fedi/mastodon
1
0
Fork 1
mirror of https://github.com/mastodon/mastodon.git synced 2024-11-25 15:09:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add LDAP_TLS_NO_VERIFY option, don't require LDAP_ENABLED outside .env (#6845)

Browse source 
Fix #6816, fix #6790
This commit is contained in:
Eugen Rochko 2018-03-20 19:41:51 +01:00 committed by GitHub
parent 61dcb686a8
commit ac49c7932d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 43 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
config/initializers/devise.rb
View file

@ -55,6 +55,8 @@ module Devise
@@ldap_bind_dn = nil @@ldap_bind_dn = nil
mattr_accessor :ldap_password mattr_accessor :ldap_password
@@ldap_password = nil @@ldap_password = nil
mattr_accessor :ldap_tls_no_verify
@@ldap_tls_no_verify = false
class Strategies::PamAuthenticatable class Strategies::PamAuthenticatable
def valid? def valid?
@ -357,5 +359,6 @@ Devise.setup do |config|
config.ldap_bind_dn = ENV.fetch('LDAP_BIND_DN') config.ldap_bind_dn = ENV.fetch('LDAP_BIND_DN')
config.ldap_password = ENV.fetch('LDAP_PASSWORD') config.ldap_password = ENV.fetch('LDAP_PASSWORD')
config.ldap_uid = ENV.fetch('LDAP_UID', 'cn') config.ldap_uid = ENV.fetch('LDAP_UID', 'cn')
config.ldap_tls_no_verify = ENV['LDAP_TLS_NO_VERIFY'] == 'true'
end end
end end

76
lib/devise/ldap_authenticatable.rb
View file

@ -1,49 +1,53 @@
# frozen_string_literal: true # frozen_string_literal: true
if ENV['LDAP_ENABLED'] == 'true' require 'net/ldap'
require 'net/ldap' require 'devise/strategies/authenticatable'
require 'devise/strategies/authenticatable'
module Devise module Devise
module Strategies module Strategies
class LdapAuthenticatable < Authenticatable class LdapAuthenticatable < Authenticatable
def authenticate! def authenticate!
if params[:user] if params[:user]
ldap = Net::LDAP.new( ldap = Net::LDAP.new(
host: Devise.ldap_host, host: Devise.ldap_host,
port: Devise.ldap_port, port: Devise.ldap_port,
base: Devise.ldap_base, base: Devise.ldap_base,
encryption: { encryption: {
method: Devise.ldap_method, method: Devise.ldap_method,
tls_options: OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, tls_options: tls_options,
}, },
auth: { auth: {
method: :simple, method: :simple,
username: Devise.ldap_bind_dn, username: Devise.ldap_bind_dn,
password: Devise.ldap_password, password: Devise.ldap_password,
}, },
connect_timeout: 10 connect_timeout: 10
) )
if (user_info = ldap.bind_as(base: Devise.ldap_base, filter: "(#{Devise.ldap_uid}=#{email})", password: password)) if (user_info = ldap.bind_as(base: Devise.ldap_base, filter: "(#{Devise.ldap_uid}=#{email})", password: password))
user = User.ldap_get_user(user_info.first) user = User.ldap_get_user(user_info.first)
success!(user) success!(user)
else else
return fail(:invalid_login) return fail(:invalid_login)
end
end end
end end
end
def email def email
params[:user][:email] params[:user][:email]
end end
def password def password
params[:user][:password] params[:user][:password]
end
def tls_options
OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.tap do |options|
options[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if Devise.ldap_tls_no_verify
end end
end end
end end
end end
Warden::Strategies.add(:ldap_authenticatable, Devise::Strategies::LdapAuthenticatable)
end end
Warden::Strategies.add(:ldap_authenticatable, Devise::Strategies::LdapAuthenticatable)