LDAP through Ruby or Rails

问题:

I've been attempting to hook a Rails application up to ActiveDirectory. I'll be synchronizing data about users between AD and a database, currently MySQL (but may turn into SQL Server or PostgreSQL).

I've checked out activedirectory-ruby, and it looks really buggy (for a 1.0 release!?). It wraps Net::LDAP, so I tried using that instead, but it's really close to the actual syntax of LDAP, and I enjoyed the abstraction of ActiveDirectory-Ruby because of its ActiveRecord-like syntax.

Is there an elegant ORM-type tool for a directory server? Better yet, if there were some kind of scaffolding tool for LDAP (CRUD for users, groups, organizational units, and so on). Then I could quickly integrate that with my existing authentication code though Authlogic, and keep all of the data synchronized.

回答1:

Here is sample code I use with the net-ldap gem to verify user logins from the ActiveDirectory server at my work:

require 'net/ldap' # gem install net-ldap

def name_for_login( email, password )
  email = email[/\A\w+/].downcase  # Throw out the domain, if it was there
  email << "@mycompany.com"        # I only check people in my company
  ldap = Net::LDAP.new(
    host: 'ldap.mycompany.com',    # Thankfully this is a standard name
    auth: { method: :simple, email: email, password:password }
  )
  if ldap.bind
    # Yay, the login credentials were valid!
    # Get the user's full name and return it
    ldap.search(
      base:         "OU=Users,OU=Accounts,DC=mycompany,DC=com",
      filter:       Net::LDAP::Filter.eq( "mail", email ),
      attributes:   %w[ displayName ],
      return_result:true
    ).first.displayName.first
  end
end

The first.displayName.first code at the end looks a little goofy, and so might benefit from some explanation:

• Net::LDAP#search always returns an array of results, even if you end up matching only one entry. The first call to first finds the first (and presumably only) entry that matched the email address.

• The Net::LDAP::Entry returned by the search conveniently lets you access attributes via method name, so some_entry.displayName is the same as some_entry['displayName'].

• Every attribute in a Net::LDAP::Entry is always an array of values, even when only one value is present. Although it might be silly to have a user with multiple "displayName" values, LDAP's generic nature means that it's possible. The final first invocation turns the array-of-one-string into just the string for the user's full name.

回答2:

Have you tried looking at these:

http://saush.wordpress.com/2006/07/18/rubyrails-user-authentication-with-microsoft-active-directory/

http://xaop.com/blog/2008/06/17/simple-windows-active-directory-ldap-authentication-with-rails/

回答3:

This is more anecdotal than a real answer...

I had a similar experience using Samba and OpenLDAP server. I couldn't find a library to really do what I wanted so I rolled my own helper classes.

I used ldapbrowser to see what fields Samba filled in when I created a user the "official" way and and basically duplicated that.

The only tricky/non-standard LDAP thing was the crazy password encryption we have:

userPass:

"{MD5}" + Base64.encode64(Digest::MD5.digest(pass))

sambaNTPassword:

OpenSSL::Digest::MD4.hexdigest(Iconv.iconv("UCS-2", "UTF-8", pass).join).upcase

For the def authenticate(user, pass) function I try to get LDAP to bind to the domain using their credentials, if I catch an exception then the login failed, otherwise let them in.

回答4:

Sorry, cannot comment yet... perhaps someone can relocate this appropriately.

@Phrogz's solution works well, but bind_simple (inside bind) raises an Net::LDAP::LdapError exception due to auth[:username] not being set as shown here:

https://github.com/ruby-ldap/ruby-net-ldap/blob/master/lib/net/ldap.rb

The corrected replaces:

auth: { method: :simple, email: email, password:password }

with:

auth: { method: :simple, username: email, password:password }

回答5:

I began using ruby-activedirectory, and even extended it/fixed a few things, hosting judy-activedirectory in Github.

Doing the next iteration, I've discovered ActiveLdap has a much better code base, and I'm seriously contemplating switching to it. Does anyone have personal experience with this?

回答6:

Have you checked out thoughtbot's ldap-activerecord-gateway? It might be something for you to consider...

http://github.com/thoughtbot/ldap-activerecord-gateway/tree/master