thecore_auth_commons 3.5.6 → 3.5.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 987477d58391f32a83a64c20eff852ce2d4ce971e222a60ee730d117e1d913c2
-  data.tar.gz: 544af82b55daddb0e720fe008769aba04d1d8b83216eb1d18c1b1edf6c134e18
+  metadata.gz: 27bf0b1187752a6de3f29fe3b2d0e15057bba9a925eb7f9860236d9d8c505966
+  data.tar.gz: 342497749ab4022507a43b88c1ef948bf02d47d8a04bb36f15b27ff8cb260ddc
 SHA512:
-  metadata.gz: 79b1a9bc7b5987594fb22b6423297e68892d2d21c371532bae2ba8b677a82c716f8311b31a8e8f909b03d9cad077a2e49e92f7489e503467e8abf9806e79637f
-  data.tar.gz: 62452c88f37fecd66bc04dd72db6d62cc50b42bedb2882f412e83b5360f7e788f4bd6e20d776c3bf04d32de14ead046143fc216a6dffb4b734f6074f14a5fd95
+  metadata.gz: 7115ff0b2fd8cd6ba55ae9d8a63c9b90d63550e585c972b71a682432dd0af2ac78be0ae646db3177956bffbb508fe31c424a695c5be6f9e35386f7c020637c68
+  data.tar.gz: 26d704084b0cebfe63a21eb2f2c8e8439a0787691fc7d08c87d8b4d946c18c0d75c064d55b481eae2dcfd77952c79017cfc0b0dda604d5de497b5fce1928bcda

data/app/controllers/users/sessions_controller.rb

@@ -4,19 +4,20 @@ class Users::SessionsController < Devise::SessionsController
     self.resource = warden.authenticate(auth_options)
 
     if resource
+      Rails.logger.info("Authentication: Found local user, signing in")
       sign_in_and_redirect(resource)
     else
+      Rails.logger.info("Authentication: Not found a local user, trying LDAP")
       user = Ldap::Authenticator.new(
         email: params[:user][:email],
-        password: params[:user][:password]
+        password: params[:user][:password],
       ).authenticate
 
       if user
-        flash[:notice] = "Autenticato via LDAP"
-        sign_in(:user, user)
-        redirect_to after_sign_in_path_for(user)
+        sign_in_and_redirect(user)
       else
-        flash.now[:alert] = "Email o password non validi"
+        set_flash_message!(:alert, :invalid)
+
         self.resource = resource_class.new(sign_in_params)
         clean_up_passwords(resource)
         respond_with_navigational(resource) { render :new, status: :unauthorized }

data/app/services/ldap/authenticator.rb

@@ -6,42 +6,56 @@ module Ldap
       @email = email
     end
 
-    def authenticate
-      return nil if @password.blank?
+    def auth_on_single_server(server)
+      Rails.logger.debug("LDAP: Trying to authenticate #{email} on server #{server.inspect}")
+      ldap = Net::LDAP.new(
+        host: server.host,
+        port: server.port,
+        encryption: server.use_ssl ? :simple_tls : nil,
+        auth: {
+          method: :simple,
+          username: server.admin_user,
+          password: server.admin_password,
+        },
+      )
 
-      LdapServer.all.each do |server|
-        ldap = Net::LDAP.new(
+      Rails.logger.debug("LDAP: Binding to server #{server.inspect} ")
+      filter = Net::LDAP::Filter.eq(server.auth_field, email) # server.auth_field
+      treebase = server.base_dn
+
+      Rails.logger.debug("LDAP: Searching for user #{email} in base #{treebase} with filter #{filter.to_s}")
+      ldap.search(base: treebase, filter: filter) do |entry|
+        user_dn = entry.dn
+
+        # Prova autenticazione utente
+        user_ldap = Net::LDAP.new(
           host: server.host,
           port: server.port,
           encryption: server.use_ssl ? :simple_tls : nil,
           auth: {
             method: :simple,
-            username: server.admin_user,
-            password: server.admin_password
-          }
+            username: user_dn,
+            password: password,
+          },
         )
 
-        filter = Net::LDAP::Filter.eq(server.auth_field, email) # server.auth_field
-        treebase = server.base_dn
-
-        ldap.search(base: treebase, filter: filter) do |entry|
-          user_dn = entry.dn
-
-          # Prova autenticazione utente
-          user_ldap = Net::LDAP.new(
-            host: server.host,
-            port: server.port,
-            encryption: server.use_ssl ? :simple_tls : nil,
-            auth: {
-              method: :simple,
-              username: user_dn,
-              password: password
-            }
-          )
-
-          if user_ldap.bind
-            return find_or_create_user(entry, server.id)
-          end
+        Rails.logger.debug("LDAP: Trying to bind as user #{user_dn} on server #{server.inspect}")
+        return entry if user_ldap.bind
+      end
+      Rails.logger.debug("LDAP: Authentication failed for #{email} on server #{server.inspect}")
+      nil
+    end
+
+    def authenticate
+      return nil if @password.blank?
+
+      LdapServer.all.each do |server|
+        entry = auth_on_single_server(server)
+        if entry
+          Rails.logger.info("Authentication: LDAP authentication succeeded for #{email} on server #{server.name}")
+          return find_or_create_user(entry, server.id)
+        else
+          Rails.logger.info("Authentication: LDAP authentication failed for #{email} on server #{server.name}")
         end
       end
 

data/config/locales/en.thecore_auth_commons.yml

@@ -1,4 +1,9 @@
 en:
+  devise:
+    sessions:
+      invalid: "Credential or password are invalid."
+      user:
+        invalid: "Credential or password are invalid."
   error:
     messages:
       password_requires_letters_and_numbers: "must contain at least one letter and one number"

data/config/locales/it.thecore_auth_commons.yml

@@ -1,4 +1,9 @@
 it:
+  devise:
+    sessions:
+      invalid: "Credenziali %{authentication_keys} o password non valide."
+      user:
+        invalid: "Credenziali %{authentication_keys} o password non valide."
   error:
     messages:
       password_requires_letters_and_numbers: "deve contenere almeno una lettera e un numero"

data/lib/thecore_auth_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreAuthCommons
-  VERSION = "3.5.6".freeze
+  VERSION = "3.5.7".freeze
 end

data/lib/thecore_auth_commons.rb

@@ -1,34 +1,34 @@
-require 'devise'
-require 'cancancan'
-require 'kaminari'
-require 'activerecord-nulldb-adapter'
+require "devise"
+require "cancancan"
+require "kaminari"
+require "activerecord-nulldb-adapter"
 require "thecore_settings"
 require "net/ldap"
-require 'omniauth'
-require 'omniauth-google-oauth2'
-require 'omniauth-entra-id'
+require "omniauth"
+require "omniauth-google-oauth2"
+require "omniauth-entra-id"
 
 require "thecore_auth_commons/engine"
 
 require "thecore/seed"
 
 module ThecoreAuthCommons
-  def self.oauth_vars? 
-     entra_id_vars? || google_oauth2_vars?
+  def self.oauth_vars?
+    entra_id_vars? || google_oauth2_vars?
   end
 
   def self.entra_id_vars?
-    ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?
+    ENV["ENTRA_CLIENT_ID"].present? && ENV["ENTRA_CLIENT_SECRET"].present? && ENV["ENTRA_TENANT_ID"].present?
   end
 
   def self.google_oauth2_vars?
-    ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?
+    ENV["GOOGLE_CLIENT_ID"].present? && ENV["GOOGLE_CLIENT_SECRET"].present?
   end
 
   # Controlla se l'utente esiste, altrimenti lo crea con una password casuale
   # e lo restituisce. Se l'utente esiste già, lo restituisce senza modificarlo.
 
-  def self.check_user email, name, surname, provider
+  def self.check_user(email, name, surname, provider)
     u = User.find_or_initialize_by(email: email)
     u.name = name
     u.surname = surname
@@ -54,8 +54,8 @@ module ThecoreAuthCommons
         auth: {
           method: :simple,
           username: server.admin_user,
-          password: server.admin_password
-        }
+          password: server.admin_password,
+        },
       )
 
       unless ldap.bind
@@ -81,7 +81,7 @@ module ThecoreAuthCommons
     puts "== Completato. Utenti importati: #{imported_count} =="
   end
   # Your code goes here...
-  def self.align_user email, entry, server_id
+  def self.align_user(email, entry, server_id)
     user = User.find_or_initialize_by(email: email)
     user.auth_source = "ldap #{server_id}"
 
@@ -96,8 +96,8 @@ module ThecoreAuthCommons
     entry[:memberOf].each do |group|
       group_name = group.split(",").first.split("=").last
       # Se il gruppo è un admin, assegna il ruolo admin
-      is_admin = true if [ "Administrators", "Domain Admins", "Schema Admins", "Enterprise Admins", "admins", "administrators" ].include?(group_name)
-      
+      is_admin = true if ["Administrators", "Domain Admins", "Schema Admins", "Enterprise Admins", "admins", "administrators"].include?(group_name)
+
       role = Role.find_or_create_by(name: group_name)
       user.roles << role unless user.roles.include?(role)
     end
@@ -109,20 +109,20 @@ module ThecoreAuthCommons
   end
 
   def self.generate_secure_password(length = 20)
-    raise ArgumentError, 'Length must be at least 4' if length < 4
+    raise ArgumentError, "Length must be at least 4" if length < 4
 
     # Caratteri da cui attingere
-    lowercase = ('a'..'z').to_a
-    uppercase = ('A'..'Z').to_a
-    numbers   = ('0'..'9').to_a
-    symbols   = ['!', '@', '#', '$', '%', '&', '*', '?', '-', '_', '+', '=']
+    lowercase = ("a".."z").to_a
+    uppercase = ("A".."Z").to_a
+    numbers = ("0".."9").to_a
+    symbols = ["!", "@", "#", "$", "%", "&", "*", "?", "-", "_", "+", "="]
 
     # Obbliga almeno un carattere da ogni gruppo
     password = [
       lowercase.sample,
       uppercase.sample,
       numbers.sample,
-      symbols.sample
+      symbols.sample,
     ]
 
     # Caratteri restanti scelti a caso tra tutti
@@ -132,5 +132,4 @@ module ThecoreAuthCommons
     # Mischia per evitare ordine prevedibile
     password.shuffle.join
   end
-
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_auth_commons
 version: !ruby/object:Gem::Version
-  version: 3.5.6
+  version: 3.5.7
 platform: ruby
 authors:
 - Gabriele Tassoni