Add rompr

[perso/Immae/Config/Nix.git] / virtual / modules / websites / tools / diaspora / ldap.patch

commit 936a14e225037aca4cdeac11c843c7985e636c88
Author: Ismaël Bouya <ismael.bouya@normalesup.org>
Date:   Mon Jul 24 19:58:24 2017 +0200

    Add LDAP to diaspora

diff --git a/Gemfile b/Gemfile
index 414b0138d..2a934e9c9 100644
--- a/Gemfile
+++ b/Gemfile
@@ -217,6 +217,9 @@ gem "thor", "0.19.1"
 
 # gem "therubyracer", :platform => :ruby
 
+# LDAP
+gem 'net-ldap', '~> 0.16'
+
 group :production do # we don"t install these on travis to speed up test runs
   # Analytics
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 84f8172e4..cdbf19fcd 100644
--- a/Gemfile.lock	2019-01-13 19:55:52.538561762 +0100
+++ b/Gemfile.lock	2019-01-13 19:58:11.087099067 +0100
@@ -398,6 +398,7 @@
     mysql2 (0.5.2)
     naught (1.1.0)
     nenv (0.3.0)
+    net-ldap (0.16.1)
     nio4r (2.3.1)
     nokogiri (1.8.5)
       mini_portile2 (~> 2.3.0)
@@ -820,6 +821,7 @@
   minitest
   mobile-fu (= 1.4.0)
   mysql2 (= 0.5.2)
+  net-ldap (~> 0.16)
   nokogiri (= 1.8.5)
   omniauth (= 1.8.1)
   omniauth-tumblr (= 1.2)
diff --git a/app/models/user.rb b/app/models/user.rb
index 940a48f25..d1e2beeee 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -337,6 +337,12 @@ class User < ActiveRecord::Base
   end
 
   def send_confirm_email
+    if skip_email_confirmation?
+      self.email = unconfirmed_email
+      self.unconfirmed_email = nil
+      save
+    end
+
     return if unconfirmed_email.blank?
     Workers::Mail::ConfirmEmail.perform_async(id)
   end
@@ -554,6 +560,14 @@ class User < ActiveRecord::Base
     end
   end
 
+  def ldap_user?
+    AppConfig.ldap.enable? && ldap_dn.present?
+  end
+
+  def skip_email_confirmation?
+    ldap_user? && AppConfig.ldap.skip_email_confirmation?
+  end
+
   private
 
   def clearable_fields
diff --git a/config/defaults.yml b/config/defaults.yml
index c046aff07..66e9afa13 100644
--- a/config/defaults.yml
+++ b/config/defaults.yml
@@ -202,6 +202,20 @@ defaults:
       scope: tags
       include_user_tags: false
       pod_tags:
+  ldap:
+    enable: false
+    host: localhost
+    port: 389
+    only_ldap: true
+    mail_attribute: mail
+    skip_email_confirmation: true
+    use_bind_dn: true
+    bind_dn: "cn=diaspora,dc=example,dc=com"
+    bind_pw: "password"
+    search_base: "dc=example,dc=com"
+    search_filter: "uid=%{username}"
+    bind_template: "uid=%{username},dc=example,dc=com"
+
 
 development:
   environment:
diff --git a/config/diaspora.yml.example b/config/diaspora.yml.example
index b2573625d..c357c8651 100644
--- a/config/diaspora.yml.example
+++ b/config/diaspora.yml.example
@@ -710,6 +710,36 @@ configuration: ## Section
       ## If scope is 'tags', a comma separated list of tags here can be set.
       ## For example "linux,diaspora", to receive posts related to these tags
       #pod_tags:
+  ldap:
+      # Uncomment next line if you want to use LDAP on your instance
+      enable: true
+      host: localhost
+      port: 389
+      # Use only LDAP authentication (don't try other means)
+      only_ldap: true
+      # LDAP attribute to find the user's e-mail. Necessary to create accounts
+      # for not existing users
+      mail_attribute: mail
+      # Skip e-mail confirmation when creating an account via LDAP.
+      skip_email_confirmation: true
+      # ----- Using bind_dn and bind_pw
+      # bind_dn and bind_pw may be used if the diaspora instance
+      # should be able to connect to LDAP to find and search for users.
+
+      use_bind_dn: true
+      bind_dn: "cn=diaspora,dc=example,dc=com"
+      bind_pw: "password"
+      search_base: "dc=example,dc=com"
+      # This is the filter with which to search for the user. %{username} will
+      # be replaced by the given login.
+      search_filter: "uid=%{username}"
+      #
+      # ----- Using template
+      # This setting doesn't require a diaspora LDAP user. Use a template, and
+      # diaspora will try to login with the templated dn and password
+      #
+      # bind_template: "uid=%{username},dc=example,dc=com"
+
 
 ## Here you can override settings defined above if you need
 ## to have them different in different environments.
diff --git a/config/initializers/0_ldap_authenticatable.rb b/config/initializers/0_ldap_authenticatable.rb
new file mode 100644
index 000000000..49846502f
--- /dev/null
+++ b/config/initializers/0_ldap_authenticatable.rb
@@ -0,0 +1,82 @@
+require 'net/ldap'
+require 'devise/strategies/authenticatable'
+
+module Devise
+  module Strategies
+    class LdapAuthenticatable < Authenticatable
+      def valid?
+        AppConfig.ldap.enable? && params[:user].present?
+      end
+
+      def authenticate!
+        ldap = Net::LDAP.new(
+          host: AppConfig.ldap.host,
+          port: AppConfig.ldap.port,
+          encryption: :simple_tls,
+        )
+
+        if AppConfig.ldap.use_bind_dn?
+          ldap.auth AppConfig.ldap.bind_dn, AppConfig.ldap.bind_pw
+
+          if !ldap.bind
+            return fail(:ldap_configuration_error)
+          end
+
+          search_filter = AppConfig.ldap.search_filter % { username: params[:user][:username] }
+
+          result = ldap.search(base: AppConfig.ldap.search_base, filter: search_filter, result_set: true)
+
+          if result.count != 1
+            return login_fail
+          end
+
+          user_dn    = result.first.dn
+          user_email = result.first[AppConfig.ldap.mail_attribute].first
+        else
+          user_dn = AppConfig.ldap.bind_template % { username: params[:user][:username] }
+        end
+
+        ldap.auth user_dn, params[:user][:password]
+
+        if ldap.bind
+          user = User.find_by(ldap_dn: user_dn)
+
+          # We don't want to trust too much the email attribute from
+          # LDAP: if the user can edit it himself, he may login as
+          # anyone
+          if user.nil?
+            if !AppConfig.ldap.use_bind_dn?
+              result = ldap.search(base: user_dn, scope: Net::LDAP::SearchScope_BaseObject, filter: "(objectClass=*)", result_set: true)
+              user_email = result.first[AppConfig.ldap.mail_attribute].first
+            end
+
+            if user_email.present? && User.find_by(email: user_email).nil?
+              # Password is used for remember_me token
+              user = User.build(email: user_email, ldap_dn: user_dn, password: SecureRandom.hex, username: params[:user][:username])
+              user.save
+              user.seed_aspects
+            elsif User.find_by(email: user_email).present?
+              return fail(:ldap_existing_email)
+            else
+              return fail(:ldap_cannot_create_account_without_email)
+            end
+          end
+
+          success!(user)
+        else
+          return login_fail
+        end
+      end
+
+      def login_fail
+        if AppConfig.ldap.only_ldap?
+          return fail(:ldap_invalid_login)
+        else
+          return pass
+        end
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:ldap_authenticatable, Devise::Strategies::LdapAuthenticatable)
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index 3698e2373..14e88063e 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -250,10 +250,9 @@ Devise.setup do |config|
   # If you want to use other strategies, that are not supported by Devise, or
   # change the failure app, you can configure them inside the config.warden block.
   #
-  # config.warden do |manager|
-  #   manager.intercept_401 = false
-  #   manager.default_strategies(:scope => :user).unshift :some_external_strategy
-  # end
+  config.warden do |manager|
+    manager.default_strategies(scope: :user).unshift :ldap_authenticatable
+  end
 
   # ==> Mountable engine configurations
   # When using Devise inside an engine, let's call it `MyEngine`, and this engine
diff --git a/db/migrate/20170724182100_add_ldap_dn_to_users.rb b/db/migrate/20170724182100_add_ldap_dn_to_users.rb
new file mode 100644
index 000000000..f5cc84d11
--- /dev/null
+++ b/db/migrate/20170724182100_add_ldap_dn_to_users.rb
@@ -0,0 +1,6 @@
+class AddLdapDnToUsers < ActiveRecord::Migration
+  def change
+    add_column :users, :ldap_dn, :text, null: true, default: nil
+    add_index :users, ['ldap_dn'], :length => { "ldap_dn" => 191 }
+  end
+end