devise_ldap_authenticatable + devise: can authenticate via ldap with test script, but doesn't work with devise

Question

I can sign in using test code provided from net-ldap gem website, but same setting to login doesn't work with devise on Rails.

This is the server log when I try to log in on Rails using devise.

Started POST "/users/sign_in" for 127.0.0.1 at Fri Mar 22 10:53:39 -0700 2013
Processing by Devise::SessionsController#create as HTML
  Parameters: {"commit"=>"Sign in", "authenticity_token"=>"bEmEPHuI8ob+O67hy0mpgGm12KzFnBNwRuhALAJzmCg=", "user"=>{"remember_me"=>"1", "email"=>"[email protected]", "password"=>"[FILTERED]"}, "utf8"=>"✓"}
  User Load (0.5ms)  SELECT `users`.* FROM `users` WHERE `users`.`email` = '[email protected]' LIMIT 1
  LDAP: LDAP dn lookup: [email protected]
  LDAP: LDAP search for login: [email protected]
  LDAP: Authorizing user [email protected],OU=Users,OU=Users_and_Groups,DC=corp,DC=bigasscorporation,DC=com
  LDAP: LDAP dn lookup: [email protected]
  LDAP: LDAP search for login: [email protected]
DEPRECATION WARNING: an empty resource was given to Devise::Strategies::LdapAuthenticatable#validate. Please ensure the resource is not nil. (called from require at script/rails:6)
Completed 401 Unauthorized in 64ms

The below is some information about my environment

Ruby 1.8.7

Rails 3.2.13

Gems used

gem "devise", "~> 2.2.2"
gem "net-ldap", '~> 0.2.2'
gem "devise_ldap_authenticatable", '~> 0.6.1'

LDAP configs

config/ldap.yml

authorizations: &AUTHORIZATIONS
  group_base: OU=Users,OU=Users_and_Groups,DC=corp,DC=somebigasscorporation,DC=com
  required_groups:
    - cn=Users,OU=Users_and_Groups,DC=corp,DC=somebigasscorporation,DC=com
    - OU=Users,OU=Users_and_Groups,DC=corp,DC=somebigasscorporation,DC=com
    - ["moreMembers", "cn=users,ou=groups,dc=test,dc=com"]
  require_attribute:
    objectClass: inetOrgPerson
    authorizationRole: postsAdmin

## Enviornments

development:
  host: xxx.corp.somebigasscorporation.com
  port: 3268
  attribute: mail
  base: OU=Users,OU=Users_and_Groups,DC=corp,DC=somebigasscorporation,DC=com
  # admin_user: cn=admin,dc=test,dc=com
  # admin_password: admin_password
  ssl: false
  # <<: *AUTHORIZATIONS

config/initializers/devise.rb

Devise.setup do |config|
  config.ldap_create_user = true

  ...

The test code that works

require 'rubygems'
require 'net/ldap'
require 'highline/import'

ldap = Net::LDAP.new
ldap.host = "xxx.corp.bigasscorporation.com"
ldap.port = "3268"
ldap.base = "OU=Users,OU=Users_and_Groups,DC=corp,DC=bigasscorporation,DC=com"
ldap.auth "[email protected]", "xxxXXXyyy"

if ldap.bind
  p "Success!!"
  p ldap
  p ldap.base
  p ldap.get_operation_result
else
  p "Failed!"
  p ldap.get_operation_result
end

# => "Success!!"
#<Net::LDAP:0x007fc393a22660 @host="xxx.corp.bigasscorporation.com", @port="3268", @verbose=false, @auth={:method=>:simple, :username=>"[email protected]", :password=>"xxxXXXyyy"}, @base="OU=Users,OU=Users_and_Groups,DC=corp,DC=bigasscorporation,DC=com", @encryption=nil, @open_connection=nil, @result=0>
"OU=Users,OU=Users_and_Groups,DC=corp,DC=bigasscorporation,DC=com"
#<OpenStruct code=0, message="Success">

Jason Kim · Accepted Answer · 2013-03-22 19:52:27Z

5

I needed this in devise.rb

config.ldap_auth_username_builder = Proc.new() {|attribute, login, ldap| "#{login}" }

answered Mar 22, 2013 at 19:52

Jason Kim

19.2k13 gold badges70 silver badges106 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Brad Rice · Accepted Answer · 2013-06-01 23:30:44Z

In case anyone else has this same issue, I found a slight problem with the ldap_auth_username_builder fix. I was also trying to set some authorizations on required attributes in the .yml file, and I was getting a lot of strange errors after ldap.search methods were being called by the gem. In particular, a lot of calling .try(:first) on a search that returned nil.

I ended up digging around in the gem's lib directory and tweaked some code for better logging. Turns out, when I added config.ldap_auth_username_builder, I was actually tricking the system to believe it found a record when it really wasn't. I wasn't able to specify attributes for these records because there was no record to begin with. If you guys are trying to do something similar, like check group membership or the like, I would suggest triple-checking that your attribute value in the ldap.yml file is set to a valid attr and that you're giving it the right information, so it can find what you need on the LDAP end.

Collectives™ on Stack Overflow

devise_ldap_authenticatable + devise: can authenticate via ldap with test script, but doesn't work with devise

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related