|
| 1 | +#this code borrowed pieces from activeldap and net-ldap |
| 2 | + |
| 3 | +require 'rack' |
| 4 | +require 'net/ldap' |
| 5 | +require 'net/ntlm' |
| 6 | +require 'uri' |
| 7 | + |
| 8 | +module OmniAuth |
| 9 | + module LDAP |
| 10 | + class Adaptor |
| 11 | + class LdapError < StandardError; end |
| 12 | + class ConfigurationError < StandardError; end |
| 13 | + class AuthenticationError < StandardError; end |
| 14 | + class ConnectionError < StandardError; end |
| 15 | + |
| 16 | + VALID_ADAPTER_CONFIGURATION_KEYS = [:host, :port, :method, :bind_dn, :password, :try_sasl, :sasl_mechanisms, :uid, :base, :allow_anonymous] |
| 17 | + |
| 18 | + MUST_HAVE_KEYS = [:host, :port, :method, :uid, :base] |
| 19 | + |
| 20 | + METHOD = { |
| 21 | + :ssl => :simple_tls, |
| 22 | + :tls => :start_tls, |
| 23 | + :plain => nil, |
| 24 | + } |
| 25 | + |
| 26 | + attr_accessor :bind_dn, :password |
| 27 | + attr_reader :connection, :uid, :base |
| 28 | + |
| 29 | + def initialize(configuration={}) |
| 30 | + @disconnected = false |
| 31 | + @bound = false |
| 32 | + @configuration = configuration.dup |
| 33 | + @configuration[:allow_anonymous] ||= false |
| 34 | + @logger = @configuration.delete(:logger) |
| 35 | + message = [] |
| 36 | + MUST_HAVE_KEYS.each do |name| |
| 37 | + message << name if configuration[name].nil? |
| 38 | + end |
| 39 | + raise ArgumentError.new(message.join(",") +" MUST be provided") unless message.empty? |
| 40 | + VALID_ADAPTER_CONFIGURATION_KEYS.each do |name| |
| 41 | + instance_variable_set("@#{name}", configuration[name]) |
| 42 | + end |
| 43 | + |
| 44 | + method = ensure_method(@method) |
| 45 | + config = { |
| 46 | + :host => @host, |
| 47 | + :port => @port, |
| 48 | + :encryption => method |
| 49 | + } |
| 50 | + @uri = construct_uri(@host, @port, @method != :plain) |
| 51 | + |
| 52 | + @bind_method = @try_sasl ? "sasl" : @allow_anonymous ? 'anonymous' : 'simple' |
| 53 | + @bind_method = 'anonymous' unless @bind_dn && @password |
| 54 | + |
| 55 | + @auth = sasl_auths.first if @bind_method == 'sasl' |
| 56 | + @bind_method = 'simple' unless @auth |
| 57 | + @auth ||= { :method => @bind_method, |
| 58 | + :username => @bind_dn, |
| 59 | + :password => @passowrd |
| 60 | + } |
| 61 | + config[:auth] = @auth |
| 62 | + @connection = Net::LDAP.new(config) |
| 63 | + end |
| 64 | + |
| 65 | + #:base => "dc=yourcompany, dc=com", |
| 66 | + # :filter => "(mail=#{user})", |
| 67 | + # :password => psw |
| 68 | + def bind_as(args = {}) |
| 69 | + result = false |
| 70 | + @connection.open { |me| |
| 71 | + rs = search args |
| 72 | + if rs and rs.first and dn = rs.first.dn |
| 73 | + password = args[:password] |
| 74 | + method = args[:method] |
| 75 | + password = password.call if password.respond_to?(:call) |
| 76 | + if method == 'sasl' |
| 77 | + result = rs if bind(sasl_auths(args)) |
| 78 | + else |
| 79 | + result = rs if bind(:method => :simple, :username => dn, |
| 80 | + :password => password) |
| 81 | + end |
| 82 | + end |
| 83 | + } |
| 84 | + result |
| 85 | + end |
| 86 | + |
| 87 | + private |
| 88 | + |
| 89 | + def ensure_port(method) |
| 90 | + if method == :ssl |
| 91 | + URI::LDAPS::DEFAULT_PORT |
| 92 | + else |
| 93 | + URI::LDAP::DEFAULT_PORT |
| 94 | + end |
| 95 | + end |
| 96 | + |
| 97 | + def ensure_method(method) |
| 98 | + method ||= "plain" |
| 99 | + normalized_method = method.to_s.downcase.to_sym |
| 100 | + return METHOD[normalized_method] if METHOD.has_key?(normalized_method) |
| 101 | + |
| 102 | + available_methods = METHOD.keys.collect {|m| m.inspect}.join(", ") |
| 103 | + format = "%s is not one of the available connect methods: %s" |
| 104 | + raise ConfigurationError, format % [method.inspect, available_methods] |
| 105 | + end |
| 106 | + |
| 107 | + def sasl_auths(options={}) |
| 108 | + auths = [] |
| 109 | + sasl_mechanisms = options[:sasl_mechanisms] || @sasl_mechanisms |
| 110 | + sasl_mechanisms.each do |mechanism| |
| 111 | + normalized_mechanism = mechanism.downcase.gsub(/-/, '_') |
| 112 | + sasl_bind_setup = "sasl_bind_setup_#{normalized_mechanism}" |
| 113 | + next unless respond_to?(sasl_bind_setup, true) |
| 114 | + initial_credential, challenge_response = send(sasl_bind_setup, options) |
| 115 | + |
| 116 | + auths << { |
| 117 | + :method => :sasl, |
| 118 | + :initial_credential => initial_credential, |
| 119 | + :mechanism => mechanism, |
| 120 | + :challenge_response => challenge_response, |
| 121 | + } |
| 122 | + end |
| 123 | + end |
| 124 | + |
| 125 | + def sasl_bind_setup_digest_md5(options) |
| 126 | + bind_dn = options[:username] |
| 127 | + initial_credential = "" |
| 128 | + challenge_response = Proc.new do |cred| |
| 129 | + pref = SASL::Preferences.new :digest_uri => "ldap/#{@host}", :username => bind_dn, :has_password? => true, :password => options[:password]||@password |
| 130 | + sasl = SASL.new("DIGEST-MD5", pref) |
| 131 | + response = sasl.receive("challenge", cred) |
| 132 | + response[1] |
| 133 | + end |
| 134 | + [initial_credential, challenge_response] |
| 135 | + end |
| 136 | + |
| 137 | + def sasl_bind_setup_gss_spnego(options) |
| 138 | + bind_dn = options[:username] |
| 139 | + psw = [bind_dn, options[:password]||@password] |
| 140 | + raise LdapError.new( "invalid binding information" ) unless (bind_dn && psw) |
| 141 | + |
| 142 | + nego = proc {|challenge| |
| 143 | + t2_msg = Net::NTLM::Message.parse( challenge ) |
| 144 | + bind_dn, domain = bind_dn.split('\\').reverse |
| 145 | + t2_msg.target_name = Net::NTLM::encode_utf16le(domain) if domain |
| 146 | + t3_msg = t2_msg.response( {:user => bind_dn, :password => psw}, {:ntlmv2 => true} ) |
| 147 | + t3_msg.serialize |
| 148 | + } |
| 149 | + [Net::NTLM::Message::Type1.new.serialize, nego] |
| 150 | + end |
| 151 | + |
| 152 | + def construct_uri(host, port, ssl) |
| 153 | + protocol = ssl ? "ldaps" : "ldap" |
| 154 | + URI.parse("#{protocol}://#{host}:#{port}").to_s |
| 155 | + end |
| 156 | + end |
| 157 | + end |
| 158 | +end |
0 commit comments