sheffield_ldap_lookup 0.0.7 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3090dd3270a42985506f6077318966d175fb5460a058f397b71f1f70577e283e
-  data.tar.gz: 60717cc86c1e4302bc2d559678cac466a8fde864f716749f9729cef676a29116
+  metadata.gz: 2a0dc52a5bd9f5aa8ec1401e62ca05c0d5f7062c0f382afb77d1f4d8595df0b5
+  data.tar.gz: f945bc9ded89ea4b1d9a047ae6b1c5a7b71786b2a7d98acdd426f5172c7720c4
 SHA512:
-  metadata.gz: 0cd3d1d61454854acee77fd4ce9e508596f2f5b915dd55cc1a8ca72812154e0e23da960c0c0abf0d4d51364146261fc46f4f17215e2e0bd62e704fb47aa4c52f
-  data.tar.gz: 229b7266dd482ef161b6544906d1c51847ddc7b28bd027687d295e28474d7fa9a8006386c3bd83d3e032beb1445d6d6400a5fd781f2b947626955605bb973e73
+  metadata.gz: 42ed11ed5b09a6a6b3b159fc4fee3757235802bfad7ce87420b3507751ba4f7561502195c03e51a44e373ee7069595f768d2b0234177a98f4ef99c7bac564ed6
+  data.tar.gz: 46017a6b493efd2d91b87f8669e9118ececac71a9190dea0782ca3958b480b8001849e632143fcc0b7d8a3b6c0183d83d07713480cb2011d59ee33a0b0ddff2e

data/.ruby-version

@@ -1 +1 @@
-2.5.1
+ruby-3.1

data/lib/sheffield_ldap_lookup/ldap_finder.rb

@@ -12,13 +12,17 @@ module SheffieldLdapLookup
 
     class << self
       attr_accessor :ldap_config
+      attr_accessor :error_notification_proc
     end
 
     def lookup
       begin
         @lookup ||= connection.search(filter: ldap_filter)[0]
-      rescue
-        {}
+      rescue Exception => exception
+        if self.class.error_notification_proc.is_a?(Proc)
+          self.class.error_notification_proc.call(exception)
+        end
+        raise exception
       end
     end
 
@@ -28,7 +32,7 @@ module SheffieldLdapLookup
 
     def search_attribute
       return custom_search_attribute if custom_search_attribute
-      keyword =~ /\A[^@]+@[^@]+\z/ ? 'mail' : 'uid'
+      keyword =~ /\A[^@]+@[^@]+\z/ ? 'mail' : 'sAMAccountName'
     end
 
     def ldap_config
@@ -56,9 +60,19 @@ module SheffieldLdapLookup
 
       if ldap_config["#{@config_prefix}ssl"] == true
         base_settings[:port] ||= 636
-        base_settings[:encryption] = :simple_tls
+        base_settings[:encryption] = {
+          method: :simple_tls,
+          tls_options: OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.merge(
+            # Default min version (in Ruby 2.7) is TLS 1.0, but server always responds and says provide TLS 1.2
+            # (and, to be honest, we shouldn't use anything less than TLS 1.2 these days)
+            min_version: OpenSSL::SSL::TLS1_2_VERSION
+          )
+        }
       end
 
+      # Avoid two LDAP queries per connection by forcing unpaged results
+      base_settings[:force_no_page] = true
+
       base_settings
     end
 

data/lib/sheffield_ldap_lookup/version.rb

@@ -1,3 +1,3 @@
 module SheffieldLdapLookup
-  VERSION = "0.0.7"
+  VERSION = "0.0.9"
 end

data/spec/lib/ldap_finder_spec.rb

@@ -3,12 +3,18 @@ require 'sheffield_ldap_lookup/ldap_finder.rb'
 
 describe SheffieldLdapLookup::LdapFinder do
   let(:ldap_config) { { 'host' => 'localhost', 'port' => '389', 'base' => 'ou=Users' } }
+  let(:default_tls_options) { OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.merge(min_version: OpenSSL::SSL::TLS1_2_VERSION) }
 
   describe "#connection" do
     it "should create a new LDAP connection" do
       allow(subject).to receive(:ldap_config).and_return(ldap_config)
       ldap_class = double
-      expect(ldap_class).to receive(:new).with(host: ldap_config['host'], port: ldap_config['port'], base: ldap_config['base'])
+      expect(ldap_class).to receive(:new).with({
+        host: ldap_config['host'],
+        port: ldap_config['port'],
+        base: ldap_config['base'],
+        force_no_page: true
+      })
       subject.connection(ldap_class)
     end
   end
@@ -24,7 +30,7 @@ describe SheffieldLdapLookup::LdapFinder do
     describe "determine to search against uid or email based on the format of the keyword" do
       it "should use 'uid' attribute for username" do
         finder = SheffieldLdapLookup::LdapFinder.new('username')
-        expect(finder.search_attribute).to eq 'uid'
+        expect(finder.search_attribute).to eq 'sAMAccountName'
       end
 
       it "should use 'mail' attribute for email" do
@@ -52,7 +58,12 @@ describe SheffieldLdapLookup::LdapFinder do
     it "should create a new LDAP connection" do
       allow(subject).to receive(:ldap_config).and_return(ldap_config)
       ldap_class = double
-      expect(ldap_class).to receive(:new).with(host: ldap_config['prefix_host'], port: ldap_config['prefix_port'], base: ldap_config['prefix_base'])
+      expect(ldap_class).to receive(:new).with({
+        host: ldap_config['prefix_host'],
+        port: ldap_config['prefix_port'],
+        base: ldap_config['prefix_base'],
+        force_no_page: true
+      })
       subject.connection(ldap_class)
     end
   end
@@ -63,9 +74,16 @@ describe SheffieldLdapLookup::LdapFinder do
     it "should create a new secure LDAP connection" do
       allow(subject).to receive(:ldap_config).and_return(ldap_config)
       ldap_class = double
-      expect(ldap_class).to receive(:new).with(host: ldap_config['host'],
-        port: ldap_config['port'], base: ldap_config['base'],
-        encryption: :simple_tls)
+      expect(ldap_class).to receive(:new).with({
+        host: ldap_config['host'],
+        port: ldap_config['port'],
+        base: ldap_config['base'],
+        encryption: {
+          method: :simple_tls,
+          tls_options: default_tls_options
+        },
+        force_no_page: true
+      })
       subject.connection(ldap_class)
     end
   end
@@ -77,9 +95,17 @@ describe SheffieldLdapLookup::LdapFinder do
     it "should create a new secure LDAP connection" do
       allow(subject).to receive(:ldap_config).and_return(ldap_config)
       ldap_class = double
-      expect(ldap_class).to receive(:new).with(host: ldap_config['host'],
-        port: ldap_config['port'], base: ldap_config['base'],
-        auth: { method: :simple, username: 'ldapusername', password: 'ldappassword' } )
+      expect(ldap_class).to receive(:new).with({
+        host: ldap_config['host'],
+        port: ldap_config['port'],
+        base: ldap_config['base'],
+        force_no_page: true,
+        auth: {
+          method: :simple,
+          username: 'ldapusername',
+          password: 'ldappassword'
+        }
+      })
       subject.connection(ldap_class)
     end
   end
@@ -91,9 +117,21 @@ describe SheffieldLdapLookup::LdapFinder do
     it "should create a new secure LDAP connection" do
       allow(subject).to receive(:ldap_config).and_return(ldap_config)
       ldap_class = double
-      expect(ldap_class).to receive(:new).with(host: ldap_config['host'],
-        port: ldap_config['port'], base: ldap_config['base'], encryption: :simple_tls,
-        auth: { method: :simple, username: 'ldapusername', password: 'ldappassword' } )
+      expect(ldap_class).to receive(:new).with({
+        host: ldap_config['host'],
+        port: ldap_config['port'],
+        base: ldap_config['base'],
+        force_no_page: true,
+        encryption: {
+          method: :simple_tls,
+          tls_options: default_tls_options
+        },
+        auth: {
+          method: :simple,
+          username: 'ldapusername',
+          password: 'ldappassword'
+        }
+      })
       subject.connection(ldap_class)
     end
   end
@@ -118,11 +156,6 @@ describe SheffieldLdapLookup::LdapFinder do
         allow(connection).to receive(:search).and_return([result])
         expect(subject.lookup).to eq result
       end
-
-      it "should return an empty hash if cannot connect to LDAP" do
-        allow(connection).to receive(:search).and_return(->{raise})
-        expect(subject.lookup).to eq({})
-      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sheffield_ldap_lookup
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.0.9
 platform: ruby
 authors:
 - James Gregory-Monk
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-01-05 00:00:00.000000000 Z
+date: 2023-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-ldap
@@ -108,7 +108,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: LDAP lookup