--- /dev/null
+commit 936a14e225037aca4cdeac11c843c7985e636c88
+Author: Ismaël Bouya <ismael.bouya@normalesup.org>
+Date: Mon Jul 24 19:58:24 2017 +0200
+
+ Add LDAP to diaspora
+
+diff --git a/Gemfile b/Gemfile
+index 414b0138d..2a934e9c9 100644
+--- a/Gemfile
++++ b/Gemfile
+@@ -217,6 +217,9 @@ gem "thor", "0.19.1"
+
+ # gem "therubyracer", :platform => :ruby
+
++# LDAP
++gem 'net-ldap', '~> 0.16'
++
+ group :production do # we don"t install these on travis to speed up test runs
+ # Analytics
+
+diff --git a/Gemfile.lock b/Gemfile.lock
+index 84f8172e4..cdbf19fcd 100644
+--- a/Gemfile.lock 2019-01-13 19:55:52.538561762 +0100
++++ b/Gemfile.lock 2019-01-13 19:58:11.087099067 +0100
+@@ -398,6 +398,7 @@
+ mysql2 (0.5.2)
+ naught (1.1.0)
+ nenv (0.3.0)
++ net-ldap (0.16.1)
+ nio4r (2.3.1)
+ nokogiri (1.8.5)
+ mini_portile2 (~> 2.3.0)
+@@ -820,6 +821,7 @@
+ minitest
+ mobile-fu (= 1.4.0)
+ mysql2 (= 0.5.2)
++ net-ldap (~> 0.16)
+ nokogiri (= 1.8.5)
+ omniauth (= 1.8.1)
+ omniauth-tumblr (= 1.2)
+diff --git a/app/models/user.rb b/app/models/user.rb
+index 940a48f25..d1e2beeee 100644
+--- a/app/models/user.rb
++++ b/app/models/user.rb
+@@ -337,6 +337,12 @@ class User < ActiveRecord::Base
+ end
+
+ def send_confirm_email
++ if skip_email_confirmation?
++ self.email = unconfirmed_email
++ self.unconfirmed_email = nil
++ save
++ end
++
+ return if unconfirmed_email.blank?
+ Workers::Mail::ConfirmEmail.perform_async(id)
+ end
+@@ -554,6 +560,14 @@ class User < ActiveRecord::Base
+ end
+ end
+
++ def ldap_user?
++ AppConfig.ldap.enable? && ldap_dn.present?
++ end
++
++ def skip_email_confirmation?
++ ldap_user? && AppConfig.ldap.skip_email_confirmation?
++ end
++
+ private
+
+ def clearable_fields
+diff --git a/config/defaults.yml b/config/defaults.yml
+index c046aff07..66e9afa13 100644
+--- a/config/defaults.yml
++++ b/config/defaults.yml
+@@ -202,6 +202,20 @@ defaults:
+ scope: tags
+ include_user_tags: false
+ pod_tags:
++ ldap:
++ enable: false
++ host: localhost
++ port: 389
++ only_ldap: true
++ mail_attribute: mail
++ skip_email_confirmation: true
++ use_bind_dn: true
++ bind_dn: "cn=diaspora,dc=example,dc=com"
++ bind_pw: "password"
++ search_base: "dc=example,dc=com"
++ search_filter: "uid=%{username}"
++ bind_template: "uid=%{username},dc=example,dc=com"
++
+
+ development:
+ environment:
+diff --git a/config/diaspora.yml.example b/config/diaspora.yml.example
+index b2573625d..c357c8651 100644
+--- a/config/diaspora.yml.example
++++ b/config/diaspora.yml.example
+@@ -710,6 +710,36 @@ configuration: ## Section
+ ## If scope is 'tags', a comma separated list of tags here can be set.
+ ## For example "linux,diaspora", to receive posts related to these tags
+ #pod_tags:
++ ldap:
++ # Uncomment next line if you want to use LDAP on your instance
++ enable: true
++ host: localhost
++ port: 389
++ # Use only LDAP authentication (don't try other means)
++ only_ldap: true
++ # LDAP attribute to find the user's e-mail. Necessary to create accounts
++ # for not existing users
++ mail_attribute: mail
++ # Skip e-mail confirmation when creating an account via LDAP.
++ skip_email_confirmation: true
++ # ----- Using bind_dn and bind_pw
++ # bind_dn and bind_pw may be used if the diaspora instance
++ # should be able to connect to LDAP to find and search for users.
++
++ use_bind_dn: true
++ bind_dn: "cn=diaspora,dc=example,dc=com"
++ bind_pw: "password"
++ search_base: "dc=example,dc=com"
++ # This is the filter with which to search for the user. %{username} will
++ # be replaced by the given login.
++ search_filter: "uid=%{username}"
++ #
++ # ----- Using template
++ # This setting doesn't require a diaspora LDAP user. Use a template, and
++ # diaspora will try to login with the templated dn and password
++ #
++ # bind_template: "uid=%{username},dc=example,dc=com"
++
+
+ ## Here you can override settings defined above if you need
+ ## to have them different in different environments.
+diff --git a/config/initializers/0_ldap_authenticatable.rb b/config/initializers/0_ldap_authenticatable.rb
+new file mode 100644
+index 000000000..49846502f
+--- /dev/null
++++ b/config/initializers/0_ldap_authenticatable.rb
+@@ -0,0 +1,82 @@
++require 'net/ldap'
++require 'devise/strategies/authenticatable'
++
++module Devise
++ module Strategies
++ class LdapAuthenticatable < Authenticatable
++ def valid?
++ AppConfig.ldap.enable? && params[:user].present?
++ end
++
++ def authenticate!
++ ldap = Net::LDAP.new(
++ host: AppConfig.ldap.host,
++ port: AppConfig.ldap.port,
++ encryption: :simple_tls,
++ )
++
++ if AppConfig.ldap.use_bind_dn?
++ ldap.auth AppConfig.ldap.bind_dn, AppConfig.ldap.bind_pw
++
++ if !ldap.bind
++ return fail(:ldap_configuration_error)
++ end
++
++ search_filter = AppConfig.ldap.search_filter % { username: params[:user][:username] }
++
++ result = ldap.search(base: AppConfig.ldap.search_base, filter: search_filter, result_set: true)
++
++ if result.count != 1
++ return login_fail
++ end
++
++ user_dn = result.first.dn
++ user_email = result.first[AppConfig.ldap.mail_attribute].first
++ else
++ user_dn = AppConfig.ldap.bind_template % { username: params[:user][:username] }
++ end
++
++ ldap.auth user_dn, params[:user][:password]
++
++ if ldap.bind
++ user = User.find_by(ldap_dn: user_dn)
++
++ # We don't want to trust too much the email attribute from
++ # LDAP: if the user can edit it himself, he may login as
++ # anyone
++ if user.nil?
++ if !AppConfig.ldap.use_bind_dn?
++ result = ldap.search(base: user_dn, scope: Net::LDAP::SearchScope_BaseObject, filter: "(objectClass=*)", result_set: true)
++ user_email = result.first[AppConfig.ldap.mail_attribute].first
++ end
++
++ if user_email.present? && User.find_by(email: user_email).nil?
++ # Password is used for remember_me token
++ user = User.build(email: user_email, ldap_dn: user_dn, password: SecureRandom.hex, username: params[:user][:username])
++ user.save
++ user.seed_aspects
++ elsif User.find_by(email: user_email).present?
++ return fail(:ldap_existing_email)
++ else
++ return fail(:ldap_cannot_create_account_without_email)
++ end
++ end
++
++ success!(user)
++ else
++ return login_fail
++ end
++ end
++
++ def login_fail
++ if AppConfig.ldap.only_ldap?
++ return fail(:ldap_invalid_login)
++ else
++ return pass
++ end
++ end
++ end
++ end
++end
++
++Warden::Strategies.add(:ldap_authenticatable, Devise::Strategies::LdapAuthenticatable)
+diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
+index 3698e2373..14e88063e 100644
+--- a/config/initializers/devise.rb
++++ b/config/initializers/devise.rb
+@@ -250,10 +250,9 @@ Devise.setup do |config|
+ # If you want to use other strategies, that are not supported by Devise, or
+ # change the failure app, you can configure them inside the config.warden block.
+ #
+- # config.warden do |manager|
+- # manager.intercept_401 = false
+- # manager.default_strategies(:scope => :user).unshift :some_external_strategy
+- # end
++ config.warden do |manager|
++ manager.default_strategies(scope: :user).unshift :ldap_authenticatable
++ end
+
+ # ==> Mountable engine configurations
+ # When using Devise inside an engine, let's call it `MyEngine`, and this engine
+diff --git a/db/migrate/20170724182100_add_ldap_dn_to_users.rb b/db/migrate/20170724182100_add_ldap_dn_to_users.rb
+new file mode 100644
+index 000000000..f5cc84d11
+--- /dev/null
++++ b/db/migrate/20170724182100_add_ldap_dn_to_users.rb
+@@ -0,0 +1,6 @@
++class AddLdapDnToUsers < ActiveRecord::Migration
++ def change
++ add_column :users, :ldap_dn, :text, null: true, default: nil
++ add_index :users, ['ldap_dn'], :length => { "ldap_dn" => 191 }
++ end
++end
projects / perso / Immae / Config / Nix.git / blobdiff