omniauth-ldap 2.3.4 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cfb42b529db19042a0140d9bdb39698b177710df48bc80eb9c1470bfebda0ae2
-  data.tar.gz: 411ba1e8817fc5814c248cbf096471ebe2f4a013a69dff3b6771143526a73f8b
+  metadata.gz: db8f14110058b0d3298f67c22cb05dcea355d72943478bdd8d9b363f346541bc
+  data.tar.gz: dda80d2d043153246fe334d57eb73059e5f8586046b7631bae1ef81682778dc5
 SHA512:
-  metadata.gz: e5cd173bb9dd917627ba9d96d3fe3a5e713bb74e3623d8ab1247fe71da0243e0e66658f64dd356247e060fbddda4a9031e76242dd8b0ea0575d9233bfcee1b0d
-  data.tar.gz: 70d8dd160e9793037bb4564cde716dfc8cd98c3805b73c65f49c5ecd2383b13c920828affab59e458b224b8f1eebfd4a127d9bd06a55d967e1d397f21f01a1da
+  metadata.gz: 75c450a755a8846071d7ebae48672f3a46bb0c6ebf36e6a37c82750b1a0fa35fe9b22484c0803bfbc029b3a00490447baa4f63a53d55d47d8afb8d62e028e80b
+  data.tar.gz: b24afe0b3fd3025482662d6f34f2a5dfbfea87e59647d1c76ebc32928273c8984cd4f3c98464bed712afd4fa04683980927e4c0effbbf55ef19191c6656df75d

data/CHANGELOG.md

@@ -32,6 +32,27 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.0] - 2026-05-21
+
+- TAG: [v3.0.0][3.0.0t]
+- COVERAGE: 97.52% -- 315/323 lines in 6 files
+- BRANCH COVERAGE: 79.41% -- 108/136 branches in 6 files
+- 94.59% documented
+
+### Added
+
+- Add `auth-sanitizer` runtime dependency to redact sensitive LDAP adaptor inspection output without defining top-level `Auth` or `AuthSanitizer`
+
+### Changed
+
+- Minimum supported Ruby version is now 2.2.0
+
+### Removed
+
+- Remove deprecated (since `v2.1.0-gl` in 2018) top-level `:ca_file` and `:ssl_version` LDAP configuration options; use `:tls_options` instead
+- Remove adaptor backward-compatibility that translated top-level `:ca_file` and `:ssl_version` into TLS options
+- Remove deprecated direct-option specs for top-level `:ca_file` and `:ssl_version`
+
 ## [2.3.4] - 2026-05-18
 
 - TAG: [v2.3.4][2.3.4t]
@@ -265,7 +286,9 @@ Please file a bug if you notice a violation of semantic versioning.
 [1.0.0]: https://github.com/omniauth/omniauth-ldap/compare/5656da80d4193e0d0584f44bac493a87695e580f...v1.0.0
 [1.0.0t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v1.0.0
 
-[Unreleased]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.4...HEAD
+[Unreleased]: https://github.com/omniauth/omniauth-ldap/compare/v3.0.0...HEAD
+[3.0.0]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.4...v3.0.0
+[3.0.0t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v3.0.0
 [2.3.4]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.3...v2.3.4
 [2.3.4t]: https://github.com/omniauth/omniauth-ldap/releases/tag/v2.3.4
 [2.3.3]: https://github.com/omniauth/omniauth-ldap/compare/v2.3.2...v2.3.3

data/README.md

@@ -9,7 +9,7 @@
 
 # 📁 OmniAuth LDAP
 
-[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![Open Source Helpers][👽oss-helpi]][👽oss-help] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
+[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
 
 `if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][🖼️galtzo-discord], as I may have missed the [discord notification][🖼️galtzo-discord].
 
@@ -112,7 +112,7 @@ Note: Net::LDAP historically defaulted to no certificate validation when `tls_op
 | Works with JRuby        | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]                                                                                                          |
 | Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf]                                                                                                                                                            |
 | Works with MRI Ruby 3   | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]                                                                                         |
-| Works with MRI Ruby 2   | ![Ruby 2.0 Compat][💎ruby-2.0i] ![Ruby 2.1 Compat][💎ruby-2.1i] ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                              |
+| Works with MRI Ruby 2   | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                              |
 | Support & Community     | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]                                       |
 | Source                  | [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc]                                                                                                                                                                                                                                                               |
 | Documentation           | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki]                                                                                                                                     |
@@ -123,7 +123,7 @@ Note: Net::LDAP historically defaulted to no certificate validation when `tls_op
 
 ### Compatibility
 
-Compatible with MRI Ruby 2.0+, and concordant releases of JRuby, and TruffleRuby.
+Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
 
 | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚             |
 |------------------------------------------------|--------------------------------------------------------|
@@ -896,8 +896,6 @@ Thanks for RTFM. ☺️
 [📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
 [👽dl-rank]: https://bestgems.org/gems/omniauth-ldap
 [👽dl-ranki]: https://img.shields.io/gem/rd/omniauth-ldap.svg
-[👽oss-help]: https://www.codetriage.com/omniauth/omniauth-ldap
-[👽oss-helpi]: https://www.codetriage.com/omniauth/omniauth-ldap/badges/users.svg
 [👽version]: https://bestgems.org/gems/omniauth-ldap
 [👽versioni]: https://img.shields.io/gem/v/omniauth-ldap.svg
 [🏀codecov]: https://codecov.io/gh/omniauth/omniauth-ldap
@@ -981,7 +979,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.312-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.323-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/{omniauth-ldap → omniauth/ldap}/adaptor.rb

@@ -21,6 +21,10 @@ module OmniAuth
     #
     # @note Public API: {validate}, {initialize}, {bind_as}, and attr readers such as {connection}, {uid}
     class Adaptor
+      include OmniAuth::LDAP::AUTH_SANITIZER::FilteredAttributes
+
+      filtered_attributes :@auth, :@configuration, :@connection, :@password, :@tls_options
+
       # Generic adaptor error super-class
       # @see Error classes that inherit from this class
       class LdapError < StandardError; end
@@ -59,11 +63,7 @@ module OmniAuth
         # Timeouts
         :connect_timeout,
         :read_timeout,
-
-        # Deprecated
         :method,
-        :ca_file,
-        :ssl_version,
       ]
 
       # Required configuration keys. This may include alternatives as sub-lists
@@ -297,7 +297,7 @@ module OmniAuth
         ENCRYPTION_METHOD[normalized_method]
       end
 
-      # Build TLS options including backward-compatibility for deprecated keys.
+      # Build TLS options from explicit :tls_options configuration.
       #
       # @param translated_method [Symbol] the normalized encryption method
       # @return [Hash] a hash suitable for passing as :tls_options
@@ -314,10 +314,6 @@ module OmniAuth
           options.merge!(configured_options)
         end
 
-        # Retain backward compatibility until deprecated configs are removed.
-        options[:ca_file] = @ca_file if @ca_file
-        options[:ssl_version] = @ssl_version if @ssl_version
-
         options
       end
 

data/lib/omniauth/ldap/auth_sanitizer.rb

@@ -0,0 +1,38 @@
+module OmniAuth
+  module LDAP
+    # See: Zero Top-Level Namespace Additions
+    #      https://github.com/ruby-oauth/auth-sanitizer/blob/main/README.md#zero-top-level-namespace-additions
+    AUTH_SANITIZER = begin
+      auth_sanitizer_requirement = Gem::Requirement.new("~> 0.1", ">= 0.1.4")
+      auth_sanitizer_spec = Gem.loaded_specs["auth-sanitizer"]
+      unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sanitizer_spec.version)
+        # :nocov:
+        auth_sanitizer_spec = Gem::Specification.find_by_name("auth-sanitizer", auth_sanitizer_requirement)
+        # :nocov:
+      end
+
+      auth_sanitizer_loader_path = File.join(
+        auth_sanitizer_spec.full_gem_path,
+        "lib/auth_sanitizer/loader.rb",
+      )
+      unless File.file?(auth_sanitizer_loader_path)
+        # :nocov:
+        raise LoadError, "omniauth-ldap requires auth-sanitizer #{auth_sanitizer_requirement}; " \
+          "loader not found at #{auth_sanitizer_loader_path}"
+        # :nocov:
+      end
+
+      auth_sanitizer_loader_namespace = Module.new
+      auth_sanitizer_loader_namespace.module_eval(
+        File.read(auth_sanitizer_loader_path),
+        auth_sanitizer_loader_path,
+        1,
+      )
+
+      auth_sanitizer_loader_namespace
+        .const_get(:AuthSanitizer)
+        .const_get(:Loader)
+        .load_isolated
+    end
+  end
+end

data/lib/{omniauth-ldap → omniauth/ldap}/version.rb

@@ -8,7 +8,7 @@ module OmniAuth
     module Version
       # Public semantic version for the gem
       # @return [String]
-      VERSION = "2.3.4"
+      VERSION = "3.0.0"
     end
     # Convenience constant for consumers that expect OmniAuth::LDAP::VERSION
     # @return [String]

data/lib/omniauth/ldap.rb

@@ -0,0 +1,18 @@
+# Integrate the VersionGem helper into the OmniAuth::LDAP::Version module
+# to expose common version-related helper methods. This file is the public
+# entry point required by consumers of the gem.
+#
+# @example
+#   require 'omniauth-ldap'
+#   OmniAuth::LDAP::VERSION # => "2.3.2"
+
+require "version_gem"
+
+require_relative "ldap/version"
+require_relative "ldap/auth_sanitizer"
+require_relative "ldap/adaptor"
+require_relative "strategies/ldap"
+
+OmniAuth::LDAP::Version.class_eval do
+  extend VersionGem::Basic
+end

data/lib/omniauth/strategies/ldap.rb

@@ -91,8 +91,6 @@ module OmniAuth
       option :port, 389
       option :method, :plain
       option :disable_verify_certificates, false
-      option :ca_file, nil
-      option :ssl_version, nil # use OpenSSL default if nil
       option :uid, "sAMAccountName"
       option :name_proc, lambda { |n| n }
 

data/lib/omniauth-ldap.rb

@@ -1,17 +1,2 @@
-# Integrate the VersionGem helper into the OmniAuth::LDAP::Version module
-# to expose common version-related helper methods. This file is the public
-# entry point required by consumers of the gem.
-#
-# @example
-#   require 'omniauth-ldap'
-#   OmniAuth::LDAP::VERSION # => "2.3.2"
-
-require "version_gem"
-
-require "omniauth-ldap/version"
-require "omniauth-ldap/adaptor"
-require "omniauth/strategies/ldap"
-
-OmniAuth::LDAP::Version.class_eval do
-  extend VersionGem::Basic
-end
+# Compatibility shim
+require "omniauth/ldap"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-ldap
 version: !ruby/object:Gem::Version
-  version: 2.3.4
+  version: 3.0.0
 platform: ruby
 authors:
 - Peter Boling
@@ -39,6 +39,26 @@ cert_chain:
   -----END CERTIFICATE-----
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: auth-sanitizer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
 - !ruby/object:Gem::Dependency
   name: net-ldap
   requirement: !ruby/object:Gem::Requirement
@@ -350,7 +370,6 @@ extra_rdoc_files:
 - FUNDING.md
 - LICENSE.txt
 - README.md
-- REEK
 - RUBOCOP.md
 - SECURITY.md
 files:
@@ -361,12 +380,13 @@ files:
 - FUNDING.md
 - LICENSE.txt
 - README.md
-- REEK
 - RUBOCOP.md
 - SECURITY.md
 - lib/omniauth-ldap.rb
-- lib/omniauth-ldap/adaptor.rb
-- lib/omniauth-ldap/version.rb
+- lib/omniauth/ldap.rb
+- lib/omniauth/ldap/adaptor.rb
+- lib/omniauth/ldap/auth_sanitizer.rb
+- lib/omniauth/ldap/version.rb
 - lib/omniauth/strategies/ldap.rb
 - sig/omniauth-ldap.rbs
 - sig/omniauth/ldap/adaptor.rbs
@@ -380,10 +400,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://omniauth-ldap.galtzo.com/
-  source_code_uri: https://github.com/omniauth/omniauth-ldap/tree/v2.3.4
-  changelog_uri: https://github.com/omniauth/omniauth-ldap/blob/v2.3.4/CHANGELOG.md
+  source_code_uri: https://github.com/omniauth/omniauth-ldap/tree/v3.0.0
+  changelog_uri: https://github.com/omniauth/omniauth-ldap/blob/v3.0.0/CHANGELOG.md
   bug_tracker_uri: https://github.com/omniauth/omniauth-ldap/issues
-  documentation_uri: https://www.rubydoc.info/gems/omniauth-ldap/2.3.4
+  documentation_uri: https://www.rubydoc.info/gems/omniauth-ldap/3.0.0
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/omniauth/omniauth-ldap/wiki
   news_uri: https://www.railsbling.com/tags/omniauth-ldap
@@ -405,7 +425,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.0'
+      version: 2.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="