omniauth-ldap 2.3.3 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- checksums.yaml.gz.sig +0 -0
- data/CHANGELOG.md +51 -1
- data/CITATION.cff +0 -0
- data/CODE_OF_CONDUCT.md +0 -0
- data/CONTRIBUTING.md +0 -0
- data/FUNDING.md +0 -0
- data/LICENSE.txt +1 -1
- data/README.md +43 -54
- data/RUBOCOP.md +0 -0
- data/SECURITY.md +0 -0
- data/lib/{omniauth-ldap → omniauth/ldap}/adaptor.rb +15 -17
- data/lib/omniauth/ldap/auth_sanitizer.rb +38 -0
- data/lib/{omniauth-ldap → omniauth/ldap}/version.rb +1 -1
- data/lib/omniauth/ldap.rb +18 -0
- data/lib/omniauth/strategies/ldap.rb +58 -12
- data/lib/omniauth-ldap.rb +2 -17
- data/sig/omniauth/ldap/adaptor.rbs +0 -0
- data/sig/omniauth/ldap/version.rbs +0 -0
- data/sig/omniauth/strategies/ldap.rbs +6 -0
- data/sig/omniauth-ldap.rbs +0 -0
- data/sig/rbs/net-ldap.rbs +0 -0
- data/sig/rbs/net-ntlm.rbs +0 -0
- data/sig/rbs/sasl.rbs +0 -0
- data.tar.gz.sig +0 -0
- metadata +30 -10
- metadata.gz.sig +0 -0
- data/REEK +0 -0
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: db8f14110058b0d3298f67c22cb05dcea355d72943478bdd8d9b363f346541bc
|
|
4
|
+
data.tar.gz: dda80d2d043153246fe334d57eb73059e5f8586046b7631bae1ef81682778dc5
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 75c450a755a8846071d7ebae48672f3a46bb0c6ebf36e6a37c82750b1a0fa35fe9b22484c0803bfbc029b3a00490447baa4f63a53d55d47d8afb8d62e028e80b
|
|
7
|
+
data.tar.gz: b24afe0b3fd3025482662d6f34f2a5dfbfea87e59647d1c76ebc32928273c8984cd4f3c98464bed712afd4fa04683980927e4c0effbbf55ef19191c6656df75d
|
checksums.yaml.gz.sig
CHANGED
|
Binary file
|
data/CHANGELOG.md
CHANGED
|
@@ -32,6 +32,52 @@ Please file a bug if you notice a violation of semantic versioning.
|
|
|
32
32
|
|
|
33
33
|
### Security
|
|
34
34
|
|
|
35
|
+
## [3.0.0] - 2026-05-21
|
|
36
|
+
|
|
37
|
+
- TAG: [v3.0.0][3.0.0t]
|
|
38
|
+
- COVERAGE: 97.52% -- 315/323 lines in 6 files
|
|
39
|
+
- BRANCH COVERAGE: 79.41% -- 108/136 branches in 6 files
|
|
40
|
+
- 94.59% documented
|
|
41
|
+
|
|
42
|
+
### Added
|
|
43
|
+
|
|
44
|
+
- Add `auth-sanitizer` runtime dependency to redact sensitive LDAP adaptor inspection output without defining top-level `Auth` or `AuthSanitizer`
|
|
45
|
+
|
|
46
|
+
### Changed
|
|
47
|
+
|
|
48
|
+
- Minimum supported Ruby version is now 2.2.0
|
|
49
|
+
|
|
50
|
+
### Removed
|
|
51
|
+
|
|
52
|
+
- Remove deprecated (since `v2.1.0-gl` in 2018) top-level `:ca_file` and `:ssl_version` LDAP configuration options; use `:tls_options` instead
|
|
53
|
+
- Remove adaptor backward-compatibility that translated top-level `:ca_file` and `:ssl_version` into TLS options
|
|
54
|
+
- Remove deprecated direct-option specs for top-level `:ca_file` and `:ssl_version`
|
|
55
|
+
|
|
56
|
+
## [2.3.4] - 2026-05-18
|
|
57
|
+
|
|
58
|
+
- TAG: [v2.3.4][2.3.4t]
|
|
59
|
+
- COVERAGE: 97.44% -- 304/312 lines in 4 files
|
|
60
|
+
- BRANCH COVERAGE: 79.58% -- 113/142 branches in 4 files
|
|
61
|
+
- 94.44% documented
|
|
62
|
+
|
|
63
|
+
### Added
|
|
64
|
+
|
|
65
|
+
- Add `header_auth_source` to require explicit selection of trusted header identity source (`:env` or `:http_header`)
|
|
66
|
+
- Add `header_auth_require_tls` to require TLS for trusted header SSO by default
|
|
67
|
+
- Log a prominent security warning when `header_auth` is enabled
|
|
68
|
+
|
|
69
|
+
### Changed
|
|
70
|
+
|
|
71
|
+
- Trusted header SSO now defaults to trusting only server-set env variables and no longer checks Rack `HTTP_` header variants unless `header_auth_source: :http_header` is configured
|
|
72
|
+
|
|
73
|
+
### Fixed
|
|
74
|
+
|
|
75
|
+
- Fix OpenSSL 3/Ruby 4 compatibility in the TLS options adaptor spec
|
|
76
|
+
|
|
77
|
+
### Security
|
|
78
|
+
|
|
79
|
+
- Harden trusted header SSO against spoofing by removing automatic fallback from `REMOTE_USER` to `HTTP_REMOTE_USER`
|
|
80
|
+
|
|
35
81
|
## [2.3.3] - 2025-11-10
|
|
36
82
|
|
|
37
83
|
- TAG: [v2.3.3][2.3.3t]
|
|
@@ -240,7 +286,11 @@ Please file a bug if you notice a violation of semantic versioning.
|
|
|
240
286
|
[1.0.0]: https://github.com/omniauth/omniauth-ldap/compare/5656da80d4193e0d0584f44bac493a87695e580f...v1.0.0
|
|
241
287
|
[1.0.0t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v1.0.0
|
|
242
288
|
|
|
243
|
-
[Unreleased]: https://github.com/omniauth/omniauth-ldap/compare/
|
|
289
|
+
[Unreleased]: https://github.com/omniauth/omniauth-ldap/compare/v3.0.0...HEAD
|
|
290
|
+
[3.0.0]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.4...v3.0.0
|
|
291
|
+
[3.0.0t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v3.0.0
|
|
292
|
+
[2.3.4]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.3...v2.3.4
|
|
293
|
+
[2.3.4t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v2.3.4
|
|
244
294
|
[2.3.3]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.2...v2.3.3
|
|
245
295
|
[2.3.3t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v2.3.3
|
|
246
296
|
[2.3.2]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.1...v2.3.2
|
data/CITATION.cff
CHANGED
|
File without changes
|
data/CODE_OF_CONDUCT.md
CHANGED
|
File without changes
|
data/CONTRIBUTING.md
CHANGED
|
File without changes
|
data/FUNDING.md
CHANGED
|
File without changes
|
data/LICENSE.txt
CHANGED
data/README.md
CHANGED
|
@@ -1,32 +1,3 @@
|
|
|
1
|
-
| 📍 NOTE |
|
|
2
|
-
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
3
|
-
| RubyGems (the [GitHub org][rubygems-org], not the website) [suffered][draper-security] a [hostile takeover][ellen-takeover] in September 2025. |
|
|
4
|
-
| Ultimately [4 maintainers][simi-removed] were [hard removed][martin-removed] and a reason has been given for only 1 of those, while 2 others resigned in protest. |
|
|
5
|
-
| It is a [complicated story][draper-takeover] which is difficult to [parse quickly][draper-lies]. |
|
|
6
|
-
| I'm adding notes like this to gems because I [don't condone theft][draper-theft] of repositories or gems from their rightful owners. |
|
|
7
|
-
| If a similar theft happened with my repos/gems, I'd hope some would stand up for me. |
|
|
8
|
-
| Disenfranchised former-maintainers have started [gem.coop][gem-coop]. |
|
|
9
|
-
| Once available I will publish there exclusively; unless RubyCentral makes amends with the community. |
|
|
10
|
-
| The ["Technology for Humans: Joel Draper"][reinteractive-podcast] podcast episode by [reinteractive][reinteractive] is the most cogent summary I'm aware of. |
|
|
11
|
-
| See [here][gem-naming], [here][gem-coop] and [here][martin-ann] for more info on what comes next. |
|
|
12
|
-
| What I'm doing: A (WIP) proposal for [bundler/gem scopes][gem-scopes], and a (WIP) proposal for a federated [gem server][gem-server]. |
|
|
13
|
-
|
|
14
|
-
[rubygems-org]: https://github.com/rubygems/
|
|
15
|
-
[draper-security]: https://joel.drapper.me/p/ruby-central-security-measures/
|
|
16
|
-
[draper-takeover]: https://joel.drapper.me/p/ruby-central-takeover/
|
|
17
|
-
[ellen-takeover]: https://pup-e.com/blog/goodbye-rubygems/
|
|
18
|
-
[simi-removed]: https://www.reddit.com/r/ruby/s/gOk42POCaV
|
|
19
|
-
[martin-removed]: https://bsky.app/profile/martinemde.com/post/3m3occezxxs2q
|
|
20
|
-
[draper-lies]: https://joel.drapper.me/p/ruby-central-fact-check/
|
|
21
|
-
[draper-theft]: https://joel.drapper.me/p/ruby-central/
|
|
22
|
-
[reinteractive]: https://reinteractive.com/ruby-on-rails
|
|
23
|
-
[gem-coop]: https://gem.coop
|
|
24
|
-
[gem-naming]: https://github.com/gem-coop/gem.coop/issues/12
|
|
25
|
-
[martin-ann]: https://martinemde.com/2025/10/05/announcing-gem-coop.html
|
|
26
|
-
[gem-scopes]: https://github.com/galtzo-floss/bundle-namespace
|
|
27
|
-
[gem-server]: https://github.com/galtzo-floss/gem-server
|
|
28
|
-
[reinteractive-podcast]: https://youtu.be/_H4qbtC5qzU?si=BvuBU90R2wAqD2E6
|
|
29
|
-
|
|
30
1
|
[![Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0][🖼️galtzo-i]][🖼️galtzo-discord] [![ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5][🖼️ruby-lang-i]][🖼️ruby-lang] [![omniauth Logo (presumed to be) by tomeara, (presumed to be) MIT License][🖼️omniauth-i]][🖼️omniauth]
|
|
31
2
|
|
|
32
3
|
[🖼️galtzo-i]: https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg
|
|
@@ -38,7 +9,7 @@
|
|
|
38
9
|
|
|
39
10
|
# 📁 OmniAuth LDAP
|
|
40
11
|
|
|
41
|
-
[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![
|
|
12
|
+
[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
|
|
42
13
|
|
|
43
14
|
`if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][🖼️galtzo-discord], as I may have missed the [discord notification][🖼️galtzo-discord].
|
|
44
15
|
|
|
@@ -48,6 +19,13 @@
|
|
|
48
19
|
|
|
49
20
|
[![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
|
|
50
21
|
|
|
22
|
+
<details>
|
|
23
|
+
<summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
|
|
24
|
+
|
|
25
|
+
I've summarized my thoughts in [this blog post](https://dev.to/galtzo/hostile-takeover-of-rubygems-my-thoughts-5hlo).
|
|
26
|
+
|
|
27
|
+
</details>
|
|
28
|
+
|
|
51
29
|
## 🌻 Synopsis
|
|
52
30
|
|
|
53
31
|
Use the LDAP strategy as a middleware in your application:
|
|
@@ -79,7 +57,9 @@ use OmniAuth::Strategies::LDAP,
|
|
|
79
57
|
# use OmniAuth::Strategies::LDAP, filter: '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))'
|
|
80
58
|
```
|
|
81
59
|
|
|
82
|
-
|
|
60
|
+
At minimum you normally configure `:host`, `:base`, and either `:uid` or `:filter`. The other options shown above customize connection behavior, TLS, username normalization, timeouts, and returned auth info.
|
|
61
|
+
|
|
62
|
+
For trusted header SSO, enable `header_auth: true` and explicitly choose the trusted identity source with `header_auth_source: :env` or `header_auth_source: :http_header`. See [Trusted header SSO](#trusted-header-sso-remote_user-and-friends) for the security requirements.
|
|
83
63
|
|
|
84
64
|
### TLS certificate verification
|
|
85
65
|
|
|
@@ -132,7 +112,7 @@ Note: Net::LDAP historically defaulted to no certificate validation when `tls_op
|
|
|
132
112
|
| Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
|
|
133
113
|
| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
|
|
134
114
|
| Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
|
|
135
|
-
| Works with MRI Ruby 2 | ![Ruby 2.
|
|
115
|
+
| Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
|
|
136
116
|
| Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork] [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor] |
|
|
137
117
|
| Source | [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
|
|
138
118
|
| Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
|
|
@@ -143,7 +123,7 @@ Note: Net::LDAP historically defaulted to no certificate validation when `tls_op
|
|
|
143
123
|
|
|
144
124
|
### Compatibility
|
|
145
125
|
|
|
146
|
-
Compatible with MRI Ruby 2.0+, and concordant releases of JRuby, and TruffleRuby.
|
|
126
|
+
Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
|
|
147
127
|
|
|
148
128
|
| 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚 |
|
|
149
129
|
|------------------------------------------------|--------------------------------------------------------|
|
|
@@ -228,14 +208,14 @@ The following options are available for configuring the OmniAuth LDAP strategy:
|
|
|
228
208
|
### Required Options
|
|
229
209
|
|
|
230
210
|
- `:host` - The hostname or IP address of the LDAP server.
|
|
231
|
-
- `:port` - The port number of the LDAP server (default: 389).
|
|
232
|
-
- `:method` - The connection method. Allowed values: `:plain`, `:ssl`, `:tls` (default: `:plain`).
|
|
233
211
|
- `:base` - The base DN for the LDAP search.
|
|
234
212
|
- `:uid` or `:filter` - Either `:uid` (the LDAP attribute for username, default: "sAMAccountName") or `:filter` (LDAP filter for searching user entries). If `:filter` is provided, `:uid` is not required. Note: This `:uid` option is the search attribute, not the top-level `auth.uid` in the OmniAuth result.
|
|
235
213
|
|
|
236
214
|
### Optional Options
|
|
237
215
|
|
|
238
216
|
- `:title` - The title for the authentication form (default: "LDAP Authentication").
|
|
217
|
+
- `:port` - The port number of the LDAP server (default: 389).
|
|
218
|
+
- `:encryption` - The connection method. Allowed values: `:plain`, `:ssl`, `:tls` (default: `:plain`). `:method` is still accepted for compatibility, but is deprecated.
|
|
239
219
|
- `:bind_dn` - The DN to bind with for searching users (required if anonymous access is not allowed).
|
|
240
220
|
- `:password` - The password for the bind DN.
|
|
241
221
|
- `:name_proc` - A proc to process the username before using it in the search (default: identity proc that returns the username unchanged).
|
|
@@ -249,6 +229,10 @@ The following options are available for configuring the OmniAuth LDAP strategy:
|
|
|
249
229
|
- `:connect_timeout` - Maximum time in seconds to wait when establishing the TCP connection to the LDAP server. Forwarded to `Net::LDAP`.
|
|
250
230
|
- `:read_timeout` - Maximum time in seconds to wait for reads during LDAP operations (search/bind). Forwarded to `Net::LDAP`.
|
|
251
231
|
- `:mapping` - Customize how LDAP attributes map to the returned `auth.info` hash. A sensible default mapping is built into the strategy and will be merged with your overrides. See `lib/omniauth/strategies/ldap.rb` for the default keys and behavior; values can be a String (single attribute), an Array (first present attribute wins), or a Hash (string pattern with placeholders like `%0` combined from multiple attributes).
|
|
232
|
+
- `:header_auth` - Enable trusted upstream identity SSO (default: false). When enabled, the strategy trusts the configured header/env key, performs an LDAP lookup, and skips the user password bind.
|
|
233
|
+
- `:header_name` - Header/env key used for trusted header SSO (default: "REMOTE_USER").
|
|
234
|
+
- `:header_auth_source` - Trusted identity source for header SSO (default: `:env`). Use `:env` to read only `env["REMOTE_USER"]`-style server variables. Use `:http_header` to read only Rack `HTTP_` header keys such as `env["HTTP_REMOTE_USER"]`; only configure this behind a proxy that strips client-supplied copies.
|
|
235
|
+
- `:header_auth_require_tls` - Require TLS for trusted header SSO requests (default: true).
|
|
252
236
|
|
|
253
237
|
Example enabling password policy:
|
|
254
238
|
|
|
@@ -284,7 +268,7 @@ Where to find the "username"-style value
|
|
|
284
268
|
- You can also read the raw attribute from `auth.extra.raw_info` (a `Net::LDAP::Entry`):
|
|
285
269
|
|
|
286
270
|
```ruby
|
|
287
|
-
|
|
271
|
+
post "/auth/ldap/callback" do
|
|
288
272
|
auth = request.env["omniauth.auth"]
|
|
289
273
|
dn = auth.uid # => "cn=alice,ou=users,dc=example,dc=com"
|
|
290
274
|
username = auth.info.nickname # => "alice" (from uid/sAMAccountName)
|
|
@@ -300,7 +284,7 @@ If you need top-level `auth.uid` to be something other than the DN (for example,
|
|
|
300
284
|
## 🔧 Basic Usage
|
|
301
285
|
|
|
302
286
|
The strategy exposes a simple Rack middleware and can be used in plain Rack apps, Sinatra, or Rails.
|
|
303
|
-
|
|
287
|
+
With OmniAuth 2.x, initiate authentication with `POST /auth/ldap`; `GET /auth/ldap` returns 404 by default. Older OmniAuth 1.x deployments may still render the form on `GET /auth/ldap`. Handle the callback at `/auth/ldap/callback`.
|
|
304
288
|
|
|
305
289
|
Below are several concrete examples to get you started.
|
|
306
290
|
|
|
@@ -316,7 +300,7 @@ use OmniAuth::Builder do
|
|
|
316
300
|
provider :ldap,
|
|
317
301
|
host: "ldap.example.com",
|
|
318
302
|
port: 389,
|
|
319
|
-
|
|
303
|
+
encryption: :plain,
|
|
320
304
|
base: "dc=example,dc=com",
|
|
321
305
|
uid: "uid",
|
|
322
306
|
title: "Example LDAP"
|
|
@@ -325,7 +309,7 @@ end
|
|
|
325
309
|
run lambda { |env| [404, {"Content-Type" => "text/plain"}, [env.key?("omniauth.auth").to_s]] }
|
|
326
310
|
```
|
|
327
311
|
|
|
328
|
-
|
|
312
|
+
Submit `POST /auth/ldap` to initiate authentication. With OmniAuth 2.x, the middleware renders the login form on POST when credentials are not already present; with OmniAuth 1.x, `GET /auth/ldap` can also render the form.
|
|
329
313
|
|
|
330
314
|
### Sinatra example
|
|
331
315
|
|
|
@@ -344,10 +328,10 @@ use OmniAuth::Builder do
|
|
|
344
328
|
end
|
|
345
329
|
|
|
346
330
|
get "/" do
|
|
347
|
-
'<
|
|
331
|
+
'<form action="/auth/ldap" method="post"><button type="submit">Sign in with LDAP</button></form>'
|
|
348
332
|
end
|
|
349
333
|
|
|
350
|
-
|
|
334
|
+
post "/auth/ldap/callback" do
|
|
351
335
|
auth = request.env["omniauth.auth"]
|
|
352
336
|
"Hello, #{auth.info["name"]}"
|
|
353
337
|
end
|
|
@@ -371,7 +355,7 @@ Rails.application.config.middleware.use(OmniAuth::Builder) do
|
|
|
371
355
|
end
|
|
372
356
|
```
|
|
373
357
|
|
|
374
|
-
Then
|
|
358
|
+
Then submit users to `/auth/ldap` with POST in your app (for example, from a Devise sign-in page).
|
|
375
359
|
|
|
376
360
|
### Use JSON Body
|
|
377
361
|
|
|
@@ -422,7 +406,7 @@ Examples
|
|
|
422
406
|
|
|
423
407
|
Notes
|
|
424
408
|
|
|
425
|
-
- You can still initiate authentication
|
|
409
|
+
- You can still initiate authentication with a regular form POST and then submit credentials as form-encoded data. JSON is an additional option, not a replacement.
|
|
426
410
|
- In the callback phase (`POST /auth/ldap/callback`), the strategy reads JSON credentials the same way; Rails exposes them via `action_dispatch.request.request_parameters` and non-Rails apps should use a JSON parser middleware.
|
|
427
411
|
|
|
428
412
|
### Using a custom filter
|
|
@@ -607,15 +591,19 @@ Note: You generally do not need this override. Prefer configuring your proxy to
|
|
|
607
591
|
|
|
608
592
|
### Trusted header SSO (REMOTE_USER and friends)
|
|
609
593
|
|
|
610
|
-
Some deployments terminate SSO at a reverse proxy or portal and forward the already-authenticated user identity via
|
|
594
|
+
Some deployments terminate SSO at a reverse proxy or portal and forward the already-authenticated user identity via a server-set environment variable or HTTP header such as `REMOTE_USER`.
|
|
611
595
|
When you enable this mode, the LDAP strategy will trust the upstream header, perform a directory lookup for that user, and complete OmniAuth without asking the user for a password.
|
|
612
596
|
|
|
613
|
-
Important: Only enable this behind a trusted front-end that
|
|
597
|
+
Important: Only enable this behind a trusted front-end that authenticates users before they can reach the OmniAuth endpoint. When `header_auth` is enabled the strategy logs a prominent security warning because it trusts the upstream identity completely.
|
|
614
598
|
|
|
615
599
|
Configuration options:
|
|
616
600
|
|
|
617
601
|
- `:header_auth` (Boolean, default: false) — Enable trusted header SSO.
|
|
618
|
-
- `:header_name` (String, default: "REMOTE_USER") — The env/header key to read.
|
|
602
|
+
- `:header_name` (String, default: "REMOTE_USER") — The env/header key to read.
|
|
603
|
+
- `:header_auth_source` (`:env` or `:http_header`, default: `:env`) — Which Rack env key form to trust.
|
|
604
|
+
- `:env` reads only the exact server-set environment key, such as `env["REMOTE_USER"]`.
|
|
605
|
+
- `:http_header` reads only the Rack HTTP header key, such as `env["HTTP_REMOTE_USER"]`. Only use this behind a proxy that strips client-sent copies of the header before setting its trusted value.
|
|
606
|
+
- `:header_auth_require_tls` (Boolean, default: true) — Raise an error if trusted header SSO is used on a non-TLS request.
|
|
619
607
|
- `:name_proc` is applied to the header value before search (e.g., to strip a domain part).
|
|
620
608
|
- Search is done using your configured `:uid` or `:filter` and the service bind (`:bind_dn`/`:password`) or anonymous bind if allowed.
|
|
621
609
|
|
|
@@ -629,8 +617,9 @@ use OmniAuth::Builder do
|
|
|
629
617
|
uid: "uid",
|
|
630
618
|
bind_dn: "cn=search,dc=example,dc=com",
|
|
631
619
|
password: ENV["LDAP_SEARCH_PASSWORD"],
|
|
632
|
-
header_auth: true,
|
|
633
|
-
header_name: "REMOTE_USER",
|
|
620
|
+
header_auth: true, # trust the configured upstream identity
|
|
621
|
+
header_name: "REMOTE_USER", # default
|
|
622
|
+
header_auth_source: :env, # default; reads env["REMOTE_USER"]
|
|
634
623
|
name_proc: proc { |n| n.split("@").first }
|
|
635
624
|
end
|
|
636
625
|
```
|
|
@@ -648,6 +637,7 @@ Rails.application.config.middleware.use(OmniAuth::Builder) do
|
|
|
648
637
|
password: ENV["LDAP_SEARCH_PASSWORD"],
|
|
649
638
|
header_auth: true,
|
|
650
639
|
header_name: "REMOTE_USER",
|
|
640
|
+
header_auth_source: :env,
|
|
651
641
|
# Optionally restrict with a group filter while using the header value
|
|
652
642
|
filter: "(&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=acme,dc=corp))",
|
|
653
643
|
name_proc: proc { |n| n.gsub(/@.*$/, "") }
|
|
@@ -662,8 +652,9 @@ Flow:
|
|
|
662
652
|
|
|
663
653
|
Security checklist:
|
|
664
654
|
|
|
665
|
-
-
|
|
666
|
-
-
|
|
655
|
+
- Prefer `header_auth_source: :env` for server-set variables such as `REMOTE_USER`.
|
|
656
|
+
- Use `header_auth_source: :http_header` only when your reverse proxy strips user-controlled copies of the header and sets the canonical value itself.
|
|
657
|
+
- Keep `header_auth_require_tls` enabled unless a separate trusted channel protects traffic between the proxy and your app.
|
|
667
658
|
- Consider also restricting with a group-based `:filter` so only authorized users can sign in.
|
|
668
659
|
|
|
669
660
|
## 🦷 FLOSS Funding
|
|
@@ -795,7 +786,7 @@ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright
|
|
|
795
786
|
|
|
796
787
|
<ul>
|
|
797
788
|
<li>
|
|
798
|
-
Copyright (c) 2025 Peter H. Boling, of
|
|
789
|
+
Copyright (c) 2025 - 2026 Peter H. Boling, of
|
|
799
790
|
<a href="https://discord.gg/3qme4XHNKN">
|
|
800
791
|
Galtzo.com
|
|
801
792
|
<picture>
|
|
@@ -905,8 +896,6 @@ Thanks for RTFM. ☺️
|
|
|
905
896
|
[📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
|
|
906
897
|
[👽dl-rank]: https://bestgems.org/gems/omniauth-ldap
|
|
907
898
|
[👽dl-ranki]: https://img.shields.io/gem/rd/omniauth-ldap.svg
|
|
908
|
-
[👽oss-help]: https://www.codetriage.com/omniauth/omniauth-ldap
|
|
909
|
-
[👽oss-helpi]: https://www.codetriage.com/omniauth/omniauth-ldap/badges/users.svg
|
|
910
899
|
[👽version]: https://bestgems.org/gems/omniauth-ldap
|
|
911
900
|
[👽versioni]: https://img.shields.io/gem/v/omniauth-ldap.svg
|
|
912
901
|
[🏀codecov]: https://codecov.io/gh/omniauth/omniauth-ldap
|
|
@@ -990,7 +979,7 @@ Thanks for RTFM. ☺️
|
|
|
990
979
|
[📌gitmoji]: https://gitmoji.dev
|
|
991
980
|
[📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
|
|
992
981
|
[🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
|
|
993
|
-
[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.
|
|
982
|
+
[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.323-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
|
|
994
983
|
[🔐security]: SECURITY.md
|
|
995
984
|
[🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
|
|
996
985
|
[📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
|
data/RUBOCOP.md
CHANGED
|
File without changes
|
data/SECURITY.md
CHANGED
|
File without changes
|
|
@@ -21,6 +21,10 @@ module OmniAuth
|
|
|
21
21
|
#
|
|
22
22
|
# @note Public API: {validate}, {initialize}, {bind_as}, and attr readers such as {connection}, {uid}
|
|
23
23
|
class Adaptor
|
|
24
|
+
include OmniAuth::LDAP::AUTH_SANITIZER::FilteredAttributes
|
|
25
|
+
|
|
26
|
+
filtered_attributes :@auth, :@configuration, :@connection, :@password, :@tls_options
|
|
27
|
+
|
|
24
28
|
# Generic adaptor error super-class
|
|
25
29
|
# @see Error classes that inherit from this class
|
|
26
30
|
class LdapError < StandardError; end
|
|
@@ -59,11 +63,7 @@ module OmniAuth
|
|
|
59
63
|
# Timeouts
|
|
60
64
|
:connect_timeout,
|
|
61
65
|
:read_timeout,
|
|
62
|
-
|
|
63
|
-
# Deprecated
|
|
64
66
|
:method,
|
|
65
|
-
:ca_file,
|
|
66
|
-
:ssl_version,
|
|
67
67
|
]
|
|
68
68
|
|
|
69
69
|
# Required configuration keys. This may include alternatives as sub-lists
|
|
@@ -131,16 +131,18 @@ module OmniAuth
|
|
|
131
131
|
# @param configuration [Hash] configuration hash passed to the adaptor
|
|
132
132
|
# @raise [ArgumentError] when required keys are missing
|
|
133
133
|
# @return [void]
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
134
|
+
class << self
|
|
135
|
+
def validate(configuration = {})
|
|
136
|
+
message = []
|
|
137
|
+
MUST_HAVE_KEYS.each do |names|
|
|
138
|
+
names = [names].flatten
|
|
139
|
+
missing_keys = names.select { |name| configuration[name].nil? }
|
|
140
|
+
if missing_keys == names
|
|
141
|
+
message << names.join(" or ")
|
|
142
|
+
end
|
|
141
143
|
end
|
|
144
|
+
raise ArgumentError.new(message.join(",") + " MUST be provided") unless message.empty?
|
|
142
145
|
end
|
|
143
|
-
raise ArgumentError.new(message.join(",") + " MUST be provided") unless message.empty?
|
|
144
146
|
end
|
|
145
147
|
|
|
146
148
|
# Create a new adaptor instance backed by a Net::LDAP connection.
|
|
@@ -295,7 +297,7 @@ module OmniAuth
|
|
|
295
297
|
ENCRYPTION_METHOD[normalized_method]
|
|
296
298
|
end
|
|
297
299
|
|
|
298
|
-
# Build TLS options
|
|
300
|
+
# Build TLS options from explicit :tls_options configuration.
|
|
299
301
|
#
|
|
300
302
|
# @param translated_method [Symbol] the normalized encryption method
|
|
301
303
|
# @return [Hash] a hash suitable for passing as :tls_options
|
|
@@ -312,10 +314,6 @@ module OmniAuth
|
|
|
312
314
|
options.merge!(configured_options)
|
|
313
315
|
end
|
|
314
316
|
|
|
315
|
-
# Retain backward compatibility until deprecated configs are removed.
|
|
316
|
-
options[:ca_file] = @ca_file if @ca_file
|
|
317
|
-
options[:ssl_version] = @ssl_version if @ssl_version
|
|
318
|
-
|
|
319
317
|
options
|
|
320
318
|
end
|
|
321
319
|
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
module OmniAuth
|
|
2
|
+
module LDAP
|
|
3
|
+
# See: Zero Top-Level Namespace Additions
|
|
4
|
+
# https://github.com/ruby-oauth/auth-sanitizer/blob/main/README.md#zero-top-level-namespace-additions
|
|
5
|
+
AUTH_SANITIZER = begin
|
|
6
|
+
auth_sanitizer_requirement = Gem::Requirement.new("~> 0.1", ">= 0.1.4")
|
|
7
|
+
auth_sanitizer_spec = Gem.loaded_specs["auth-sanitizer"]
|
|
8
|
+
unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sanitizer_spec.version)
|
|
9
|
+
# :nocov:
|
|
10
|
+
auth_sanitizer_spec = Gem::Specification.find_by_name("auth-sanitizer", auth_sanitizer_requirement)
|
|
11
|
+
# :nocov:
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
auth_sanitizer_loader_path = File.join(
|
|
15
|
+
auth_sanitizer_spec.full_gem_path,
|
|
16
|
+
"lib/auth_sanitizer/loader.rb",
|
|
17
|
+
)
|
|
18
|
+
unless File.file?(auth_sanitizer_loader_path)
|
|
19
|
+
# :nocov:
|
|
20
|
+
raise LoadError, "omniauth-ldap requires auth-sanitizer #{auth_sanitizer_requirement}; " \
|
|
21
|
+
"loader not found at #{auth_sanitizer_loader_path}"
|
|
22
|
+
# :nocov:
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
auth_sanitizer_loader_namespace = Module.new
|
|
26
|
+
auth_sanitizer_loader_namespace.module_eval(
|
|
27
|
+
File.read(auth_sanitizer_loader_path),
|
|
28
|
+
auth_sanitizer_loader_path,
|
|
29
|
+
1,
|
|
30
|
+
)
|
|
31
|
+
|
|
32
|
+
auth_sanitizer_loader_namespace
|
|
33
|
+
.const_get(:AuthSanitizer)
|
|
34
|
+
.const_get(:Loader)
|
|
35
|
+
.load_isolated
|
|
36
|
+
end
|
|
37
|
+
end
|
|
38
|
+
end
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
# Integrate the VersionGem helper into the OmniAuth::LDAP::Version module
|
|
2
|
+
# to expose common version-related helper methods. This file is the public
|
|
3
|
+
# entry point required by consumers of the gem.
|
|
4
|
+
#
|
|
5
|
+
# @example
|
|
6
|
+
# require 'omniauth-ldap'
|
|
7
|
+
# OmniAuth::LDAP::VERSION # => "2.3.2"
|
|
8
|
+
|
|
9
|
+
require "version_gem"
|
|
10
|
+
|
|
11
|
+
require_relative "ldap/version"
|
|
12
|
+
require_relative "ldap/auth_sanitizer"
|
|
13
|
+
require_relative "ldap/adaptor"
|
|
14
|
+
require_relative "strategies/ldap"
|
|
15
|
+
|
|
16
|
+
OmniAuth::LDAP::Version.class_eval do
|
|
17
|
+
extend VersionGem::Basic
|
|
18
|
+
end
|
|
@@ -91,18 +91,22 @@ module OmniAuth
|
|
|
91
91
|
option :port, 389
|
|
92
92
|
option :method, :plain
|
|
93
93
|
option :disable_verify_certificates, false
|
|
94
|
-
option :ca_file, nil
|
|
95
|
-
option :ssl_version, nil # use OpenSSL default if nil
|
|
96
94
|
option :uid, "sAMAccountName"
|
|
97
95
|
option :name_proc, lambda { |n| n }
|
|
98
96
|
|
|
99
97
|
# Trusted header SSO support (disabled by default)
|
|
100
|
-
# :header_auth - when true and the header is present, the strategy trusts
|
|
101
|
-
# and searches the directory for the user without
|
|
102
|
-
#
|
|
103
|
-
#
|
|
98
|
+
# :header_auth - when true and the configured header/env key is present, the strategy trusts
|
|
99
|
+
# the upstream gateway and searches the directory for the user without
|
|
100
|
+
# requiring a user password.
|
|
101
|
+
# :header_name - which header/env key to read (default: "REMOTE_USER").
|
|
102
|
+
# :header_auth_source - :env trusts only server-set env variables. :http_header trusts only
|
|
103
|
+
# Rack HTTP header keys, and should only be used behind a proxy that
|
|
104
|
+
# strips client-supplied copies of the header.
|
|
105
|
+
# :header_auth_require_tls - require a TLS request for header auth.
|
|
104
106
|
option :header_auth, false
|
|
105
107
|
option :header_name, "REMOTE_USER"
|
|
108
|
+
option :header_auth_source, :env
|
|
109
|
+
option :header_auth_require_tls, true
|
|
106
110
|
|
|
107
111
|
# Optional timeouts (forwarded to Net::LDAP when supported)
|
|
108
112
|
option :connect_timeout, nil
|
|
@@ -124,6 +128,8 @@ module OmniAuth
|
|
|
124
128
|
return Rack::Response.new("", 404, {"Content-Type" => "text/plain"}).finish
|
|
125
129
|
end
|
|
126
130
|
|
|
131
|
+
validate_header_auth_configuration!
|
|
132
|
+
|
|
127
133
|
# Fast-path: if a trusted identity header is present, skip the login form
|
|
128
134
|
# and jump to the callback where we will complete using directory lookup.
|
|
129
135
|
if header_username
|
|
@@ -163,6 +169,8 @@ module OmniAuth
|
|
|
163
169
|
|
|
164
170
|
return fail!(:invalid_request_method) unless valid_request_method?
|
|
165
171
|
|
|
172
|
+
validate_header_auth_configuration!
|
|
173
|
+
|
|
166
174
|
# Header-based SSO (REMOTE_USER-style) path
|
|
167
175
|
if (hu = header_username)
|
|
168
176
|
begin
|
|
@@ -311,24 +319,62 @@ module OmniAuth
|
|
|
311
319
|
@env["action_dispatch.request.request_parameters"] || request.params
|
|
312
320
|
end
|
|
313
321
|
|
|
314
|
-
# Extract a normalized username from a trusted header when enabled.
|
|
322
|
+
# Extract a normalized username from a trusted header/env key when enabled.
|
|
315
323
|
# Returns nil when not configured or not present.
|
|
316
324
|
#
|
|
317
|
-
# The
|
|
318
|
-
#
|
|
325
|
+
# The source is intentionally explicit: :env reads the raw env key
|
|
326
|
+
# (e.g. "REMOTE_USER"), while :http_header reads the Rack HTTP_ variant
|
|
327
|
+
# (e.g. "HTTP_REMOTE_USER" or "HTTP_X_REMOTE_USER").
|
|
319
328
|
#
|
|
320
329
|
# @return [String, nil] normalized username or nil if not present
|
|
321
330
|
def header_username
|
|
322
331
|
return unless options[:header_auth]
|
|
323
332
|
|
|
324
|
-
|
|
325
|
-
# Try both the raw env var (e.g., REMOTE_USER) and the Rack HTTP_ variant (e.g., HTTP_REMOTE_USER or HTTP_X_REMOTE_USER)
|
|
326
|
-
raw = request.env[name] || request.env["HTTP_#{name.upcase.tr("-", "_")}"]
|
|
333
|
+
raw = request.env[header_auth_env_key]
|
|
327
334
|
return if raw.nil? || raw.to_s.strip.empty?
|
|
328
335
|
|
|
329
336
|
options[:name_proc].call(raw.to_s)
|
|
330
337
|
end
|
|
331
338
|
|
|
339
|
+
# Validate trusted header auth before reading the configured identity key.
|
|
340
|
+
#
|
|
341
|
+
# @raise [ArgumentError] when the header auth options are unsafe or invalid
|
|
342
|
+
# @return [void]
|
|
343
|
+
def validate_header_auth_configuration!
|
|
344
|
+
return unless options[:header_auth]
|
|
345
|
+
|
|
346
|
+
log_header_auth_warning
|
|
347
|
+
|
|
348
|
+
source = (options[:header_auth_source] || :env).to_sym
|
|
349
|
+
unless [:env, :http_header].include?(source)
|
|
350
|
+
raise ArgumentError, "header_auth_source must be :env or :http_header"
|
|
351
|
+
end
|
|
352
|
+
|
|
353
|
+
if options[:header_auth_require_tls] && !request.ssl?
|
|
354
|
+
raise ArgumentError, "header_auth requires TLS unless header_auth_require_tls is disabled"
|
|
355
|
+
end
|
|
356
|
+
end
|
|
357
|
+
|
|
358
|
+
# Rack env key selected by the explicit header auth source option.
|
|
359
|
+
#
|
|
360
|
+
# @return [String]
|
|
361
|
+
def header_auth_env_key
|
|
362
|
+
name = options[:header_name] || "REMOTE_USER"
|
|
363
|
+
return name if (options[:header_auth_source] || :env).to_sym == :env
|
|
364
|
+
|
|
365
|
+
"HTTP_#{name.upcase.tr("-", "_")}"
|
|
366
|
+
end
|
|
367
|
+
|
|
368
|
+
# Warn operators that trusted header auth delegates authentication to the upstream gateway.
|
|
369
|
+
#
|
|
370
|
+
# @return [void]
|
|
371
|
+
def log_header_auth_warning
|
|
372
|
+
logger = OmniAuth.config.respond_to?(:logger) ? OmniAuth.config.logger : nil
|
|
373
|
+
return unless logger && logger.respond_to?(:warn)
|
|
374
|
+
|
|
375
|
+
logger.warn("[omniauth-ldap] SECURITY WARNING: header_auth is enabled. This trusts upstream authentication completely; only enable it behind a trusted proxy that strips client-supplied identity headers.")
|
|
376
|
+
end
|
|
377
|
+
|
|
332
378
|
# Perform a directory lookup for the given username using the strategy configuration
|
|
333
379
|
# (bind_dn/password or anonymous). Does not attempt to bind as the user.
|
|
334
380
|
#
|
data/lib/omniauth-ldap.rb
CHANGED
|
@@ -1,17 +1,2 @@
|
|
|
1
|
-
#
|
|
2
|
-
|
|
3
|
-
# entry point required by consumers of the gem.
|
|
4
|
-
#
|
|
5
|
-
# @example
|
|
6
|
-
# require 'omniauth-ldap'
|
|
7
|
-
# OmniAuth::LDAP::VERSION # => "2.3.2"
|
|
8
|
-
|
|
9
|
-
require "version_gem"
|
|
10
|
-
|
|
11
|
-
require "omniauth-ldap/version"
|
|
12
|
-
require "omniauth-ldap/adaptor"
|
|
13
|
-
require "omniauth/strategies/ldap"
|
|
14
|
-
|
|
15
|
-
OmniAuth::LDAP::Version.class_eval do
|
|
16
|
-
extend VersionGem::Basic
|
|
17
|
-
end
|
|
1
|
+
# Compatibility shim
|
|
2
|
+
require "omniauth/ldap"
|
|
File without changes
|
|
File without changes
|
|
@@ -22,6 +22,12 @@ module OmniAuth
|
|
|
22
22
|
# Extract username from a trusted header when enabled
|
|
23
23
|
def header_username: () -> (String | nil)
|
|
24
24
|
|
|
25
|
+
def validate_header_auth_configuration!: () -> void
|
|
26
|
+
|
|
27
|
+
def header_auth_env_key: () -> String
|
|
28
|
+
|
|
29
|
+
def log_header_auth_warning: () -> void
|
|
30
|
+
|
|
25
31
|
# Perform a directory lookup for a given username; returns an Entry or nil
|
|
26
32
|
def directory_lookup: (OmniAuth::LDAP::Adaptor, String) -> untyped
|
|
27
33
|
|
data/sig/omniauth-ldap.rbs
CHANGED
|
File without changes
|
data/sig/rbs/net-ldap.rbs
CHANGED
|
File without changes
|
data/sig/rbs/net-ntlm.rbs
CHANGED
|
File without changes
|
data/sig/rbs/sasl.rbs
CHANGED
|
File without changes
|
data.tar.gz.sig
CHANGED
|
Binary file
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: omniauth-ldap
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version:
|
|
4
|
+
version: 3.0.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Peter Boling
|
|
@@ -39,6 +39,26 @@ cert_chain:
|
|
|
39
39
|
-----END CERTIFICATE-----
|
|
40
40
|
date: 1980-01-02 00:00:00.000000000 Z
|
|
41
41
|
dependencies:
|
|
42
|
+
- !ruby/object:Gem::Dependency
|
|
43
|
+
name: auth-sanitizer
|
|
44
|
+
requirement: !ruby/object:Gem::Requirement
|
|
45
|
+
requirements:
|
|
46
|
+
- - "~>"
|
|
47
|
+
- !ruby/object:Gem::Version
|
|
48
|
+
version: '0.1'
|
|
49
|
+
- - ">="
|
|
50
|
+
- !ruby/object:Gem::Version
|
|
51
|
+
version: 0.1.4
|
|
52
|
+
type: :runtime
|
|
53
|
+
prerelease: false
|
|
54
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
55
|
+
requirements:
|
|
56
|
+
- - "~>"
|
|
57
|
+
- !ruby/object:Gem::Version
|
|
58
|
+
version: '0.1'
|
|
59
|
+
- - ">="
|
|
60
|
+
- !ruby/object:Gem::Version
|
|
61
|
+
version: 0.1.4
|
|
42
62
|
- !ruby/object:Gem::Dependency
|
|
43
63
|
name: net-ldap
|
|
44
64
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -350,7 +370,6 @@ extra_rdoc_files:
|
|
|
350
370
|
- FUNDING.md
|
|
351
371
|
- LICENSE.txt
|
|
352
372
|
- README.md
|
|
353
|
-
- REEK
|
|
354
373
|
- RUBOCOP.md
|
|
355
374
|
- SECURITY.md
|
|
356
375
|
files:
|
|
@@ -361,12 +380,13 @@ files:
|
|
|
361
380
|
- FUNDING.md
|
|
362
381
|
- LICENSE.txt
|
|
363
382
|
- README.md
|
|
364
|
-
- REEK
|
|
365
383
|
- RUBOCOP.md
|
|
366
384
|
- SECURITY.md
|
|
367
385
|
- lib/omniauth-ldap.rb
|
|
368
|
-
- lib/omniauth
|
|
369
|
-
- lib/omniauth
|
|
386
|
+
- lib/omniauth/ldap.rb
|
|
387
|
+
- lib/omniauth/ldap/adaptor.rb
|
|
388
|
+
- lib/omniauth/ldap/auth_sanitizer.rb
|
|
389
|
+
- lib/omniauth/ldap/version.rb
|
|
370
390
|
- lib/omniauth/strategies/ldap.rb
|
|
371
391
|
- sig/omniauth-ldap.rbs
|
|
372
392
|
- sig/omniauth/ldap/adaptor.rbs
|
|
@@ -380,10 +400,10 @@ licenses:
|
|
|
380
400
|
- MIT
|
|
381
401
|
metadata:
|
|
382
402
|
homepage_uri: https://omniauth-ldap.galtzo.com/
|
|
383
|
-
source_code_uri: https://github.com/omniauth/omniauth-ldap/tree/
|
|
384
|
-
changelog_uri: https://github.com/omniauth/omniauth-ldap/blob/
|
|
403
|
+
source_code_uri: https://github.com/omniauth/omniauth-ldap/tree/v3.0.0
|
|
404
|
+
changelog_uri: https://github.com/omniauth/omniauth-ldap/blob/v3.0.0/CHANGELOG.md
|
|
385
405
|
bug_tracker_uri: https://github.com/omniauth/omniauth-ldap/issues
|
|
386
|
-
documentation_uri: https://www.rubydoc.info/gems/omniauth-ldap/
|
|
406
|
+
documentation_uri: https://www.rubydoc.info/gems/omniauth-ldap/3.0.0
|
|
387
407
|
funding_uri: https://github.com/sponsors/pboling
|
|
388
408
|
wiki_uri: https://github.com/omniauth/omniauth-ldap/wiki
|
|
389
409
|
news_uri: https://www.railsbling.com/tags/omniauth-ldap
|
|
@@ -405,14 +425,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
405
425
|
requirements:
|
|
406
426
|
- - ">="
|
|
407
427
|
- !ruby/object:Gem::Version
|
|
408
|
-
version:
|
|
428
|
+
version: 2.2.0
|
|
409
429
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
410
430
|
requirements:
|
|
411
431
|
- - ">="
|
|
412
432
|
- !ruby/object:Gem::Version
|
|
413
433
|
version: '0'
|
|
414
434
|
requirements: []
|
|
415
|
-
rubygems_version:
|
|
435
|
+
rubygems_version: 4.0.11
|
|
416
436
|
specification_version: 4
|
|
417
437
|
summary: "\U0001F4C1 LDAP strategy for OmniAuth."
|
|
418
438
|
test_files: []
|
metadata.gz.sig
CHANGED
|
Binary file
|
data/REEK
DELETED
|
File without changes
|