123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161 |
- class Ldap
-
- class Group
- include Ldap::FilterLookup
-
-
-
-
-
-
- def self.uid_attribute
- 'dn'
- end
-
-
-
-
-
-
-
-
-
-
-
- def initialize(config = nil, ldap: nil)
- @ldap = ldap || ::Ldap.new(config)
- handle_config(config)
- end
-
-
-
-
-
-
-
-
-
-
- def list(filter: nil, base_dn: nil)
- filter ||= filter()
-
- return {} if filter.blank?
- groups = {}
- @ldap.search(filter, base: base_dn, attributes: %w[dn]) do |entry|
- groups[entry.dn.downcase] = entry.dn.downcase
- end
- groups
- end
-
-
-
-
-
-
-
-
-
-
-
- def user_roles(mapping, filter: nil)
- filter ||= filter()
- result = {}
- @ldap.search(filter, attributes: %w[dn member memberuid uniquemember]) do |entry|
- roles = mapping[entry.dn.downcase]
- next if roles.blank?
- members = group_user_dns(entry)
- next if members.blank?
- members.each do |user_dn|
- user_dn_key = user_dn.downcase
- roles.each do |role|
- role = role.to_i
- result[user_dn_key] ||= []
- next if result[user_dn_key].include?(role)
- result[user_dn_key].push(role)
- end
- end
- end
- result
- end
-
-
-
-
-
-
-
- def filter
- @filter ||= lookup_filter(['(objectClass=groupOfUniqueNames)', '(objectClass=groupOfNames)', '(objectClass=group)', '(objectClass=posixgroup)', '(objectClass=organization)'])
- end
-
-
-
-
-
-
-
- def uid_attribute
- @uid_attribute ||= self.class.uid_attribute
- end
- private
- def handle_config(config)
- return if config.blank?
- @uid_attribute = config[:uid_attribute]
- @filter = config[:filter]
- @user_filter = config[:user_filter]
- end
- def group_user_dns(entry)
- return entry[:member] if entry[:member].present?
-
-
- return group_user_memberof(entry) if entry.to_h.keys.any? { |key| key.to_s.include?('member;range') }
- return group_user_dns_memberuid(entry) if entry[:memberuid].present?
- entry[:uniquemember].presence
- end
- def group_user_dns_memberuid(entry)
- entry[:memberuid].filter_map do |uid|
- dn = nil
- @ldap.search("(&(uid=#{uid})#{@user_filter})", attributes: %w[dn]) do |user|
- dn = user.dn
- end
- dn
- end
- end
- def group_user_memberof(entry)
- result = []
- @ldap.search("(&(memberOf=#{entry.dn})#{@user_filter})", attributes: %w[dn]) do |user|
- result << user.dn
- end
- result
- end
- end
- end
|