mirror of
https://github.com/zammad/zammad
synced 2026-05-24 09:48:36 +00:00
124 lines
3.2 KiB
Ruby
124 lines
3.2 KiB
Ruby
# Copyright (C) 2012-2013 Zammad Foundation, http://zammad-foundation.org/
|
|
|
|
require 'net/ldap'
|
|
|
|
module Auth::Ldap
|
|
def self.check(username, password, config, user)
|
|
|
|
scope = Net::LDAP::SearchScope_WholeSubtree
|
|
|
|
# ldap connect
|
|
ldap = Net::LDAP.new( host: config[:host], port: config[:port] )
|
|
|
|
# set auth data if needed
|
|
if config[:bind_dn] && config[:bind_pw]
|
|
ldap.auth config[:bind_dn], config[:bind_pw]
|
|
end
|
|
|
|
# ldap bind
|
|
begin
|
|
if !ldap.bind
|
|
Rails.logger.info "Can't bind to '#{config[:host]}', #{ldap.get_operation_result.code}, #{ldap.get_operation_result.message}"
|
|
return
|
|
end
|
|
rescue => e
|
|
Rails.logger.info "Can't connect to '#{config[:host]}', #{e}"
|
|
return
|
|
end
|
|
|
|
# search user
|
|
filter = "(#{config[:uid]}=#{username})"
|
|
if config[:always_filter] && !config[:always_filter].empty?
|
|
filter = "(&#{filter}#{config[:always_filter]})"
|
|
end
|
|
user_dn = nil
|
|
user_data = {}
|
|
ldap.search( base: config[:base], filter: filter, scope: scope ) do |entry|
|
|
user_data = {}
|
|
user_dn = entry.dn
|
|
|
|
# remember attributes for :sync_params
|
|
entry.each do |attribute, values|
|
|
user_data[ attribute.downcase.to_sym ] = ''
|
|
values.each do |value|
|
|
user_data[ attribute.downcase.to_sym ] = value
|
|
end
|
|
end
|
|
end
|
|
|
|
if user_dn.nil?
|
|
Rails.logger.info "ldap entry found for user '#{username}' with filter #{filter} failed!"
|
|
return nil
|
|
end
|
|
|
|
# try ldap bind with user credentals
|
|
auth = ldap.authenticate user_dn, password
|
|
if !ldap.bind( auth )
|
|
Rails.logger.info "ldap bind with '#{user_dn}' failed!"
|
|
return false
|
|
end
|
|
|
|
# create/update user
|
|
if config[:sync_params]
|
|
user_attributes = {
|
|
source: 'ldap',
|
|
updated_by_id: 1,
|
|
}
|
|
config[:sync_params].each {|local_data, ldap_data|
|
|
if user_data[ ldap_data.downcase.to_sym ]
|
|
user_attributes[ local_data.downcase.to_sym] = user_data[ ldap_data.downcase.to_sym ]
|
|
end
|
|
}
|
|
if !user
|
|
user_attributes[:created_by_id] = 1
|
|
user = User.create( user_attributes )
|
|
Rails.logger.debug "user created '#{user.login}'"
|
|
else
|
|
user.update_attributes( user_attributes )
|
|
Rails.logger.debug "user updated '#{user.login}'"
|
|
end
|
|
end
|
|
|
|
# return if it was not possible to create user
|
|
return if !user
|
|
|
|
# sync roles
|
|
# FIXME
|
|
|
|
# sync groups
|
|
# FIXME
|
|
|
|
# set always roles
|
|
if config[:always_roles]
|
|
role_ids = user.role_ids
|
|
config[:always_roles].each {|role_name|
|
|
role = Role.where( name: role_name ).first
|
|
next if !role
|
|
if !role_ids.include?( role.id )
|
|
role_ids.push role.id
|
|
end
|
|
}
|
|
user.role_ids = role_ids
|
|
user.save
|
|
end
|
|
|
|
# set always groups
|
|
if config[:always_groups]
|
|
group_ids = user.group_ids
|
|
config[:always_groups].each {|group_name|
|
|
group = Group.where( name: group_name ).first
|
|
next if !group
|
|
if !group_ids.include?( group.id )
|
|
group_ids.push group.id
|
|
end
|
|
}
|
|
user.group_ids = group_ids
|
|
user.save
|
|
end
|
|
|
|
# take session down
|
|
# - not needed, done by Net::LDAP -
|
|
|
|
user
|
|
end
|
|
end
|