+ [💎stone_checksums]: https://github.com/galtzo-floss/stone_checksums
807
+ [💎SHA_checksums]: https://gitlab.com/omniauth/omniauth-ldap/-/tree/main/checksums
808
+ [💎rlts]: https://github.com/rubocop-lts/rubocop-lts
809
+ [💎rlts-img]: https://img.shields.io/badge/code_style_&_linting-rubocop--lts-34495e.svg?plastic&logo=ruby&logoColor=white
810
+ [💎appraisal2]: https://github.com/appraisal-rb/appraisal2
811
+ [💎appraisal2-img]: https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&logo=ruby&logoColor=white
812
+ [💎d-in-dvcs]: https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/
813
+
814
+ [//]: # (LDAP RFC references)
815
+ [rfc4511]: https://datatracker.ietf.org/doc/html/rfc4511
816
+ [rfc4514]: https://datatracker.ietf.org/doc/html/rfc4514
817
+ [rfc4519]: https://datatracker.ietf.org/doc/html/rfc4519