simple_ldap_authenticator 1.3.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3dbf224e93ab7c30ed11038747ecaec5dc263715cb9ab03172f6a1d605bac947
-  data.tar.gz: bb5b1c047030368ea994ea55b35aee888596d5976323780109437805776a4b34
+  metadata.gz: 6077b51596ff8f01277e06222f7373de619040403ef347415de226c8802a9fa7
+  data.tar.gz: f6b9491e5055a8da2a57dbdd192a9547acc194edebe95c9d0f33158e945d5133
 SHA512:
-  metadata.gz: 177e31bda9a64aa956f2f67bd484674d238fcf16c0721892dbfd7ceaf7ae0a78902accf2378879c1a8568ea29404aa2593f64d8f43187549395e1d4a165bbc9a
-  data.tar.gz: 6d627bd78c11141794af994ba7ad9876e25e5666fbda3d3fe467bb15e722351a3b9af5b2d6b023d8ee02db59a58426ceed016a55d1607ec1dd39d0a9859db586
+  metadata.gz: f426214b597d888072cd0f0cb7ec66089ae55c7330b7fafbafb098d5314760fd32854f01dd285b25f546b88f750ef86c858fdac71ecd3d644a698637651703b4
+  data.tar.gz: fb996d2dbacf455d99b8f7aee099de3e2eaccd01a77fb29f6840ffe8721c0d39fb8c71c8d268d87ac63167062fdd2e1bf9b2958999a018402c6e7a263f4f4366

data/README

@@ -17,4 +17,40 @@ Example Usage:
   SimpleLdapAuthenticator.valid?(username, password)
   # => true or false (or raise if there is an issue connecting to the server)
 
+By default, a new connection object is created for each call to valid?,
+so valid? is safe to call concurrently from multiple threads.  If you only
+use SimpleLdapAuthenticator from a single thread, you can reuse a single
+connection object for all calls to valid?:
+
+  SimpleLdapAuthenticator.single_threaded = true
+
+Do not enable single threaded mode if valid? may be called concurrently,
+as that can result in invalid passwords being considered valid.
+
+When use_ssl is true, the server's certificate and hostname are verified
+using the default trusted certificates.  You can set use_ssl to a hash of
+TLS options to customize this, such as specifying the CA certificate(s) to
+trust (useful for internal CAs and self-signed certificates, such as those
+commonly used by Active Directory):
+
+  SimpleLdapAuthenticator.use_ssl = {ca_file: '/path/to/ca.pem'}
+
+The :ca_file, :ca_path, and :verify_mode options are supported for both
+ldap and net/ldap backends.  For net/ldap, any option supported by
+OpenSSL::SSL::SSLContext#set_params can be used.  For ldap, only
+those three options are supported. :verify_mode on ldap will default to
+the LDAP behavior (which verifies by default unless the TLS_REQCERT
+setting is set in the system's ldap.conf).
+
+Before version 2, use_ssl = true did not verify the server's
+certificate when using net/ldap.  To get the previous behavior of not
+verifying the server's certificate (not recommended, as it allows
+man-in-the-middle attacks to capture passwords):
+
+  SimpleLdapAuthenticator.use_ssl = {verify_mode: OpenSSL::SSL::VERIFY_NONE}
+
+Note that due to a bug in net/ldap, you should use domain names and
+not IP addresses in the servers array, at least if you are using
+LibreSSL (which follows the SSL spec more closely).
+
 github: http://github.com/jeremyevans/simple_ldap_authenticator

data/lib/simple_ldap_authenticator.rb

@@ -12,9 +12,43 @@
 # * login_format = '%s@domain.com' # Active Directory, OR
 # * login_format = 'cn=%s,cn=users,o=organization,c=us' # Other LDAP servers
 # * servers = ['dc1.domain.com', 'dc2.domain.com'] # names/addresses of LDAP servers to use
-# * use_ssl = true # for logging in via LDAPS
+# * use_ssl = true # for logging in via LDAPS, verifying the server certificate
+# * use_ssl = {ca_file: '/path/to/ca.pem'} # for logging in via LDAPS, with TLS options
 # * port = 3289 # instead of 389 for LDAP or 636 for LDAPS
 # * logger = Logger.new($stdout) # for logging authentication successes/failures
+# * single_threaded = true # reuse a single connection, only safe if not using threads
+#
+# By default, a new connection object is created for each call to valid?,
+# so that valid? is safe to call concurrently from multiple threads.  If
+# you are only using SimpleLdapAuthenticator in a single thread, you can set
+# single_threaded = true, which reuses a single connection object for all
+# calls to valid?.  Do not set single_threaded = true if valid? may be
+# called concurrently, as that can result in invalid passwords being
+# considered valid.
+#
+# When use_ssl is true, the server's certificate and hostname are verified
+# using the default trusted certificates.  use_ssl can also be set to a hash
+# of TLS options, which are merged into the default TLS options.  The
+# following TLS options are supported for both libraries:
+#
+# :ca_file :: File containing trusted CA certificates.
+# :ca_path :: Directory containing trusted CA certificates.
+# :verify_mode :: Whether to verify the server certificate, should be
+#                 OpenSSL::SSL::VERIFY_PEER or OpenSSL::SSL::VERIFY_NONE
+#                 if given.
+#
+# For net/ldap, any option supported by OpenSSL::SSL::SSLContext#set_params
+# can be used. For ldap, only the three keys given above work.
+#
+# Before version 2, use_ssl = true did not verify the server certificate
+# when using net/ldap.  To restore that behavior (not recommended, as it allows
+# man-in-the-middle attacks), you can disable verification:
+#
+#  SimpleLdapAuthenticator.use_ssl = {verify_mode: OpenSSL::SSL::VERIFY_NONE}
+#
+# With ldap, whether to verify the certificate by default depends on the
+# system's libldap configuration (TLS_REQCERT in ldap.conf). The above setting
+# also disables verification when using ldap.
 #
 # The class is used as a singleton, you are not supposed to create an
 # instance of it. For example:
@@ -31,9 +65,11 @@ class SimpleLdapAuthenticator
   @servers = ['127.0.0.1']
   @use_ssl = false
   @login_format = '%s'
+  @single_threaded = false
+  @switch_server_mutex = Mutex.new
 
   class << self
-    attr_accessor :servers, :use_ssl, :login_format, :logger, :ldap_library
+    attr_accessor :servers, :use_ssl, :login_format, :logger, :ldap_library, :single_threaded
     attr_writer :port, :connection
     
     # Load the required LDAP library, either 'ldap' or 'net/ldap'
@@ -64,16 +100,46 @@ class SimpleLdapAuthenticator
       servers[0]
     end
     
-    # The connection to the LDAP server.  A single connection is made and the
-    # connection is only changed if a server returns an error other than 
-    # invalid password.
+    # The shared connection to the LDAP server, only used in single threaded
+    # mode.  A single connection is made and the connection is only changed if
+    # a server returns an error other than invalid password.
     def connection
-      return @connection if @connection
+      @connection ||= new_connection(server)
+    end
+
+    # Create a new connection object for the given LDAP server.
+    def new_connection(server)
       load_ldap_library
-      @connection = if ldap_library == 'net/ldap'
-        Net::LDAP.new(:host=>server, :port=>(port), :encryption=>(:simple_tls if use_ssl))
+      if ldap_library == 'net/ldap'
+        if use_ssl
+          tls_opts = use_ssl.is_a?(Hash) ? use_ssl.dup : {}
+          unless tls_opts[:verify_mode]
+            require "openssl"
+            tls_opts[:verify_mode] = OpenSSL::SSL::VERIFY_PEER
+          end
+          encryption_opts = {:method=>:simple_tls, :tls_options=>tls_opts}
+        end
+        Net::LDAP.new(:host=>server, :port=>port, :encryption=>encryption_opts)
+      elsif use_ssl
+        conn = LDAP::SSLConn.new(server, port)
+        if use_ssl.is_a?(Hash) && !use_ssl.empty?
+          use_ssl.each do |k, v|
+            case k
+            when :verify_mode
+              conn.set_option(LDAP::LDAP_OPT_X_TLS_REQUIRE_CERT, v)
+            when :ca_file
+              conn.set_option(LDAP::LDAP_OPT_X_TLS_CACERTFILE, v)
+            when :ca_path
+              conn.set_option(LDAP::LDAP_OPT_X_TLS_CACERTDIR, v)
+            else
+              raise ArgumentError, "unsupported TLS option for ldap library: #{k.inspect}"
+            end
+          end
+          conn.set_option(LDAP::LDAP_OPT_X_TLS_NEWCTX, 0)
+        end
+        conn
       else
-        (use_ssl ? LDAP::SSLConn : LDAP::Conn).new(server, port)
+        LDAP::Conn.new(server, port)
       end
     end
     
@@ -83,23 +149,30 @@ class SimpleLdapAuthenticator
     end
     
     # Disconnect from current LDAP server and use a different LDAP server on the
-    # next authentication attempt
-    def switch_server
-      self.connection = nil
-      servers << servers.shift
+    # next authentication attempt.  If failed_server is given, only switch
+    # servers if failed_server is still the current server, so that multiple
+    # threads failing on the same server only switch servers once.
+    def switch_server(failed_server = nil)
+      @switch_server_mutex.synchronize do
+        if failed_server.nil? || server.equal?(failed_server)
+          self.connection = nil
+          servers.rotate!
+        end
+      end
     end
     
     # Check the validity of a login/password combination
     def valid?(login, password)
       login = login.to_s
       password = password.to_s
-      connection = self.connection
-      if password == '' || password.include?("\0") || login.include?("\0")
-        false
-      elsif ldap_library == 'net/ldap'
-        connection.authenticate(login_format % login, password)
+      return false if password == '' || password.include?("\0") || login.include?("\0")
+
+      server = self.server
+      if ldap_library == 'net/ldap'
+        connection = single_threaded ? self.connection : new_connection(server)
+        auth = {:method=>:simple, :username=>login_format % login, :password=>password}
         begin
-          if connection.bind
+          if connection.bind(auth)
             logger.info("Authenticated #{login} by #{server}") if logger
             true
           else
@@ -107,15 +180,16 @@ class SimpleLdapAuthenticator
             if logger
               logger.info("Error attempting to authenticate #{login} by #{server}: #{result.code} #{result.message} #{result.error_message.to_s.strip}")
             end
-            switch_server unless result.code == 49
+            switch_server(server) unless result.code == 49
             false
           end
         rescue Net::LDAP::Error, SocketError, SystemCallError => error
           logger.info("Error attempting to authenticate #{login} by #{server}: #{error.message}") if logger
-          switch_server
+          switch_server(server)
           false
         end
       else
+        connection = (single_threaded && !(use_ssl.is_a?(Hash) && !use_ssl.empty?)) ? self.connection : new_connection(server)
         connection.unbind if connection.bound?
         begin
           connection.bind(login_format % login, password)
@@ -123,9 +197,8 @@ class SimpleLdapAuthenticator
           logger.info("Authenticated #{login} by #{server}") if logger
           true
         rescue LDAP::ResultError => error
-          connection.unbind if connection.bound?
           logger.info("Error attempting to authenticate #{login} by #{server}: #{error.message}") if logger
-          switch_server unless error.message == 'Invalid credentials'
+          switch_server(server) unless error.message == 'Invalid credentials'
           false
         end
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simple_ldap_authenticator
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Jeremy Evans
@@ -23,20 +23,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: eventmachine
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: net-ldap
   requirement: !ruby/object:Gem::Requirement