omniauth-ldap 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/{pkg/omniauth-ldap-1.0.0.rc1.gem → omniauth-ldap-1.0.0.rc1.gem} +0 -0
- data/{pkg/omniauth-ldap-1.0.0.rc2.gem → omniauth-ldap-1.0.0.rc2.gem} +0 -0
- metadata +97 -103
- data/.gitignore +0 -2
- data/.rspec +0 -1
- data/Gemfile +0 -11
- data/Gemfile.lock +0 -79
- data/Guardfile +0 -11
- data/README.md +0 -68
- data/Rakefile +0 -9
- data/lib/omniauth-ldap.rb +0 -4
- data/lib/omniauth-ldap/adaptor.rb +0 -158
- data/lib/omniauth-ldap/version.rb +0 -5
- data/lib/omniauth/strategies/ldap.rb +0 -90
- data/omniauth-ldap.gemspec +0 -27
- data/spec/omniauth/strategies/ldap_spec.rb +0 -104
- data/spec/spec_helper.rb +0 -14
|
File without changes
|
|
File without changes
|
metadata
CHANGED
|
@@ -1,162 +1,156 @@
|
|
|
1
|
-
--- !ruby/object:Gem::Specification
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: omniauth-ldap
|
|
3
|
-
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.0.0
|
|
3
|
+
version: !ruby/object:Gem::Version
|
|
5
4
|
prerelease:
|
|
5
|
+
version: 1.0.1
|
|
6
6
|
platform: ruby
|
|
7
|
-
authors:
|
|
7
|
+
authors:
|
|
8
8
|
- Ping Yu
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
12
|
+
|
|
13
|
+
date: 2011-11-02 00:00:00 -05:00
|
|
14
|
+
default_executable:
|
|
15
|
+
dependencies:
|
|
16
|
+
- !ruby/object:Gem::Dependency
|
|
15
17
|
name: omniauth
|
|
16
|
-
|
|
18
|
+
prerelease: false
|
|
19
|
+
requirement: &id001 !ruby/object:Gem::Requirement
|
|
17
20
|
none: false
|
|
18
|
-
requirements:
|
|
21
|
+
requirements:
|
|
19
22
|
- - ~>
|
|
20
|
-
- !ruby/object:Gem::Version
|
|
21
|
-
version:
|
|
23
|
+
- !ruby/object:Gem::Version
|
|
24
|
+
version: "1.0"
|
|
22
25
|
type: :runtime
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
- !ruby/object:Gem::Dependency
|
|
26
|
+
version_requirements: *id001
|
|
27
|
+
- !ruby/object:Gem::Dependency
|
|
26
28
|
name: net-ldap
|
|
27
|
-
|
|
29
|
+
prerelease: false
|
|
30
|
+
requirement: &id002 !ruby/object:Gem::Requirement
|
|
28
31
|
none: false
|
|
29
|
-
requirements:
|
|
32
|
+
requirements:
|
|
30
33
|
- - ~>
|
|
31
|
-
- !ruby/object:Gem::Version
|
|
34
|
+
- !ruby/object:Gem::Version
|
|
32
35
|
version: 0.2.2
|
|
33
36
|
type: :runtime
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
- !ruby/object:Gem::Dependency
|
|
37
|
+
version_requirements: *id002
|
|
38
|
+
- !ruby/object:Gem::Dependency
|
|
37
39
|
name: pyu-ruby-sasl
|
|
38
|
-
|
|
40
|
+
prerelease: false
|
|
41
|
+
requirement: &id003 !ruby/object:Gem::Requirement
|
|
39
42
|
none: false
|
|
40
|
-
requirements:
|
|
43
|
+
requirements:
|
|
41
44
|
- - ~>
|
|
42
|
-
- !ruby/object:Gem::Version
|
|
45
|
+
- !ruby/object:Gem::Version
|
|
43
46
|
version: 0.0.3.1
|
|
44
47
|
type: :runtime
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
- !ruby/object:Gem::Dependency
|
|
48
|
+
version_requirements: *id003
|
|
49
|
+
- !ruby/object:Gem::Dependency
|
|
48
50
|
name: rubyntlm
|
|
49
|
-
|
|
51
|
+
prerelease: false
|
|
52
|
+
requirement: &id004 !ruby/object:Gem::Requirement
|
|
50
53
|
none: false
|
|
51
|
-
requirements:
|
|
54
|
+
requirements:
|
|
52
55
|
- - ~>
|
|
53
|
-
- !ruby/object:Gem::Version
|
|
56
|
+
- !ruby/object:Gem::Version
|
|
54
57
|
version: 0.1.1
|
|
55
58
|
type: :runtime
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
- !ruby/object:Gem::Dependency
|
|
59
|
+
version_requirements: *id004
|
|
60
|
+
- !ruby/object:Gem::Dependency
|
|
59
61
|
name: rspec
|
|
60
|
-
|
|
62
|
+
prerelease: false
|
|
63
|
+
requirement: &id005 !ruby/object:Gem::Requirement
|
|
61
64
|
none: false
|
|
62
|
-
requirements:
|
|
65
|
+
requirements:
|
|
63
66
|
- - ~>
|
|
64
|
-
- !ruby/object:Gem::Version
|
|
65
|
-
version:
|
|
67
|
+
- !ruby/object:Gem::Version
|
|
68
|
+
version: "2.7"
|
|
66
69
|
type: :development
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
- !ruby/object:Gem::Dependency
|
|
70
|
+
version_requirements: *id005
|
|
71
|
+
- !ruby/object:Gem::Dependency
|
|
70
72
|
name: simplecov
|
|
71
|
-
|
|
73
|
+
prerelease: false
|
|
74
|
+
requirement: &id006 !ruby/object:Gem::Requirement
|
|
72
75
|
none: false
|
|
73
|
-
requirements:
|
|
74
|
-
- -
|
|
75
|
-
- !ruby/object:Gem::Version
|
|
76
|
-
version:
|
|
76
|
+
requirements:
|
|
77
|
+
- - ">="
|
|
78
|
+
- !ruby/object:Gem::Version
|
|
79
|
+
version: "0"
|
|
77
80
|
type: :development
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
- !ruby/object:Gem::Dependency
|
|
81
|
+
version_requirements: *id006
|
|
82
|
+
- !ruby/object:Gem::Dependency
|
|
81
83
|
name: rack-test
|
|
82
|
-
|
|
84
|
+
prerelease: false
|
|
85
|
+
requirement: &id007 !ruby/object:Gem::Requirement
|
|
83
86
|
none: false
|
|
84
|
-
requirements:
|
|
85
|
-
- -
|
|
86
|
-
- !ruby/object:Gem::Version
|
|
87
|
-
version:
|
|
87
|
+
requirements:
|
|
88
|
+
- - ">="
|
|
89
|
+
- !ruby/object:Gem::Version
|
|
90
|
+
version: "0"
|
|
88
91
|
type: :development
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
- !ruby/object:Gem::Dependency
|
|
92
|
+
version_requirements: *id007
|
|
93
|
+
- !ruby/object:Gem::Dependency
|
|
92
94
|
name: libnotify
|
|
93
|
-
|
|
95
|
+
prerelease: false
|
|
96
|
+
requirement: &id008 !ruby/object:Gem::Requirement
|
|
94
97
|
none: false
|
|
95
|
-
requirements:
|
|
96
|
-
- -
|
|
97
|
-
- !ruby/object:Gem::Version
|
|
98
|
-
version:
|
|
98
|
+
requirements:
|
|
99
|
+
- - ">="
|
|
100
|
+
- !ruby/object:Gem::Version
|
|
101
|
+
version: "0"
|
|
99
102
|
type: :development
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
- !ruby/object:Gem::Dependency
|
|
103
|
+
version_requirements: *id008
|
|
104
|
+
- !ruby/object:Gem::Dependency
|
|
103
105
|
name: ruby-debug19
|
|
104
|
-
|
|
106
|
+
prerelease: false
|
|
107
|
+
requirement: &id009 !ruby/object:Gem::Requirement
|
|
105
108
|
none: false
|
|
106
|
-
requirements:
|
|
107
|
-
- -
|
|
108
|
-
- !ruby/object:Gem::Version
|
|
109
|
-
version:
|
|
109
|
+
requirements:
|
|
110
|
+
- - ">="
|
|
111
|
+
- !ruby/object:Gem::Version
|
|
112
|
+
version: "0"
|
|
110
113
|
type: :development
|
|
111
|
-
|
|
112
|
-
version_requirements: *70103539399000
|
|
114
|
+
version_requirements: *id009
|
|
113
115
|
description: A LDAP strategy for OmniAuth.
|
|
114
|
-
email:
|
|
116
|
+
email:
|
|
115
117
|
- ping@intridea.com
|
|
116
118
|
executables: []
|
|
119
|
+
|
|
117
120
|
extensions: []
|
|
121
|
+
|
|
118
122
|
extra_rdoc_files: []
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
- .
|
|
122
|
-
-
|
|
123
|
-
|
|
124
|
-
- Guardfile
|
|
125
|
-
- README.md
|
|
126
|
-
- Rakefile
|
|
127
|
-
- lib/omniauth-ldap.rb
|
|
128
|
-
- lib/omniauth-ldap/adaptor.rb
|
|
129
|
-
- lib/omniauth-ldap/version.rb
|
|
130
|
-
- lib/omniauth/strategies/ldap.rb
|
|
131
|
-
- omniauth-ldap.gemspec
|
|
132
|
-
- pkg/omniauth-ldap-1.0.0.rc1.gem
|
|
133
|
-
- pkg/omniauth-ldap-1.0.0.rc2.gem
|
|
134
|
-
- spec/omniauth/strategies/ldap_spec.rb
|
|
135
|
-
- spec/spec_helper.rb
|
|
123
|
+
|
|
124
|
+
files:
|
|
125
|
+
- omniauth-ldap-1.0.0.rc1.gem
|
|
126
|
+
- omniauth-ldap-1.0.0.rc2.gem
|
|
127
|
+
has_rdoc: true
|
|
136
128
|
homepage: https://github.com/intridea/omniauth-ldap
|
|
137
129
|
licenses: []
|
|
130
|
+
|
|
138
131
|
post_install_message:
|
|
139
132
|
rdoc_options: []
|
|
140
|
-
|
|
133
|
+
|
|
134
|
+
require_paths:
|
|
141
135
|
- lib
|
|
142
|
-
required_ruby_version: !ruby/object:Gem::Requirement
|
|
136
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
|
143
137
|
none: false
|
|
144
|
-
requirements:
|
|
145
|
-
- -
|
|
146
|
-
- !ruby/object:Gem::Version
|
|
147
|
-
version:
|
|
148
|
-
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
138
|
+
requirements:
|
|
139
|
+
- - ">="
|
|
140
|
+
- !ruby/object:Gem::Version
|
|
141
|
+
version: "0"
|
|
142
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
149
143
|
none: false
|
|
150
|
-
requirements:
|
|
151
|
-
- -
|
|
152
|
-
- !ruby/object:Gem::Version
|
|
153
|
-
version:
|
|
144
|
+
requirements:
|
|
145
|
+
- - ">="
|
|
146
|
+
- !ruby/object:Gem::Version
|
|
147
|
+
version: "0"
|
|
154
148
|
requirements: []
|
|
149
|
+
|
|
155
150
|
rubyforge_project:
|
|
156
|
-
rubygems_version: 1.
|
|
151
|
+
rubygems_version: 1.6.2
|
|
157
152
|
signing_key:
|
|
158
153
|
specification_version: 3
|
|
159
154
|
summary: A LDAP strategy for OmniAuth.
|
|
160
|
-
test_files:
|
|
161
|
-
|
|
162
|
-
- spec/spec_helper.rb
|
|
155
|
+
test_files: []
|
|
156
|
+
|
data/.gitignore
DELETED
data/.rspec
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
--colour
|
data/Gemfile
DELETED
data/Gemfile.lock
DELETED
|
@@ -1,79 +0,0 @@
|
|
|
1
|
-
PATH
|
|
2
|
-
remote: .
|
|
3
|
-
specs:
|
|
4
|
-
omniauth-ldap (1.0.0.beta1)
|
|
5
|
-
net-ldap (~> 0.2.2)
|
|
6
|
-
omniauth (~> 1.0.0.beta1)
|
|
7
|
-
pyu-ruby-sasl (~> 0.0.3.1)
|
|
8
|
-
rubyntlm (~> 0.1.1)
|
|
9
|
-
|
|
10
|
-
GEM
|
|
11
|
-
remote: http://rubygems.org/
|
|
12
|
-
specs:
|
|
13
|
-
archive-tar-minitar (0.5.2)
|
|
14
|
-
columnize (0.3.4)
|
|
15
|
-
diff-lcs (1.1.3)
|
|
16
|
-
ffi (1.0.9)
|
|
17
|
-
growl (1.0.3)
|
|
18
|
-
guard (0.8.8)
|
|
19
|
-
thor (~> 0.14.6)
|
|
20
|
-
guard-bundler (0.1.3)
|
|
21
|
-
bundler (>= 1.0.0)
|
|
22
|
-
guard (>= 0.2.2)
|
|
23
|
-
guard-rspec (0.5.0)
|
|
24
|
-
guard (>= 0.8.4)
|
|
25
|
-
hashie (1.2.0)
|
|
26
|
-
libnotify (0.5.7)
|
|
27
|
-
ffi (= 1.0.9)
|
|
28
|
-
linecache19 (0.5.12)
|
|
29
|
-
ruby_core_source (>= 0.1.4)
|
|
30
|
-
multi_json (1.0.3)
|
|
31
|
-
net-ldap (0.2.2)
|
|
32
|
-
omniauth (1.0.0.beta1)
|
|
33
|
-
hashie
|
|
34
|
-
rack
|
|
35
|
-
pyu-ruby-sasl (0.0.3.3)
|
|
36
|
-
rack (1.3.5)
|
|
37
|
-
rack-test (0.6.1)
|
|
38
|
-
rack (>= 1.0)
|
|
39
|
-
rb-fsevent (0.4.3.1)
|
|
40
|
-
rspec (2.7.0)
|
|
41
|
-
rspec-core (~> 2.7.0)
|
|
42
|
-
rspec-expectations (~> 2.7.0)
|
|
43
|
-
rspec-mocks (~> 2.7.0)
|
|
44
|
-
rspec-core (2.7.1)
|
|
45
|
-
rspec-expectations (2.7.0)
|
|
46
|
-
diff-lcs (~> 1.1.2)
|
|
47
|
-
rspec-mocks (2.7.0)
|
|
48
|
-
ruby-debug-base19 (0.11.25)
|
|
49
|
-
columnize (>= 0.3.1)
|
|
50
|
-
linecache19 (>= 0.5.11)
|
|
51
|
-
ruby_core_source (>= 0.1.4)
|
|
52
|
-
ruby-debug19 (0.11.6)
|
|
53
|
-
columnize (>= 0.3.1)
|
|
54
|
-
linecache19 (>= 0.5.11)
|
|
55
|
-
ruby-debug-base19 (>= 0.11.19)
|
|
56
|
-
ruby_core_source (0.1.5)
|
|
57
|
-
archive-tar-minitar (>= 0.5.2)
|
|
58
|
-
rubyntlm (0.1.1)
|
|
59
|
-
simplecov (0.5.4)
|
|
60
|
-
multi_json (~> 1.0.3)
|
|
61
|
-
simplecov-html (~> 0.5.3)
|
|
62
|
-
simplecov-html (0.5.3)
|
|
63
|
-
thor (0.14.6)
|
|
64
|
-
|
|
65
|
-
PLATFORMS
|
|
66
|
-
ruby
|
|
67
|
-
|
|
68
|
-
DEPENDENCIES
|
|
69
|
-
growl
|
|
70
|
-
guard
|
|
71
|
-
guard-bundler
|
|
72
|
-
guard-rspec
|
|
73
|
-
libnotify
|
|
74
|
-
omniauth-ldap!
|
|
75
|
-
rack-test
|
|
76
|
-
rb-fsevent
|
|
77
|
-
rspec (~> 2.6)
|
|
78
|
-
ruby-debug19
|
|
79
|
-
simplecov
|
data/Guardfile
DELETED
data/README.md
DELETED
|
@@ -1,68 +0,0 @@
|
|
|
1
|
-
# OmniAuth LDAP
|
|
2
|
-
|
|
3
|
-
**Note:** This gem is designed to work with the in-beta OmniAuth 1.0
|
|
4
|
-
library. It will not be officially released on RubyGems.org until
|
|
5
|
-
OmniAuth 1.0 is released.
|
|
6
|
-
|
|
7
|
-
== LDAP
|
|
8
|
-
|
|
9
|
-
Use the LDAP strategy as a middleware in your application:
|
|
10
|
-
|
|
11
|
-
use OmniAuth::Strategies::LDAP,
|
|
12
|
-
:title => "My LDAP",
|
|
13
|
-
:host => '10.101.10.1',
|
|
14
|
-
:port => 389,
|
|
15
|
-
:method => :plain,
|
|
16
|
-
:base => 'dc=intridea, dc=com',
|
|
17
|
-
:uid => 'sAMAccountName',
|
|
18
|
-
:name_proc => Proc.new {|name| name.gsub(/@.*$/,'')}
|
|
19
|
-
:bind_dn => 'default_bind_dn'
|
|
20
|
-
:password => 'password'
|
|
21
|
-
|
|
22
|
-
All of the listed options are required, with the exception of :name_proc, :bind_dn, and :password.
|
|
23
|
-
Allowed values of :method are: :plain, :ssl, :tls.
|
|
24
|
-
|
|
25
|
-
:bind_dn and :password is the default credentials to perform user lookup.
|
|
26
|
-
most LDAP servers require that you supply a complete DN as a binding-credential, along with an authenticator
|
|
27
|
-
such as a password. But for many applications, you often don’t have a full DN to identify the user.
|
|
28
|
-
You usually get a simple identifier like a username or an email address, along with a password.
|
|
29
|
-
Since many LDAP servers don't allow anonymous access, search function will require a bound connection,
|
|
30
|
-
:bind_dn and :password will be required for searching on the username or email to retrieve the DN attribute
|
|
31
|
-
for the user. If the LDAP server allows anonymous access, you don't need to provide these two parameters.
|
|
32
|
-
|
|
33
|
-
:uid is the LDAP attribute name for the user name in the login form.
|
|
34
|
-
typically AD would be 'sAMAccountName' or 'UserPrincipalName', while OpenLDAP is 'uid'.
|
|
35
|
-
|
|
36
|
-
:name_proc allows you to match the user name entered with the format of the :uid attributes.
|
|
37
|
-
For example, value of 'sAMAccountName' in AD contains only the windows user name. If your user prefers using
|
|
38
|
-
email to login, a name_proc as above will trim the email string down to just the windows login name.
|
|
39
|
-
In summary, use :name_proc to fill the gap between the submitted username and LDAP uid attribute value.
|
|
40
|
-
|
|
41
|
-
:try_sasl and :sasl_mechanisms are optional. :try_sasl [true | false], :sasl_mechanisms ['DIGEST-MD5' | 'GSS-SPNEGO']
|
|
42
|
-
Use them to initialize a SASL connection to server. If you are not familiar with these authentication methods,
|
|
43
|
-
please just avoid them.
|
|
44
|
-
|
|
45
|
-
Direct users to '/auth/ldap' to have them authenticated via your company's LDAP server.
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
## License
|
|
49
|
-
|
|
50
|
-
Copyright (C) 2011 by Ping Yu and Intridea, Inc.
|
|
51
|
-
|
|
52
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
53
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
54
|
-
in the Software without restriction, including without limitation the rights
|
|
55
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
56
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
57
|
-
furnished to do so, subject to the following conditions:
|
|
58
|
-
|
|
59
|
-
The above copyright notice and this permission notice shall be included in
|
|
60
|
-
all copies or substantial portions of the Software.
|
|
61
|
-
|
|
62
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
63
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
64
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
65
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
66
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
67
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
68
|
-
THE SOFTWARE.
|
data/Rakefile
DELETED
data/lib/omniauth-ldap.rb
DELETED
|
@@ -1,158 +0,0 @@
|
|
|
1
|
-
#this code borrowed pieces from activeldap and net-ldap
|
|
2
|
-
|
|
3
|
-
require 'rack'
|
|
4
|
-
require 'net/ldap'
|
|
5
|
-
require 'net/ntlm'
|
|
6
|
-
require 'uri'
|
|
7
|
-
|
|
8
|
-
module OmniAuth
|
|
9
|
-
module LDAP
|
|
10
|
-
class Adaptor
|
|
11
|
-
class LdapError < StandardError; end
|
|
12
|
-
class ConfigurationError < StandardError; end
|
|
13
|
-
class AuthenticationError < StandardError; end
|
|
14
|
-
class ConnectionError < StandardError; end
|
|
15
|
-
|
|
16
|
-
VALID_ADAPTER_CONFIGURATION_KEYS = [:host, :port, :method, :bind_dn, :password, :try_sasl, :sasl_mechanisms, :uid, :base, :allow_anonymous]
|
|
17
|
-
|
|
18
|
-
MUST_HAVE_KEYS = [:host, :port, :method, :uid, :base]
|
|
19
|
-
|
|
20
|
-
METHOD = {
|
|
21
|
-
:ssl => :simple_tls,
|
|
22
|
-
:tls => :start_tls,
|
|
23
|
-
:plain => nil,
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
attr_accessor :bind_dn, :password
|
|
27
|
-
attr_reader :connection, :uid, :base
|
|
28
|
-
|
|
29
|
-
def initialize(configuration={})
|
|
30
|
-
@disconnected = false
|
|
31
|
-
@bound = false
|
|
32
|
-
@configuration = configuration.dup
|
|
33
|
-
@configuration[:allow_anonymous] ||= false
|
|
34
|
-
@logger = @configuration.delete(:logger)
|
|
35
|
-
message = []
|
|
36
|
-
MUST_HAVE_KEYS.each do |name|
|
|
37
|
-
message << name if configuration[name].nil?
|
|
38
|
-
end
|
|
39
|
-
raise ArgumentError.new(message.join(",") +" MUST be provided") unless message.empty?
|
|
40
|
-
VALID_ADAPTER_CONFIGURATION_KEYS.each do |name|
|
|
41
|
-
instance_variable_set("@#{name}", configuration[name])
|
|
42
|
-
end
|
|
43
|
-
|
|
44
|
-
method = ensure_method(@method)
|
|
45
|
-
config = {
|
|
46
|
-
:host => @host,
|
|
47
|
-
:port => @port,
|
|
48
|
-
:encryption => method
|
|
49
|
-
}
|
|
50
|
-
@uri = construct_uri(@host, @port, @method != :plain)
|
|
51
|
-
|
|
52
|
-
@bind_method = @try_sasl ? "sasl" : @allow_anonymous ? 'anonymous' : 'simple'
|
|
53
|
-
@bind_method = 'anonymous' unless @bind_dn && @password
|
|
54
|
-
|
|
55
|
-
@auth = sasl_auths.first if @bind_method == 'sasl'
|
|
56
|
-
@bind_method = 'simple' unless @auth
|
|
57
|
-
@auth ||= { :method => @bind_method,
|
|
58
|
-
:username => @bind_dn,
|
|
59
|
-
:password => @passowrd
|
|
60
|
-
}
|
|
61
|
-
config[:auth] = @auth
|
|
62
|
-
@connection = Net::LDAP.new(config)
|
|
63
|
-
end
|
|
64
|
-
|
|
65
|
-
#:base => "dc=yourcompany, dc=com",
|
|
66
|
-
# :filter => "(mail=#{user})",
|
|
67
|
-
# :password => psw
|
|
68
|
-
def bind_as(args = {})
|
|
69
|
-
result = false
|
|
70
|
-
@connection.open { |me|
|
|
71
|
-
rs = search args
|
|
72
|
-
if rs and rs.first and dn = rs.first.dn
|
|
73
|
-
password = args[:password]
|
|
74
|
-
method = args[:method]
|
|
75
|
-
password = password.call if password.respond_to?(:call)
|
|
76
|
-
if method == 'sasl'
|
|
77
|
-
result = rs if bind(sasl_auths(args))
|
|
78
|
-
else
|
|
79
|
-
result = rs if bind(:method => :simple, :username => dn,
|
|
80
|
-
:password => password)
|
|
81
|
-
end
|
|
82
|
-
end
|
|
83
|
-
}
|
|
84
|
-
result
|
|
85
|
-
end
|
|
86
|
-
|
|
87
|
-
private
|
|
88
|
-
|
|
89
|
-
def ensure_port(method)
|
|
90
|
-
if method == :ssl
|
|
91
|
-
URI::LDAPS::DEFAULT_PORT
|
|
92
|
-
else
|
|
93
|
-
URI::LDAP::DEFAULT_PORT
|
|
94
|
-
end
|
|
95
|
-
end
|
|
96
|
-
|
|
97
|
-
def ensure_method(method)
|
|
98
|
-
method ||= "plain"
|
|
99
|
-
normalized_method = method.to_s.downcase.to_sym
|
|
100
|
-
return METHOD[normalized_method] if METHOD.has_key?(normalized_method)
|
|
101
|
-
|
|
102
|
-
available_methods = METHOD.keys.collect {|m| m.inspect}.join(", ")
|
|
103
|
-
format = "%s is not one of the available connect methods: %s"
|
|
104
|
-
raise ConfigurationError, format % [method.inspect, available_methods]
|
|
105
|
-
end
|
|
106
|
-
|
|
107
|
-
def sasl_auths(options={})
|
|
108
|
-
auths = []
|
|
109
|
-
sasl_mechanisms = options[:sasl_mechanisms] || @sasl_mechanisms
|
|
110
|
-
sasl_mechanisms.each do |mechanism|
|
|
111
|
-
normalized_mechanism = mechanism.downcase.gsub(/-/, '_')
|
|
112
|
-
sasl_bind_setup = "sasl_bind_setup_#{normalized_mechanism}"
|
|
113
|
-
next unless respond_to?(sasl_bind_setup, true)
|
|
114
|
-
initial_credential, challenge_response = send(sasl_bind_setup, options)
|
|
115
|
-
|
|
116
|
-
auths << {
|
|
117
|
-
:method => :sasl,
|
|
118
|
-
:initial_credential => initial_credential,
|
|
119
|
-
:mechanism => mechanism,
|
|
120
|
-
:challenge_response => challenge_response,
|
|
121
|
-
}
|
|
122
|
-
end
|
|
123
|
-
end
|
|
124
|
-
|
|
125
|
-
def sasl_bind_setup_digest_md5(options)
|
|
126
|
-
bind_dn = options[:username]
|
|
127
|
-
initial_credential = ""
|
|
128
|
-
challenge_response = Proc.new do |cred|
|
|
129
|
-
pref = SASL::Preferences.new :digest_uri => "ldap/#{@host}", :username => bind_dn, :has_password? => true, :password => options[:password]||@password
|
|
130
|
-
sasl = SASL.new("DIGEST-MD5", pref)
|
|
131
|
-
response = sasl.receive("challenge", cred)
|
|
132
|
-
response[1]
|
|
133
|
-
end
|
|
134
|
-
[initial_credential, challenge_response]
|
|
135
|
-
end
|
|
136
|
-
|
|
137
|
-
def sasl_bind_setup_gss_spnego(options)
|
|
138
|
-
bind_dn = options[:username]
|
|
139
|
-
psw = [bind_dn, options[:password]||@password]
|
|
140
|
-
raise LdapError.new( "invalid binding information" ) unless (bind_dn && psw)
|
|
141
|
-
|
|
142
|
-
nego = proc {|challenge|
|
|
143
|
-
t2_msg = Net::NTLM::Message.parse( challenge )
|
|
144
|
-
bind_dn, domain = bind_dn.split('\\').reverse
|
|
145
|
-
t2_msg.target_name = Net::NTLM::encode_utf16le(domain) if domain
|
|
146
|
-
t3_msg = t2_msg.response( {:user => bind_dn, :password => psw}, {:ntlmv2 => true} )
|
|
147
|
-
t3_msg.serialize
|
|
148
|
-
}
|
|
149
|
-
[Net::NTLM::Message::Type1.new.serialize, nego]
|
|
150
|
-
end
|
|
151
|
-
|
|
152
|
-
def construct_uri(host, port, ssl)
|
|
153
|
-
protocol = ssl ? "ldaps" : "ldap"
|
|
154
|
-
URI.parse("#{protocol}://#{host}:#{port}").to_s
|
|
155
|
-
end
|
|
156
|
-
end
|
|
157
|
-
end
|
|
158
|
-
end
|
|
@@ -1,90 +0,0 @@
|
|
|
1
|
-
require 'omniauth'
|
|
2
|
-
require 'ruby-debug'
|
|
3
|
-
|
|
4
|
-
module OmniAuth
|
|
5
|
-
module Strategies
|
|
6
|
-
class LDAP
|
|
7
|
-
class MissingCredentialsError < StandardError; end
|
|
8
|
-
include OmniAuth::Strategy
|
|
9
|
-
@@config = {
|
|
10
|
-
'name' => 'cn',
|
|
11
|
-
'first_name' => 'givenName',
|
|
12
|
-
'last_name' => 'sn',
|
|
13
|
-
'email' => ['mail', "email", 'userPrincipalName'],
|
|
14
|
-
'phone' => ['telephoneNumber', 'homePhone', 'facsimileTelephoneNumber'],
|
|
15
|
-
'mobile' => ['mobile', 'mobileTelephoneNumber'],
|
|
16
|
-
'nickname' => ['uid', 'userid', 'sAMAccountName'],
|
|
17
|
-
'title' => 'title',
|
|
18
|
-
'location' => {"%0, %1, %2, %3 %4" => [['address', 'postalAddress', 'homePostalAddress', 'street', 'streetAddress'], ['l'], ['st'],['co'],['postOfficeBox']]},
|
|
19
|
-
'uid' => 'dn',
|
|
20
|
-
'url' => ['wwwhomepage'],
|
|
21
|
-
'image' => 'jpegPhoto',
|
|
22
|
-
'description' => 'description'
|
|
23
|
-
}
|
|
24
|
-
option :title, "LDAP Authentication" #default title for authentication form
|
|
25
|
-
option :port, 389
|
|
26
|
-
option :method, :plain
|
|
27
|
-
option :uid, 'sAMAccountName'
|
|
28
|
-
option :name_proc, lambda {|n| n}
|
|
29
|
-
def initialize(app, *args, &block)
|
|
30
|
-
super
|
|
31
|
-
@adaptor = OmniAuth::LDAP::Adaptor.new @options
|
|
32
|
-
end
|
|
33
|
-
def request_phase
|
|
34
|
-
f = OmniAuth::Form.new(:title => (options[:title] || "LDAP Authentication"), :url => callback_path)
|
|
35
|
-
f.text_field 'Login', 'username'
|
|
36
|
-
f.password_field 'Password', 'password'
|
|
37
|
-
f.button "Sign In"
|
|
38
|
-
f.to_response
|
|
39
|
-
end
|
|
40
|
-
|
|
41
|
-
def callback_phase
|
|
42
|
-
raise MissingCredentialsError.new("Missing login credentials") if request['username'].nil? || request['password'].nil?
|
|
43
|
-
begin
|
|
44
|
-
creds = {'username' => request['username'], 'password' => request['password']}
|
|
45
|
-
@ldap_user_info = @adaptor.bind_as(:filter => Net::LDAP::Filter.eq(@adaptor.uid, @options.name_proc.call(creds['username'])),:size => 1)
|
|
46
|
-
return fail!(:invalid_credentials) if !@ldap_user_info
|
|
47
|
-
|
|
48
|
-
@user_info = self.class.map_user(@@config, @ldap_user_info)
|
|
49
|
-
super
|
|
50
|
-
rescue Exception => e
|
|
51
|
-
return fail!(:ldap_error, e)
|
|
52
|
-
end
|
|
53
|
-
end
|
|
54
|
-
|
|
55
|
-
uid {
|
|
56
|
-
@user_info["uid"]
|
|
57
|
-
}
|
|
58
|
-
info {
|
|
59
|
-
@user_info
|
|
60
|
-
}
|
|
61
|
-
extra {
|
|
62
|
-
@ldap_user_info
|
|
63
|
-
}
|
|
64
|
-
|
|
65
|
-
def self.map_user(mapper, object)
|
|
66
|
-
user = {}
|
|
67
|
-
mapper.each do |key, value|
|
|
68
|
-
case value
|
|
69
|
-
when String
|
|
70
|
-
user[key] = object[value.downcase.to_sym].to_s if object[value.downcase.to_sym]
|
|
71
|
-
when Array
|
|
72
|
-
value.each {|v| (user[key] = object[v.downcase.to_sym].to_s; break;) if object[v.downcase.to_sym]}
|
|
73
|
-
when Hash
|
|
74
|
-
value.map do |key1, value1|
|
|
75
|
-
pattern = key1.dup
|
|
76
|
-
value1.each_with_index do |v,i|
|
|
77
|
-
part = ''; v.collect(&:downcase).collect(&:to_sym).each {|v1| (part = object[v1].to_s; break;) if object[v1]}
|
|
78
|
-
pattern.gsub!("%#{i}",part||'')
|
|
79
|
-
end
|
|
80
|
-
user[key] = pattern
|
|
81
|
-
end
|
|
82
|
-
end
|
|
83
|
-
end
|
|
84
|
-
user
|
|
85
|
-
end
|
|
86
|
-
end
|
|
87
|
-
end
|
|
88
|
-
end
|
|
89
|
-
|
|
90
|
-
OmniAuth.config.add_camelization 'ldap', 'LDAP'
|
data/omniauth-ldap.gemspec
DELETED
|
@@ -1,27 +0,0 @@
|
|
|
1
|
-
# -*- encoding: utf-8 -*-
|
|
2
|
-
require File.expand_path('../lib/omniauth-ldap/version', __FILE__)
|
|
3
|
-
|
|
4
|
-
Gem::Specification.new do |gem|
|
|
5
|
-
gem.authors = ["Ping Yu"]
|
|
6
|
-
gem.email = ["ping@intridea.com"]
|
|
7
|
-
gem.description = %q{A LDAP strategy for OmniAuth.}
|
|
8
|
-
gem.summary = %q{A LDAP strategy for OmniAuth.}
|
|
9
|
-
gem.homepage = "https://github.com/intridea/omniauth-ldap"
|
|
10
|
-
|
|
11
|
-
gem.add_runtime_dependency 'omniauth', '~> 1.0'
|
|
12
|
-
gem.add_runtime_dependency 'net-ldap', '~> 0.2.2'
|
|
13
|
-
gem.add_runtime_dependency 'pyu-ruby-sasl', '~> 0.0.3.1'
|
|
14
|
-
gem.add_runtime_dependency 'rubyntlm', '~> 0.1.1'
|
|
15
|
-
gem.add_development_dependency 'rspec', '~> 2.7'
|
|
16
|
-
gem.add_development_dependency 'simplecov'
|
|
17
|
-
gem.add_development_dependency 'rack-test'
|
|
18
|
-
gem.add_development_dependency 'libnotify'
|
|
19
|
-
gem.add_development_dependency 'ruby-debug19'
|
|
20
|
-
|
|
21
|
-
gem.executables = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
|
|
22
|
-
gem.files = `git ls-files`.split("\n")
|
|
23
|
-
gem.test_files = `git ls-files -- {test,spec,features}/*`.split("\n")
|
|
24
|
-
gem.name = "omniauth-ldap"
|
|
25
|
-
gem.require_paths = ["lib"]
|
|
26
|
-
gem.version = OmniAuth::LDAP::VERSION
|
|
27
|
-
end
|
|
@@ -1,104 +0,0 @@
|
|
|
1
|
-
require 'spec_helper'
|
|
2
|
-
describe "OmniAuth::Strategies::LDAP" do
|
|
3
|
-
# :title => "My LDAP",
|
|
4
|
-
# :host => '10.101.10.1',
|
|
5
|
-
# :port => 389,
|
|
6
|
-
# :method => :plain,
|
|
7
|
-
# :base => 'dc=intridea, dc=com',
|
|
8
|
-
# :uid => 'sAMAccountName',
|
|
9
|
-
# :name_proc => Proc.new {|name| name.gsub(/@.*$/,'')}
|
|
10
|
-
# :bind_dn => 'default_bind_dn'
|
|
11
|
-
# :password => 'password'
|
|
12
|
-
class MyLdapProvider < OmniAuth::Strategies::LDAP; end
|
|
13
|
-
def app
|
|
14
|
-
Rack::Builder.new {
|
|
15
|
-
use OmniAuth::Test::PhonySession
|
|
16
|
-
use MyLdapProvider, :name => 'ldap', :title => 'MyLdap Form', :host => '192.168.1.145', :base => 'dc=score, dc=local', :name_proc => Proc.new {|name| name.gsub(/@.*$/,'')}
|
|
17
|
-
run lambda { |env| [404, {'Content-Type' => 'text/plain'}, [env.key?('omniauth.auth').to_s]] }
|
|
18
|
-
}.to_app
|
|
19
|
-
end
|
|
20
|
-
|
|
21
|
-
def session
|
|
22
|
-
last_request.env['rack.session']
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
it 'should add a camelization for itself' do
|
|
26
|
-
OmniAuth::Utils.camelize('ldap').should == 'LDAP'
|
|
27
|
-
end
|
|
28
|
-
|
|
29
|
-
describe '/auth/ldap' do
|
|
30
|
-
before(:each){ get '/auth/ldap' }
|
|
31
|
-
|
|
32
|
-
it 'should display a form' do
|
|
33
|
-
last_response.status.should == 200
|
|
34
|
-
last_response.body.should be_include("<form")
|
|
35
|
-
end
|
|
36
|
-
|
|
37
|
-
it 'should have the callback as the action for the form' do
|
|
38
|
-
last_response.body.should be_include("action='/auth/ldap/callback'")
|
|
39
|
-
end
|
|
40
|
-
|
|
41
|
-
it 'should have a text field for each of the fields' do
|
|
42
|
-
last_response.body.scan('<input').size.should == 2
|
|
43
|
-
end
|
|
44
|
-
it 'should have a label of the form title' do
|
|
45
|
-
last_response.body.scan('MyLdap Form').size.should > 1
|
|
46
|
-
end
|
|
47
|
-
|
|
48
|
-
end
|
|
49
|
-
|
|
50
|
-
describe 'post /auth/ldap/callback' do
|
|
51
|
-
before(:each) do
|
|
52
|
-
@adaptor = mock(OmniAuth::LDAP::Adaptor, {:uid => 'ping'})
|
|
53
|
-
OmniAuth::LDAP::Adaptor.stub(:new).and_return(@adaptor)
|
|
54
|
-
end
|
|
55
|
-
context 'failure' do
|
|
56
|
-
before(:each) do
|
|
57
|
-
@adaptor.stub(:bind_as).and_return(false)
|
|
58
|
-
end
|
|
59
|
-
it 'should raise MissingCredentialsError' do
|
|
60
|
-
lambda{post('/auth/ldap/callback', {})}.should raise_error OmniAuth::Strategies::LDAP::MissingCredentialsError
|
|
61
|
-
end
|
|
62
|
-
it 'should redirect to error page' do
|
|
63
|
-
post('/auth/ldap/callback', {:username => 'ping', :password => 'password'})
|
|
64
|
-
last_response.should be_redirect
|
|
65
|
-
last_response.headers['Location'].should =~ %r{invalid_credentials}
|
|
66
|
-
end
|
|
67
|
-
it 'should redirect to error page when there is exception' do
|
|
68
|
-
@adaptor.stub(:bind_as).and_throw(Exception.new('connection_error'))
|
|
69
|
-
post('/auth/ldap/callback', {:username => 'ping', :password => 'password'})
|
|
70
|
-
last_response.should be_redirect
|
|
71
|
-
last_response.headers['Location'].should =~ %r{ldap_error}
|
|
72
|
-
end
|
|
73
|
-
end
|
|
74
|
-
|
|
75
|
-
context 'success' do
|
|
76
|
-
let(:auth_hash){ last_request.env['omniauth.auth'] }
|
|
77
|
-
before(:each) do
|
|
78
|
-
@adaptor.stub(:bind_as).and_return({:dn => 'cn=ping, dc=intridea, dc=com', :mail => 'ping@intridea.com', :givenname => 'Ping', :sn => 'Yu',
|
|
79
|
-
:telephonenumber => '555-555-5555', :mobile => '444-444-4444', :uid => 'ping', :title => 'dev', :address => 'k street',
|
|
80
|
-
:l => 'Washington', :st => 'DC', :co => "U.S.A", :postofficebox => '20001', :wwwhomepage => 'www.intridea.com',
|
|
81
|
-
:jpegphoto => 'http://www.intridea.com/ping.jpg', :description => 'omniauth-ldap'})
|
|
82
|
-
post('/auth/ldap/callback', {:username => 'ping', :password => 'password'})
|
|
83
|
-
end
|
|
84
|
-
|
|
85
|
-
it 'should raise MissingCredentialsError' do
|
|
86
|
-
should_not raise_error OmniAuth::Strategies::LDAP::MissingCredentialsError
|
|
87
|
-
end
|
|
88
|
-
it 'should map user info' do
|
|
89
|
-
auth_hash.uid.should == 'cn=ping, dc=intridea, dc=com'
|
|
90
|
-
auth_hash.info.email.should == 'ping@intridea.com'
|
|
91
|
-
auth_hash.info.first_name.should == 'Ping'
|
|
92
|
-
auth_hash.info.last_name.should == 'Yu'
|
|
93
|
-
auth_hash.info.phone.should == '555-555-5555'
|
|
94
|
-
auth_hash.info.mobile.should == '444-444-4444'
|
|
95
|
-
auth_hash.info.nickname.should == 'ping'
|
|
96
|
-
auth_hash.info.title.should == 'dev'
|
|
97
|
-
auth_hash.info.location.should == 'k street, Washington, DC, U.S.A 20001'
|
|
98
|
-
auth_hash.info.url.should == 'www.intridea.com'
|
|
99
|
-
auth_hash.info.image.should == 'http://www.intridea.com/ping.jpg'
|
|
100
|
-
auth_hash.info.description.should == 'omniauth-ldap'
|
|
101
|
-
end
|
|
102
|
-
end
|
|
103
|
-
end
|
|
104
|
-
end
|
data/spec/spec_helper.rb
DELETED
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
$:.unshift File.expand_path('..', __FILE__)
|
|
2
|
-
$:.unshift File.expand_path('../../lib', __FILE__)
|
|
3
|
-
require 'simplecov'
|
|
4
|
-
SimpleCov.start
|
|
5
|
-
require 'rspec'
|
|
6
|
-
require 'rack/test'
|
|
7
|
-
require 'omniauth'
|
|
8
|
-
require 'omniauth-ldap'
|
|
9
|
-
|
|
10
|
-
RSpec.configure do |config|
|
|
11
|
-
config.include Rack::Test::Methods
|
|
12
|
-
config.extend OmniAuth::Test::StrategyMacros, :type => :strategy
|
|
13
|
-
end
|
|
14
|
-
|