|
| 1 | +# taken from https://github.com/omniauth/omniauth-ldap/blob/master/lib/omniauth-ldap/adaptor.rb |
| 2 | +#this code borrowed pieces from activeldap and net-ldap |
| 3 | +require 'rack' |
| 4 | +require 'net/ldap' |
| 5 | +require 'net/ntlm' |
| 6 | +require 'sasl' |
| 7 | +require 'kconv' |
| 8 | +module OmniAuth |
| 9 | + module LDAP |
| 10 | + class Adaptor |
| 11 | + class LdapError < StandardError; end |
| 12 | + class ConfigurationError < StandardError; end |
| 13 | + class AuthenticationError < StandardError; end |
| 14 | + class ConnectionError < StandardError; end |
| 15 | + |
| 16 | + VALID_ADAPTER_CONFIGURATION_KEYS = [:host, :port, :method, :bind_dn, :password, :try_sasl, :sasl_mechanisms, :uid, :base, :allow_anonymous, :filter] |
| 17 | + |
| 18 | + # A list of needed keys. Possible alternatives are specified using sub-lists. |
| 19 | + MUST_HAVE_KEYS = [:host, :port, :method, [:uid, :filter], :base] |
| 20 | + |
| 21 | + METHOD = { |
| 22 | + :ssl => :simple_tls, |
| 23 | + :tls => :start_tls, |
| 24 | + :plain => nil, |
| 25 | + } |
| 26 | + |
| 27 | + attr_accessor :bind_dn, :password |
| 28 | + attr_reader :connection, :uid, :base, :auth, :filter |
| 29 | + def self.validate(configuration={}) |
| 30 | + message = [] |
| 31 | + MUST_HAVE_KEYS.each do |names| |
| 32 | + names = [names].flatten |
| 33 | + missing_keys = names.select{|name| configuration[name].nil?} |
| 34 | + if missing_keys == names |
| 35 | + message << names.join(' or ') |
| 36 | + end |
| 37 | + end |
| 38 | + raise ArgumentError.new(message.join(",") +" MUST be provided") unless message.empty? |
| 39 | + end |
| 40 | + def initialize(configuration={}) |
| 41 | + Adaptor.validate(configuration) |
| 42 | + @configuration = configuration.dup |
| 43 | + @configuration[:allow_anonymous] ||= false |
| 44 | + @logger = @configuration.delete(:logger) |
| 45 | + VALID_ADAPTER_CONFIGURATION_KEYS.each do |name| |
| 46 | + instance_variable_set("@#{name}", @configuration[name]) |
| 47 | + end |
| 48 | + method = ensure_method(@method) |
| 49 | + config = { |
| 50 | + :host => @host, |
| 51 | + :port => @port, |
| 52 | + :base => @base |
| 53 | + } |
| 54 | + @bind_method = @try_sasl ? :sasl : (@allow_anonymous||!@bind_dn||!@password ? :anonymous : :simple) |
| 55 | + |
| 56 | + |
| 57 | + @auth = sasl_auths({:username => @bind_dn, :password => @password}).first if @bind_method == :sasl |
| 58 | + @auth ||= { :method => @bind_method, |
| 59 | + :username => @bind_dn, |
| 60 | + :password => @password |
| 61 | + } |
| 62 | + config[:auth] = @auth |
| 63 | + config[:encryption] = method |
| 64 | + @connection = Net::LDAP.new(config) |
| 65 | + end |
| 66 | + |
| 67 | + #:base => "dc=yourcompany, dc=com", |
| 68 | + # :filter => "(mail=#{user})", |
| 69 | + # :password => psw |
| 70 | + def bind_as(args = {}) |
| 71 | + result = false |
| 72 | + @connection.open do |me| |
| 73 | + rs = me.search args |
| 74 | + if rs and rs.first and dn = rs.first.dn |
| 75 | + password = args[:password] |
| 76 | + method = args[:method] || @method |
| 77 | + password = password.call if password.respond_to?(:call) |
| 78 | + if method == 'sasl' |
| 79 | + result = rs.first if me.bind(sasl_auths({:username => dn, :password => password}).first) |
| 80 | + else |
| 81 | + result = rs.first if me.bind(:method => :simple, :username => dn, |
| 82 | + :password => password) |
| 83 | + end |
| 84 | + end |
| 85 | + end |
| 86 | + result |
| 87 | + end |
| 88 | + |
| 89 | + private |
| 90 | + def ensure_method(method) |
| 91 | + method ||= "plain" |
| 92 | + normalized_method = method.to_s.downcase.to_sym |
| 93 | + return METHOD[normalized_method] if METHOD.has_key?(normalized_method) |
| 94 | + |
| 95 | + available_methods = METHOD.keys.collect {|m| m.inspect}.join(", ") |
| 96 | + format = "%s is not one of the available connect methods: %s" |
| 97 | + raise ConfigurationError, format % [method.inspect, available_methods] |
| 98 | + end |
| 99 | + |
| 100 | + def sasl_auths(options={}) |
| 101 | + auths = [] |
| 102 | + sasl_mechanisms = options[:sasl_mechanisms] || @sasl_mechanisms |
| 103 | + sasl_mechanisms.each do |mechanism| |
| 104 | + normalized_mechanism = mechanism.downcase.gsub(/-/, '_') |
| 105 | + sasl_bind_setup = "sasl_bind_setup_#{normalized_mechanism}" |
| 106 | + next unless respond_to?(sasl_bind_setup, true) |
| 107 | + initial_credential, challenge_response = send(sasl_bind_setup, options) |
| 108 | + auths << { |
| 109 | + :method => :sasl, |
| 110 | + :initial_credential => initial_credential, |
| 111 | + :mechanism => mechanism, |
| 112 | + :challenge_response => challenge_response |
| 113 | + } |
| 114 | + end |
| 115 | + auths |
| 116 | + end |
| 117 | + |
| 118 | + def sasl_bind_setup_digest_md5(options) |
| 119 | + bind_dn = options[:username] |
| 120 | + initial_credential = "" |
| 121 | + challenge_response = Proc.new do |cred| |
| 122 | + pref = SASL::Preferences.new :digest_uri => "ldap/#{@host}", :username => bind_dn, :has_password? => true, :password => options[:password] |
| 123 | + sasl = SASL.new("DIGEST-MD5", pref) |
| 124 | + response = sasl.receive("challenge", cred) |
| 125 | + response[1] |
| 126 | + end |
| 127 | + [initial_credential, challenge_response] |
| 128 | + end |
| 129 | + |
| 130 | + def sasl_bind_setup_gss_spnego(options) |
| 131 | + bind_dn = options[:username] |
| 132 | + psw = options[:password] |
| 133 | + raise LdapError.new( "invalid binding information" ) unless (bind_dn && psw) |
| 134 | + |
| 135 | + nego = proc {|challenge| |
| 136 | + t2_msg = Net::NTLM::Message.parse( challenge ) |
| 137 | + bind_dn, domain = bind_dn.split('\\').reverse |
| 138 | + t2_msg.target_name = Net::NTLM::encode_utf16le(domain) if domain |
| 139 | + t3_msg = t2_msg.response( {:user => bind_dn, :password => psw}, {:ntlmv2 => true} ) |
| 140 | + t3_msg.serialize |
| 141 | + } |
| 142 | + [Net::NTLM::Message::Type1.new.serialize, nego] |
| 143 | + end |
| 144 | + |
| 145 | + end |
| 146 | + end |
| 147 | +end |
0 commit comments