Redmine

# Modified by Daniel Marczisovszky (marczi@dev-labs.com) 

# to allow dereferencing aliases, START_TLS

require 'ldap'

  validates_length_of :account, :base_dn, :filter, :maximum => 255, :allow_blank => true

  validates_numericality_of :port, :protocol_version, :only_integer => true

    self.protocol_version = 3 if self.protocol_version == 0

  rescue LDAP::Error => text

    raise AuthSourceException.new(text)

  rescue LDAP::Error => text

    raise AuthSourceException.new(text)

      LDAP::Filter.construct(filter)

  rescue LDAP::Error

    #if filter.present? && ldap_filter.nil?

    #  errors.add(:filter, :invalid)

    #end

    logger.debug "Connecting to #{self.host}:#{self.port}, tls=#{self.tls}" if logger && logger.debug?

    if self.tls

      conn = LDAP::SSLConn.new(self.host, self.port, self.starttls)

    else

      conn = LDAP::Conn.new(self.host, self.port)

    end

    logger.debug "Dereference set option" if logger && logger.debug?

    conn.set_option(LDAP::LDAP_OPT_PROTOCOL_VERSION, self.protocol_version)

    conn.set_option(LDAP::LDAP_OPT_DEREF, self.dereference)

    if self.tls && self.starttls

      logger.debug "Certificate set option" if logger && logger.debug?

      conn.set_option(LDAP::LDAP_OPT_X_TLS_REQUIRE_CERT, self.require_cert)

    end

    logger.debug "Trying to bind" if logger && logger.debug?

    if !ldap_user.blank? || !ldap_password.blank? then

      logger.debug "Bind as user #{ldap_user}" if logger && logger.debug?

      conn.bind(ldap_user, ldap_password)

    else

      logger.debug "Anonymous bind" if logger && logger.debug?

      conn.bind

    end

  rescue LDAP::Error => text

    logger.debug "LDAP Connect Error: #{$!}" if logger && logger.debug?

    raise

      begin

        logger.debug "Trying to login as #{dn}" if logger && logger.debug?

        initialize_ldap_con(dn, password)

      rescue LDAP::Error => bindError

        logger.debug "Login failed: #{bindError}" if logger && logger.debug?

        return nil

      end

    #ldap_con = nil

    #if self.account && self.account.include?("$login")

    #  ldap_con = initialize_ldap_con(self.account.sub("$login", Net::LDAP::DN.escape(login)), password)

    #else

    #  ldap_con = initialize_ldap_con(self.account, self.account_password)

    #end

    #login_filter = Net::LDAP::Filter.eq( self.attr_login, login )

    #object_filter = Net::LDAP::Filter.eq( "objectClass", "*" )

    attrs = {}

    #search_filter = object_filter & login_filter

    #if f = ldap_filter

    #  search_filter = search_filter & f

    #end

    #ldap_con.search( :base => self.base_dn,

    #                 :filter => search_filter,

    #                 :attributes=> search_attributes) do |entry|

    # Ticket #1913 by Adi Kriegisch (adi@cg.tuwien.ac.at)

    if self.account.include? "$login" then

      logger.debug "LDAP-Auth with User login" if logger && logger.debug?

      ldap_con = initialize_ldap_con(self.account.sub("$login", encode(login)), password)

      logger.debug "LDAP-Auth with Admin User" if logger && logger.debug?

    if self.filter.empty?

      filter = self.attr_login + "=" + encode(login)

    else

      filter = self.filter.gsub("$login", encode(login))

#    ldap_con.search( :base => self.base_dn, 

#                     :filter => object_filter & login_filter, 

#                     :attributes=> search_attributes) do |entry|

    logger.debug "Search in DN: #{self.base_dn} with filter: #{filter}" if logger && logger.debug?

    ldap_con.search( self.base_dn, LDAP::LDAP_SCOPE_SUBTREE, filter,

                     (onthefly_register? ? ['dn', self.attr_firstname, self.attr_lastname, self.attr_mail] : ['dn'])) { |entry|

    }

  def encode(value)

    value = value.gsub("\\", "\\\\5c")

    value = value.gsub("*", "\\\\2a")

    value = value.gsub("(", "\\\\28")

    value = value.gsub(")", "\\\\29")

    value = value.gsub("\000", "\\\\00")

  end

<%= text_field 'auth_source', 'port', :size => 6 %>

<%= check_box 'auth_source', 'tls' %> LDAPS

<%= check_box 'auth_source', 'starttls' %> START_TLS</p>

<p><label for="auth_source_protocol_version"><%=l(:field_protocol_version)%></label>

<%= select 'auth_source', 'protocol_version', [2, 3] %></p>

<%= text_field 'auth_source', 'account' %></p>

<p><label for="auth_source_require_cert"><%=l(:field_require_cert)%></label>

<%= select 'auth_source', 'require_cert', [ [l(:field_require_cert_never), 0],

                                            [l(:field_require_cert_hard), 1],

                                            [l(:field_require_cert_demand), 2],

                                            [l(:field_require_cert_allow), 3],

                                            [l(:field_require_cert_try), 4] ] %></p>

<p><label for="auth_source_filter"><%=l(:field_filter)%></label><%= text_field 'auth_source', 'filter' %></p>

<p><label for="auth_source_dereference"><%=l(:field_dereference)%></label>

<%= select 'auth_source', 'dereference', [ [l(:field_dereference_never), 0],

                                         [l(:field_dereference_searching), 1],

                                         [l(:field_dereference_finding), 2],

                                         [l(:field_dereference_always), 3] ] %></p>

  field_protocol_version: Protokol Version

  field_filter: Filter

  field_dereference: LDAP Aliase dereferenzieren

  field_dereference_never: Nie (standard)

  field_dereference_searching: Beim suchen

  field_dereference_finding: Beim finden

  field_dereference_always: Immer

  field_require_cert: Zertifikat verlangen

  field_require_cert_never: Nie

  field_require_cert_hard: Hart

  field_require_cert_demand: Anfordern

  field_require_cert_allow: Erlauben

  field_require_cert_try: Versuchen

  field_protocol_version: Protocol version

  field_filter: Filter

  field_dereference: Dereference LDAP aliases

  field_dereference_never: Never (default)

  field_dereference_searching: Searching

  field_dereference_finding: Finding

  field_dereference_always: Always

  field_require_cert: Require certificate

  field_require_cert_never: Never

  field_require_cert_hard: Hard

  field_require_cert_demand: Demand

  field_require_cert_allow: Allow

  field_require_cert_try: Try

class AddAuthSourcesFilterDerefAdvtls < ActiveRecord::Migration

  def self.up

    add_column :auth_sources, :starttls, :boolean, :default => false, :null => false

    add_column :auth_sources, :filter, :string

    add_column :auth_sources, :dereference, :integer

    add_column :auth_sources, :require_cert, :integer

    add_column :auth_sources, :protocol_version, :integer, :default => 3, :null => false

  end

   +  def self.down

    remove_column :auth_sources, :starttls

    remove_column :auth_sources, :filter

    remove_column :auth_sources, :dereference

    remove_column :auth_sources, :require_cert

    remove_column :auth_sources, :protocol_version

  end

end