debian-mirror-gitlab/lib/gitlab/auth/ldap/person.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

125 lines
3.8 KiB
Ruby
Raw Normal View History

2018-12-13 13:39:08 +05:30
# frozen_string_literal: true
2018-03-27 19:54:05 +05:30
module Gitlab
module Auth
2020-04-08 14:13:33 +05:30
module Ldap
2018-03-27 19:54:05 +05:30
class Person
# Active Directory-specific LDAP filter that checks if bit 2 of the
# userAccountControl attribute is set.
# Source: http://ctogonewild.com/2009/09/03/bitmask-searches-in-ldap/
AD_USER_DISABLED = Net::LDAP::Filter.ex("userAccountControl:1.2.840.113556.1.4.803", "2")
InvalidEntryError = Class.new(StandardError)
2020-10-24 23:57:45 +05:30
attr_accessor :provider
2018-03-27 19:54:05 +05:30
def self.find_by_uid(uid, adapter)
uid = Net::LDAP::Filter.escape(uid)
adapter.user(adapter.config.uid, uid)
end
def self.find_by_dn(dn, adapter)
adapter.user('dn', dn)
end
def self.find_by_email(email, adapter)
email_fields = adapter.config.attributes['email']
adapter.user(email_fields, email)
end
def self.disabled_via_active_directory?(dn, adapter)
adapter.dn_matches_filter?(dn, AD_USER_DISABLED)
end
def self.ldap_attributes(config)
[
'dn',
config.uid,
*config.attributes['name'],
*config.attributes['email'],
*config.attributes['username']
2020-06-23 00:09:42 +05:30
].compact.uniq.reject(&:blank?)
2018-03-27 19:54:05 +05:30
end
def self.normalize_dn(dn)
2020-04-08 14:13:33 +05:30
::Gitlab::Auth::Ldap::DN.new(dn).to_normalized_s
rescue ::Gitlab::Auth::Ldap::DN::FormatError => e
2020-11-24 15:15:51 +05:30
Gitlab::AppLogger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
2018-03-27 19:54:05 +05:30
dn
end
# Returns the UID in a normalized form.
#
# 1. Excess spaces are stripped
# 2. The string is downcased (for case-insensitivity)
def self.normalize_uid(uid)
2020-04-08 14:13:33 +05:30
::Gitlab::Auth::Ldap::DN.normalize_value(uid)
rescue ::Gitlab::Auth::Ldap::DN::FormatError => e
2020-11-24 15:15:51 +05:30
Gitlab::AppLogger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
2018-03-27 19:54:05 +05:30
uid
end
def initialize(entry, provider)
2020-11-24 15:15:51 +05:30
Gitlab::AppLogger.debug "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}"
2018-03-27 19:54:05 +05:30
@entry = entry
@provider = provider
end
def name
2019-07-07 11:18:12 +05:30
attribute_value(:name)&.first
2018-03-27 19:54:05 +05:30
end
def uid
entry.public_send(config.uid).first # rubocop:disable GitlabSecurity/PublicSend
end
def username
username = attribute_value(:username)
# Depending on the attribute, multiple values may
# be returned. We need only one for username.
# Ex. `uid` returns only one value but `mail` may
# return an array of multiple email addresses.
[username].flatten.first.tap do |username|
username.downcase! if config.lowercase_usernames
end
end
def email
attribute_value(:email)
end
def dn
self.class.normalize_dn(entry.dn)
end
private
2019-03-02 22:35:43 +05:30
attr_reader :entry
2018-03-27 19:54:05 +05:30
def config
2020-04-08 14:13:33 +05:30
@config ||= Gitlab::Auth::Ldap::Config.new(provider)
2018-03-27 19:54:05 +05:30
end
# Using the LDAP attributes configuration, find and return the first
# attribute with a value. For example, by default, when given 'email',
# this method looks for 'mail', 'email' and 'userPrincipalName' and
# returns the first with a value.
def attribute_value(attribute)
attributes = Array(config.attributes[attribute.to_s])
selected_attr = attributes.find { |attr| entry.respond_to?(attr) }
2019-07-07 11:18:12 +05:30
return unless selected_attr
2018-03-27 19:54:05 +05:30
entry.public_send(selected_attr) # rubocop:disable GitlabSecurity/PublicSend
end
end
end
end
end
2020-05-24 23:13:21 +05:30
2021-06-08 01:23:25 +05:30
Gitlab::Auth::Ldap::Person.prepend_mod_with('Gitlab::Auth::Ldap::Person')