Rails authentication with LDAP and local database

Question

I am trying to rewrite an older app that was created with PHP/MySQL. The authentication system used has a users table in the database that stores username, email etc... but NOT passwords.

Whenever the user logs in it first checks the database to see if the user exists if not then returns a login error. If the user exists in the local database then it tries to bind to the active directory using the username/password combination entered by the user and creates a session if successful.

What is the best way to accomplish this using Rails?

Are you asking about Rails 4.0+ ?

Ray301
– Ray301

2014-01-09 21:38:10 +00:00
Commented Jan 9, 2014 at 21:38 — Ray301
– Ray301, Commented Jan 9, 2014 at 21:38

Unixmonkey · Accepted Answer · 2012-11-13 21:51:33Z

Ruby's Net::LDAP library is pretty good.

Here's a simplified version of what I've been using for years:

# sessions_controller.rb
def create
  user = User.find_by_login(params[:login])
  if user && Ldap.authenticate(params[:login], params[:password])
    self.current_user = user
    Rails.logger.info "Logged in #{user.name}"
    flash[:notice] = "Successfully Logged In!"
    redirect_back_or_default root_url
  else
    flash[:alert] = "Invalid User credentials"
    render :new
  end
end

# lib/ldap.rb
# Ldap.authenticate('user','password')
# Returns true if validated
# Returns false if invalidated
# Returns nil if LDAP unavailable
require 'net/ldap'
class Ldap
  def self.config
    # this is actually loaded from a yaml config file
    {
      :domain => 'YOURDOMAIN',
      :host   => '10.10.10.100'
    }
  end

  def self.authenticate(login, password)
    conn = Net::LDAP.new(
      :host       => config[:host],
      :port       => 636,
      :base       => "dc=#{config[:domain]}, dc=local",
      :encryption => :simple_tls,
      :auth       => {
        :username => "#{login}@#{config[:domain]}.local",
        :password => password,
        :method   => :simple
      }
    )
    Timeout::timeout(15) do
      return conn.bind ? true : false
    end
  rescue Net::LDAP::LdapError => e
    notify_ldap_admin(config[:host],'Error',e)
    nil
  rescue Timeout::Error => e
    notify_ldap_admin(config[:host],'Timeout',e)
    nil
  end

  def self.notify_ldap_admin(host,error_type,error)
    msg = "LDAP #{error_type} on #{host}"
    RAILS_DEFAULT_LOGGER.debug(msg)
    DeveloperMailer.deliver_ldap_failure_msg(msg,error)
  end
end

ForceMagic · Accepted Answer · 2012-11-13 21:08:43Z

0

Check out the devise and devise_ldap_authenticatable libraries.

edited Nov 13, 2012 at 21:08

ForceMagic

6,42712 gold badges71 silver badges93 bronze badges

answered Nov 13, 2012 at 20:44

spullen

3,32721 silver badges25 bronze badges

4 Comments

VNarasimhaM Over a year ago

from the documentation, devise_ldap_authenticable cannot be used along with database authenticable module.

spullen Over a year ago

You can do it, just have to write your own strategy

Ray301 Over a year ago

Can you explain that more please? Is there another question that digs into that?

spullen Over a year ago

gist.github.com/jancel/1367606 github.com/dfhcc/hybrid_authentication_overridable

Collectives™ on Stack Overflow

Rails authentication with LDAP and local database

2 Answers 2

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related