annotate .svn/pristine/28/287b739e36a269ed72c54dcd10ebdefa5f23d6ee.svn-base @ 1327:287f201c2802 redmine-2.2-integration

Add italic
author Chris Cannam <chris.cannam@soundsoftware.ac.uk>
date Wed, 19 Jun 2013 20:56:22 +0100
parents 038ba2d95de8
children
rev   line source
Chris@1296 1 # Redmine - project management software
Chris@1296 2 # Copyright (C) 2006-2012 Jean-Philippe Lang
Chris@1296 3 #
Chris@1296 4 # This program is free software; you can redistribute it and/or
Chris@1296 5 # modify it under the terms of the GNU General Public License
Chris@1296 6 # as published by the Free Software Foundation; either version 2
Chris@1296 7 # of the License, or (at your option) any later version.
Chris@1296 8 #
Chris@1296 9 # This program is distributed in the hope that it will be useful,
Chris@1296 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
Chris@1296 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
Chris@1296 12 # GNU General Public License for more details.
Chris@1296 13 #
Chris@1296 14 # You should have received a copy of the GNU General Public License
Chris@1296 15 # along with this program; if not, write to the Free Software
Chris@1296 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
Chris@1296 17
Chris@1296 18 require 'iconv'
Chris@1296 19 require 'net/ldap'
Chris@1296 20 require 'net/ldap/dn'
Chris@1296 21 require 'timeout'
Chris@1296 22
Chris@1296 23 class AuthSourceLdap < AuthSource
Chris@1296 24 validates_presence_of :host, :port, :attr_login
Chris@1296 25 validates_length_of :name, :host, :maximum => 60, :allow_nil => true
Chris@1296 26 validates_length_of :account, :account_password, :base_dn, :filter, :maximum => 255, :allow_blank => true
Chris@1296 27 validates_length_of :attr_login, :attr_firstname, :attr_lastname, :attr_mail, :maximum => 30, :allow_nil => true
Chris@1296 28 validates_numericality_of :port, :only_integer => true
Chris@1296 29 validates_numericality_of :timeout, :only_integer => true, :allow_blank => true
Chris@1296 30 validate :validate_filter
Chris@1296 31
Chris@1296 32 before_validation :strip_ldap_attributes
Chris@1296 33
Chris@1296 34 def initialize(attributes=nil, *args)
Chris@1296 35 super
Chris@1296 36 self.port = 389 if self.port == 0
Chris@1296 37 end
Chris@1296 38
Chris@1296 39 def authenticate(login, password)
Chris@1296 40 return nil if login.blank? || password.blank?
Chris@1296 41
Chris@1296 42 with_timeout do
Chris@1296 43 attrs = get_user_dn(login, password)
Chris@1296 44 if attrs && attrs[:dn] && authenticate_dn(attrs[:dn], password)
Chris@1296 45 logger.debug "Authentication successful for '#{login}'" if logger && logger.debug?
Chris@1296 46 return attrs.except(:dn)
Chris@1296 47 end
Chris@1296 48 end
Chris@1296 49 rescue Net::LDAP::LdapError => e
Chris@1296 50 raise AuthSourceException.new(e.message)
Chris@1296 51 end
Chris@1296 52
Chris@1296 53 # test the connection to the LDAP
Chris@1296 54 def test_connection
Chris@1296 55 with_timeout do
Chris@1296 56 ldap_con = initialize_ldap_con(self.account, self.account_password)
Chris@1296 57 ldap_con.open { }
Chris@1296 58 end
Chris@1296 59 rescue Net::LDAP::LdapError => e
Chris@1296 60 raise AuthSourceException.new(e.message)
Chris@1296 61 end
Chris@1296 62
Chris@1296 63 def auth_method_name
Chris@1296 64 "LDAP"
Chris@1296 65 end
Chris@1296 66
Chris@1296 67 private
Chris@1296 68
Chris@1296 69 def with_timeout(&block)
Chris@1296 70 timeout = self.timeout
Chris@1296 71 timeout = 20 unless timeout && timeout > 0
Chris@1296 72 Timeout.timeout(timeout) do
Chris@1296 73 return yield
Chris@1296 74 end
Chris@1296 75 rescue Timeout::Error => e
Chris@1296 76 raise AuthSourceTimeoutException.new(e.message)
Chris@1296 77 end
Chris@1296 78
Chris@1296 79 def ldap_filter
Chris@1296 80 if filter.present?
Chris@1296 81 Net::LDAP::Filter.construct(filter)
Chris@1296 82 end
Chris@1296 83 rescue Net::LDAP::LdapError
Chris@1296 84 nil
Chris@1296 85 end
Chris@1296 86
Chris@1296 87 def validate_filter
Chris@1296 88 if filter.present? && ldap_filter.nil?
Chris@1296 89 errors.add(:filter, :invalid)
Chris@1296 90 end
Chris@1296 91 end
Chris@1296 92
Chris@1296 93 def strip_ldap_attributes
Chris@1296 94 [:attr_login, :attr_firstname, :attr_lastname, :attr_mail].each do |attr|
Chris@1296 95 write_attribute(attr, read_attribute(attr).strip) unless read_attribute(attr).nil?
Chris@1296 96 end
Chris@1296 97 end
Chris@1296 98
Chris@1296 99 def initialize_ldap_con(ldap_user, ldap_password)
Chris@1296 100 options = { :host => self.host,
Chris@1296 101 :port => self.port,
Chris@1296 102 :encryption => (self.tls ? :simple_tls : nil)
Chris@1296 103 }
Chris@1296 104 options.merge!(:auth => { :method => :simple, :username => ldap_user, :password => ldap_password }) unless ldap_user.blank? && ldap_password.blank?
Chris@1296 105 Net::LDAP.new options
Chris@1296 106 end
Chris@1296 107
Chris@1296 108 def get_user_attributes_from_ldap_entry(entry)
Chris@1296 109 {
Chris@1296 110 :dn => entry.dn,
Chris@1296 111 :firstname => AuthSourceLdap.get_attr(entry, self.attr_firstname),
Chris@1296 112 :lastname => AuthSourceLdap.get_attr(entry, self.attr_lastname),
Chris@1296 113 :mail => AuthSourceLdap.get_attr(entry, self.attr_mail),
Chris@1296 114 :auth_source_id => self.id
Chris@1296 115 }
Chris@1296 116 end
Chris@1296 117
Chris@1296 118 # Return the attributes needed for the LDAP search. It will only
Chris@1296 119 # include the user attributes if on-the-fly registration is enabled
Chris@1296 120 def search_attributes
Chris@1296 121 if onthefly_register?
Chris@1296 122 ['dn', self.attr_firstname, self.attr_lastname, self.attr_mail]
Chris@1296 123 else
Chris@1296 124 ['dn']
Chris@1296 125 end
Chris@1296 126 end
Chris@1296 127
Chris@1296 128 # Check if a DN (user record) authenticates with the password
Chris@1296 129 def authenticate_dn(dn, password)
Chris@1296 130 if dn.present? && password.present?
Chris@1296 131 initialize_ldap_con(dn, password).bind
Chris@1296 132 end
Chris@1296 133 end
Chris@1296 134
Chris@1296 135 # Get the user's dn and any attributes for them, given their login
Chris@1296 136 def get_user_dn(login, password)
Chris@1296 137 ldap_con = nil
Chris@1296 138 if self.account && self.account.include?("$login")
Chris@1296 139 ldap_con = initialize_ldap_con(self.account.sub("$login", Net::LDAP::DN.escape(login)), password)
Chris@1296 140 else
Chris@1296 141 ldap_con = initialize_ldap_con(self.account, self.account_password)
Chris@1296 142 end
Chris@1296 143 login_filter = Net::LDAP::Filter.eq( self.attr_login, login )
Chris@1296 144 object_filter = Net::LDAP::Filter.eq( "objectClass", "*" )
Chris@1296 145 attrs = {}
Chris@1296 146
Chris@1296 147 search_filter = object_filter & login_filter
Chris@1296 148 if f = ldap_filter
Chris@1296 149 search_filter = search_filter & f
Chris@1296 150 end
Chris@1296 151
Chris@1296 152 ldap_con.search( :base => self.base_dn,
Chris@1296 153 :filter => search_filter,
Chris@1296 154 :attributes=> search_attributes) do |entry|
Chris@1296 155
Chris@1296 156 if onthefly_register?
Chris@1296 157 attrs = get_user_attributes_from_ldap_entry(entry)
Chris@1296 158 else
Chris@1296 159 attrs = {:dn => entry.dn}
Chris@1296 160 end
Chris@1296 161
Chris@1296 162 logger.debug "DN found for #{login}: #{attrs[:dn]}" if logger && logger.debug?
Chris@1296 163 end
Chris@1296 164
Chris@1296 165 attrs
Chris@1296 166 end
Chris@1296 167
Chris@1296 168 def self.get_attr(entry, attr_name)
Chris@1296 169 if !attr_name.blank?
Chris@1296 170 entry[attr_name].is_a?(Array) ? entry[attr_name].first : entry[attr_name]
Chris@1296 171 end
Chris@1296 172 end
Chris@1296 173 end