rbcas / casino-ldap_authenticator Goto Github PK

When a user authenticates and user data, along with extra attributes, are loaded (especially with the Net::LDAP#search fix - see pull request #4 ), the user data that is returned may be missing some values.

I have seen this with the data from the OpenLDAP memberof overlay, which creates multiple entries named 'memberof' for each group to which the user belongs.

I recommend the following change:

  def extra_attributes
    if @options[:extra_attributes]
      result = {}
      @options[:extra_attributes].each do |index_result, index_ldap|
        value = @user_plain[index_ldap]
        if value
          result[index_result] = "#{value.join(', ')}"
        end
      end
      result
    else
      nil
    end
  end

This will keep the attribute values in string form and also permit multiple values.

I'll submit a Pull Request with this soon.

Tested by "fenderdb" (IRC):

[21:56:13] fenderdb Success =)
[21:56:46] fenderdb so the config options defnitely work.

Net::LDAP#bind_as should not be used to pull data, instead the #search method should be used.

Although the Net::LDAP documentation indicates that #bind_as is a combination of search and LDAP binding, it's not as effective as #search in practice because it does not pull a variable list of attributes.

This problem is significant because the usage of the extra_attributes setting in the cas.yml file is somewhat restricted by this usage of #bind_as.

I'd recommend using the Net::LDAP#search method. I've tested this, and can pull extra data like group membership (using the 'memberof' overlay in OpenLDAP, for example).

I'll make a pull request shortly.

Copied over from rbCAS/CASino#164, created by @febs:

If that option isn't set, the authentication would fail at line:

include_attributes = @options[:extra_attributes].values + [username_attribute]

with "undefined method values' for nil:NilClass".