pg-ldap-sync 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3630b9ed2307ae5d629896016d302f8ccfee7e324ca963b2ba6dfe1cee612351
-  data.tar.gz: f2065307ea2d61d6e2498e604c3d2105248380a27039601808be6b24579ef586
+  metadata.gz: 62fea7bb7d0ed64a4ccb20bae815fd3f5412fb5d594d5a5aa54c8062da2ec401
+  data.tar.gz: db9d4ff658763c76efc0bcf7d6713b02476d2902df9c2a9ee42de77172bf8b7c
 SHA512:
-  metadata.gz: 449792e68c3cf512209e42231b134fec4a090bb873473e4db844eb50a3f9be87cd23c07676bd80ffbf604774f6a72d1d7b508cee13d8f703577c19a4312d9975
-  data.tar.gz: 2bbe1be11834f35b361dc0a255cd8e02323aa2f000940efcec6e695bfa5e2653ff940c883cd6264462afda36d8125913ac012c7e89d760440345d67cd48bddd5
+  metadata.gz: b56eafdd8955a818d78d65e34916109255b64ff8b0c48d1c6c5ab4d3b6588c0221166dfd5428f36332ea20aede3b22f8fa52122aaaaf3493dd802a56a07c0504
+  data.tar.gz: eb4216d46013a6dd84189ed7ffa913e2cf635bd5ea57a33137f930c5731fe5f8712abe50a0b68a5e55936a427a4a57497630412f99bc53f3ade352acf53b6a13

data/.github/workflows/ci.yml

@@ -1,6 +1,18 @@
 name: CI
 
-on: [push, pull_request]
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 1 2 * *" # At 01:00 on the second day of each month - https://crontab.guru/#0_1_2_*_*
+  push:
+    branches:
+      - master
+    tags:
+      - "*.*.*"
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - "*"
 
 jobs:
   job_test_gem:
@@ -11,23 +23,23 @@ jobs:
         include:
           - os: windows
             ruby: "head"
-            PGVERSION: 15.1-1-windows-x64
-            PGVER: "15"
+            PGVERSION: 17.0-1-windows-x64
+            PGVER: "17"
           - os: windows
             ruby: "2.4"
             PGVERSION: 9.4.26-1-windows-x64
             PGVER: "9.4"
           - os: ubuntu
             ruby: "head"
-            PGVER: "15"
+            PGVER: "17"
           - os: ubuntu
             os_ver: "20.04"
             ruby: "2.3"
             PGVER: "9.3"
           - os: macos
             ruby: "head"
-            PGVERSION: 15.1-1-osx
-            PGVER: "15"
+            PGVERSION: 17.0-1-osx
+            PGVER: "17"
 
     runs-on: ${{ matrix.os }}-${{ matrix.os_ver || 'latest' }}
     env:
@@ -73,6 +85,7 @@ jobs:
           wget https://get.enterprisedb.com/postgresql/postgresql-$PGVERSION-binaries.zip && \
           sudo mkdir -p /Library/PostgreSQL && \
           sudo unzip postgresql-$PGVERSION-binaries.zip -d /Library/PostgreSQL/$PGVER && \
+          sudo mv /Library/PostgreSQL/$PGVER/pgsql/* /Library/PostgreSQL/$PGVER/ && \
           echo /Library/PostgreSQL/$PGVER/bin >> $GITHUB_PATH
 
       - run: bundle install

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.5.1 / 2025-03-22
+
+* Add dependent gems for compat with ruby-3.5
+* Add predefined roles for compat with PostgreSQL-16 and 17
+
+
+## 0.5.0 / 2023-08-24
+
+* Add Kerberos and NTLM authentication support to LDAP connection
+* Fix retrieval of groups with over 1500 users in Active Directory server. #45
+
+
 ## 0.4.0 / 2022-12-02
 
 * Support groups with over 1500 users in Active Directory server. #32

data/Gemfile

@@ -5,5 +5,4 @@ gemspec
 
 group :development do
   gem "debug"
-  gem "ruby-ldapserver", git: "https://github.com/larskanis/ruby-ldapserver/"
 end

data/README.md

@@ -20,16 +20,18 @@ It is meant to be started as a cron job.
 
 ## FEATURES:
 
+* User+group creation, deletion and changes in memberships are synchronized from LDAP to PostgreSQL
+* Nested groups/roles supported
 * Configurable per YAML config file
 * Can use Active Directory as LDAP-Server
-* Nested groups/roles supported
 * Set scope of considered users/groups on LDAP and PG side
 * Test mode which doesn't do any changes to the DBMS
 * Both LDAP and PG connections can be secured by SSL/TLS
+* NTLM and Kerberos authentication to LDAP server
 
 ## REQUIREMENTS:
 
-* Ruby-2.0+, JRuby-1.2+
+* Ruby-2.0+
 * LDAP-v3 server
 * PostgreSQL-server v9.0+
 
@@ -70,6 +72,11 @@ Run in modify-mode:
   pg_ldap_sync -c my_config.yaml -vv
 ```
 
+It is recommended to avoid granting permissions to synchronized users on the PostgreSQL server, but to grant permissions to groups instead.
+This is because `DROP USER` statements invoked when a user leaves otherwise fail due to depending objects.
+`DROP GROUP` equally fails if there are depending objects, but groups are typically more stable and removed rarely.
+
+
 ## TEST:
 There is a small test suite in the `test` directory that runs against an internal LDAP server and a PostgreSQL server. Ensure `pg_ctl`, `initdb` and `psql` commands are in the `PATH` like so:
 ```sh

data/appveyor.yml

@@ -1,4 +1,4 @@
-image: Visual Studio 2019
+image: Visual Studio 2022
 
 init:
   - set PATH=C:/Ruby%ruby_version%/bin;c:/Program Files/Git/cmd;c:/Windows/system32;C:/Windows/System32/WindowsPowerShell/v1.0
@@ -21,7 +21,8 @@ test_script:
 
 environment:
   matrix:
+    # ruby-3.3.6 currently fails installing stringio-3.1.5.gem
+    # - ruby_version: "33-x64"
+      # PGVER: 16
     - ruby_version: "27-x64"
-      PGVER: 13
-    - ruby_version: "24"
-      PGVER: 10
+      PGVER: 11

data/config/sample-config.yaml

@@ -5,13 +5,26 @@
 # Connection parameters to LDAP server
 # see also: http://net-ldap.rubyforge.org/Net/LDAP.html#method-c-new
 ldap_connection:
-  host: localhost
+  host: ldapserver
   port: 389
   auth:
     method: :simple
     username: CN=username,OU=!Serviceaccounts,OU=company,DC=company,DC=de
     password: secret
 
+  # or GSSAPI / Kerberos authentication:
+  auth:
+    method: :gssapi
+    hostname: ldapserver.company.de
+    servicename: ldap # optional, defaults to "ldap"
+
+  # or GSS-SPNEGO / NTLM authentication
+  auth:
+    method: :gss_spnego
+    username: 'myuser'
+    password: 'secret'
+    domain: 'company.de' # optional
+
 # Search parameters for LDAP users which should be synchronized
 ldap_users:
   base: OU=company,OU=company,DC=company,DC=de
@@ -51,4 +64,5 @@ pg_groups:
   filter: NOT rolcanlogin AND NOT rolsuper
   # Options for CREATE RULE statements
   create_options: NOLOGIN
+  # Options for GRANT <role> TO <group> statements
   grant_options:

data/config/sample-config2.yaml

@@ -1,9 +1,11 @@
 # With this sample config the distinction between LDAP-synchronized
-# groups/users from is done by the membership to ldap_user and
-# ldap_group. These two roles have to be defined manally before
-# pg_ldap_sync can run:
-#     CREATE GROUP ldap_group;
-#     CREATE USER ldap_user;
+# groups/users from manually created PostgreSQL users is done by the
+# membership in ldap_user and ldap_group.
+# These two roles have to be defined manally before pg_ldap_sync can
+# run and all synchronized users/groups will become member of them
+# later on:
+#     CREATE GROUP ldap_groups;
+#     CREATE USER ldap_users;
 #
 
 # Connection parameters to LDAP server
@@ -63,4 +65,5 @@ pg_groups:
   filter: oid IN (SELECT pam.member FROM pg_auth_members pam JOIN pg_roles pr ON pr.oid=pam.roleid WHERE pr.rolname='ldap_groups')
   # Options for CREATE RULE statements
   create_options: NOLOGIN IN ROLE ldap_groups
+  # Options for GRANT <role> TO <group> statements
   grant_options:

data/lib/pg_ldap_sync/application.rb

@@ -103,7 +103,7 @@ class Application
           array += entry[ranged_attr]
           log.debug "retrieved attribute range #{ranged_attr.inspect} of dn #{entry_dn}"
 
-          if ranged_attr =~ /;range=\d\-\*\z/
+          if ranged_attr =~ /;range=\d+\-\*\z/
             break
           end
 
@@ -168,7 +168,7 @@ class Application
   PgRole = Struct.new :name, :member_names
 
   # List of default roles taken from https://www.postgresql.org/docs/current/predefined-roles.html
-  PG_BUILTIN_ROLES = %w[ pg_read_all_data pg_write_all_data pg_read_all_settings pg_read_all_stats pg_stat_scan_tables pg_monitor pg_database_owner pg_signal_backend pg_read_server_files pg_write_server_files pg_execute_server_program pg_checkpoint]
+  PG_BUILTIN_ROLES = %w[ pg_read_all_data pg_write_all_data pg_read_all_settings pg_read_all_stats pg_stat_scan_tables pg_monitor pg_database_owner pg_signal_backend pg_read_server_files pg_write_server_files pg_execute_server_program pg_checkpoint pg_create_subscription pg_maintain pg_use_reserved_connections ]
 
   def search_pg_users
     pg_users_conf = @config[:pg_users]
@@ -361,8 +361,26 @@ class Application
   def start!
     read_config_file(@config_fname)
 
+    ldap_conf = @config[:ldap_connection]
+    auth_meth = ldap_conf.dig(:auth, :method).to_s
+    if auth_meth == "gssapi"
+      begin
+        require 'net/ldap/auth_adapter/gssapi'
+      rescue LoadError => err
+        raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-auth_adapter-gssapi"
+      end
+    elsif auth_meth == "gss_spnego"
+      begin
+        require 'net-ldap-gss-spnego'
+        # This doesn't work since this file is defined in net-ldap as a placeholder:
+        #   require 'net/ldap/auth_adapter/gss_spnego'
+      rescue LoadError => err
+        raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-gss-spnego"
+      end
+    end
+
     # gather LDAP users and groups
-    @ldap = Net::LDAP.new @config[:ldap_connection]
+    @ldap = Net::LDAP.new ldap_conf
     ldap_users = uniq_names search_ldap_users
     ldap_groups = uniq_names search_ldap_groups
 

data/lib/pg_ldap_sync/compat.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
 
 class Hash
+  # transform_keys was added in ruby-2.5
   def transform_keys
     map do |k, v|
       [yield(k), v]

data/lib/pg_ldap_sync/version.rb

@@ -1,3 +1,3 @@
 module PgLdapSync
-  VERSION = "0.4.0"
+  VERSION = "0.5.1"
 end

data/pg-ldap-sync.gemspec

@@ -24,7 +24,10 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency "net-ldap", "~> 0.16"
   spec.add_runtime_dependency "kwalify", "~> 0.7"
   spec.add_runtime_dependency "pg", ">= 0.14", "< 2.0"
-  spec.add_development_dependency "ruby-ldapserver", "~> 0.3"
+  spec.add_runtime_dependency "logger", "~> 1.0"
+  spec.add_runtime_dependency "ostruct", "~> 0.1" # workaround missing dependency in net-ldap-0.19.0
+  spec.add_runtime_dependency "base64", "~> 0.1" # workaround missing dependency in net-ldap-0.19.0
+  spec.add_development_dependency "ruby-ldapserver", "~> 0.7"
   spec.add_development_dependency "minitest", "~> 5.0"
   spec.add_development_dependency "bundler", ">= 1.16", "< 3.0"
   spec.add_development_dependency "rake", "~> 13.0"

data.tar.gz.sig

@@ -1,4 +1 @@
-j�"�gj�y�1D�FDb�:떙uqWg�
�a�1�?5FE�{�{E�_��Ld��+*���:�]��\h�W��{�?��
-�8_���v���-))Z�x7�T_���X�^���c��&���V��Ѿ�dM�E��c��a�ⰨZ��bL��Ȓ@�
-�n�r8	_@��BR���[^�zP���6�����&|��QF~=%+�C���q
-��غ�Գ.<FG=}��q�1�?�EE��
+�����J�1� ���}q�R�6�!����[F'
�uӪ��_nw�n�ӽw�N�S��.�V

metadata

@@ -1,18 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: pg-ldap-sync
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Lars Kanis
-autorequire:
 bindir: exe
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
-  MIIETTCCArWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQDDB1sYXJz
-  L0RDPWdyZWl6LXJlaW5zZG9yZi9EQz1kZTAeFw0yMjAyMTQxMzMwNTZaFw0yMzAy
-  MTQxMzMwNTZaMCgxJjAkBgNVBAMMHWxhcnMvREM9Z3JlaXotcmVpbnNkb3JmL0RD
+  MIIEBDCCAmygAwIBAgIBAzANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQDDB1sYXJz
+  L0RDPWdyZWl6LXJlaW5zZG9yZi9EQz1kZTAeFw0yNDEyMjkxOTU2NTZaFw0yNTEy
+  MjkxOTU2NTZaMCgxJjAkBgNVBAMMHWxhcnMvREM9Z3JlaXotcmVpbnNkb3JmL0RD
   PWRlMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAwum6Y1KznfpzXOT/
   mZgJTBbxZuuZF49Fq3K0WA67YBzNlDv95qzSp7V/7Ek3NCcnT7G+2kSuhNo1FhdN
   eSDO/moYebZNAcu3iqLsuzuULXPLuoU0GsMnVMqV9DZPh7cQHE5EBZ7hlzDBK7k/
@@ -21,21 +20,19 @@ cert_chain:
   JMNDFsmHK/6Ji4Kk48Z3TyscHQnipAID5GhS1oD21/WePdj7GhmbF5gBzkV5uepd
   eJQPgWGwrQW/Z2oPjRuJrRofzWfrMWqbOahj9uth6WSxhNexUtbjk6P8emmXOJi5
   chQPnWX+N3Gj+jjYxqTFdwT7Mj3pv1VHa+aNUbqSPpvJeDyxRIuo9hvzDaBHb/Cg
-  9qRVcm8a96n4t7y2lrX1oookY6bkBaxWOMtWlqIprq8JZXM9AgMBAAGjgYEwfzAJ
-  BgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUOIdbSMr3VFrTCO9/cTM0
-  0exHzBcwIgYDVR0RBBswGYEXbGFyc0BncmVpei1yZWluc2RvcmYuZGUwIgYDVR0S
-  BBswGYEXbGFyc0BncmVpei1yZWluc2RvcmYuZGUwDQYJKoZIhvcNAQELBQADggGB
-  AFWP7F/y3Oq3NgrqUOnjKOeDaBa7AqNhHS+PZg+C90lnJzMgOs4KKgZYxqSQVSab
-  SCEmzIO/StkXY4NpJ4fYLrHemf/fJy1wPyu+fNdp5SEEUwEo+2toRFlzTe4u4LdS
-  QC636nPPTMt8H3xz2wf/lUIUeo2Qc95Qt2BQM465ibbG9kmA3c7Sopx6yOabYOAl
-  KPRbOSEPiWYcF9Suuz8Gdf8jxEtPlnZiwRvnYJ+IHMq3XQCJWPpMzdDMbtlgHbXE
-  vq1zOTLMSYAS0UB3uionR4yo1hLz60odwkCm7qf0o2Ci/5OjtB0a89VuyqRU2vUJ
-  QH95WBjDJ6lCCW7J0mrMPnJQSUFTmufsU6jOChvPaCeAzW1YwrsP/YKnvwueG7ip
-  VOdW6RitjtFxhS7evRL0201+KUvLz12zZWWjOcujlQs64QprxOtiv/MiisKb1Ng+
-  oL1mUdzB8KrZL4/WbG5YNX6UTtJbIOu9qEFbBAy4/jtIkJX+dlNoFwd4GXQW1YNO
-  nA==
+  9qRVcm8a96n4t7y2lrX1oookY6bkBaxWOMtWlqIprq8JZXM9AgMBAAGjOTA3MAkG
+  A1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBQ4h1tIyvdUWtMI739xMzTR
+  7EfMFzANBgkqhkiG9w0BAQsFAAOCAYEAoZZWzNV2XXaoSmvyamSSN+Wt/Ia+DNrU
+  2pc3kMEqykH6l1WiVPszr6HavQ//2I2UcSRSS5AGDdiSXcfyFmHtMBdtJHhTPcn7
+  4DLliB0szpvwG+ltGD8PI8eWkLaTQeFzs+0QCTavgKV+Zw56Q0J5zZvHHUMrLkUD
+  qhwKjdTdkrRTn9Sqi0BrIRRZGTUDdrt8qoWm35aES5arKZzytgrRD/kXfFW2LCg0
+  FzgTKibR4/3g8ph94kQLg/D2SMlVPkQ3ECi036mZxDC2n8V6u3rDkG5923wmrRZB
+  J6cqz475Q8HYORQCB68OPzkWMfC7mBo3vpSsIqRoNs1FE4FJu4FGwZG8fBSrDC4H
+  bZe+GtyS3e2SMjgT65zp35gLO9I7MquzYN9P6V2u1iBpTycchk5z9R1ghxzZSBT8
+  DrkJ9tVlPQtJB0LqT0tvBap4upnwT1xYq721b5dwH6AF4Pi6iz/dc5vnq1/MH8bV
+  8VbbBzzeE7MsvgkP3sHlLmY8PtuyViJ8
   -----END CERTIFICATE-----
-date: 2022-12-02 00:00:00.000000000 Z
+date: 2025-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-ldap
@@ -85,20 +82,62 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: ruby-ldapserver
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.7'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -161,7 +200,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.4'
-description:
 email:
 - lars@greiz-reinsdorf.de
 executables:
@@ -194,7 +232,6 @@ homepage: https://github.com/larskanis/pg-ldap-sync
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -212,8 +249,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: Use LDAP permissions in PostgreSQL
 test_files: []