[PATCH conductor 1/5] Task 3521: Integrate ldap_fluff into conductor

Scott Seago sseago at redhat.com
Fri Jul 27 19:59:14 UTC 2012


Revise conductor to use ldap_fluff for ldap auth rather than the prior
copy-and-paste from what katello used to do inline.

aeolus-configure will need to now generate /etc/ldap_fluff.yml
Until that's done, this patch will need to be tested after
editing it manually. Here's what I'm using locally, but actual
content will depend on your ldap setup:

$ cat /etc/ldap_fluff.yml
---
host: localhost
port: 389
encryption:
base_dn: ou=People,dc=my-domain,dc=com
group_base: ou=Groups,dc=my-domain,dc=com
server_type: :posix
ad_domain:
service_user:
service_pass:
anon_queries: false
---
 aeolus-conductor.spec.in |    1 +
 src/Gemfile              |    1 +
 src/app/models/user.rb   |    2 +-
 src/config/settings.yml  |    7 -------
 src/lib/ldap.rb          |   34 +++++++++++-----------------------
 5 files changed, 14 insertions(+), 31 deletions(-)

diff --git a/aeolus-conductor.spec.in b/aeolus-conductor.spec.in
index 425ae07..186834d 100644
--- a/aeolus-conductor.spec.in
+++ b/aeolus-conductor.spec.in
@@ -50,6 +50,7 @@ Requires: rubygem(aeolus-image) >= 0.1.0-4
 Requires: rubygem(pg)
 Requires: rubygem(ruby-net-ldap)
 Requires: rubygem(oauth)
+Requires: rubygem(ldap_fluff)
 Requires: rubygem(rake)
 Requires: rubygem(delayed_job) >= 2.1.4
 Requires: rubygem(paranoia)
diff --git a/src/Gemfile b/src/Gemfile
index 1d90a91..761a653 100644
--- a/src/Gemfile
+++ b/src/Gemfile
@@ -19,6 +19,7 @@ gem 'rails_warden'
 gem 'ruby-net-ldap', :require => 'net/ldap'
 gem 'aeolus-image', '>= 0.4.0', :require => 'aeolus_image'
 gem 'oauth'
+gem 'ldap_fluff'
 gem 'compass'
 gem 'compass-960-plugin', :require=> 'ninesixty'
 gem 'delayed_job', '~> 2.1.4'
diff --git a/src/app/models/user.rb b/src/app/models/user.rb
index 6c1cfb7..3d166dd 100644
--- a/src/app/models/user.rb
+++ b/src/app/models/user.rb
@@ -116,7 +116,7 @@ class User < ActiveRecord::Base
   end
 
   def self.authenticate_using_ldap(username, password, ipaddress)
-    if Ldap.valid_ldap_authentication?(username, password, SETTINGS_CONFIG[:auth][:ldap])
+    if Ldap.valid_ldap_authentication?(username, password)
       u = User.find_by_login(username) || create_ldap_user!(username)
       u.login_count += 1
       update_login_attributes(u, ipaddress)
diff --git a/src/config/settings.yml b/src/config/settings.yml
index 7adecd3..bf1430a 100644
--- a/src/config/settings.yml
+++ b/src/config/settings.yml
@@ -3,13 +3,6 @@
 :auth:
   # supported strategies: database, ldap
   :strategy: database
-  :ldap:
-    :host: localhost
-    # '%s' expression in username_dn string will be replaced
-    # by user's login
-    # username_dn: "deltacloud\%s"
-    :username_dn: uid=%s,ou=People,dc=my-domain,dc=com
-    # :port: 389
 :iwhd:
   :url: http://localhost:9090
   # :oauth:
diff --git a/src/lib/ldap.rb b/src/lib/ldap.rb
index e58d758..59ec326 100644
--- a/src/lib/ldap.rb
+++ b/src/lib/ldap.rb
@@ -14,33 +14,21 @@
 #   limitations under the License.
 #
 
-require 'net/ldap'
+require 'ldap_fluff'
 
 module Ldap
-  def self.valid_ldap_authentication?(uid, password, ldap_config)
-    ldap = LdapConnection.new(ldap_config)
-    ldap.bind? uid, password
+  def self.valid_ldap_authentication?(uid, password)
+    ldap = LdapFluff.new
+    ldap.authenticate? uid, password
   end
 
-  class LdapConnection
-    attr_reader :ldap, :host, :base
-
-    def initialize(config)
-      @ldap = Net::LDAP.new
-      @ldap.host = config[:host]
-      @ldap.port = config[:port] || 389
-      @username_dn = config[:username_dn]
-    end
+  def self.ldap_groups(uid)
+    ldap = LdapFluff.new
+    ldap.group_list(uid)
+  end
 
-    def bind?(uid, password)
-      begin
-        @ldap.auth(@username_dn % uid, password)
-        @ldap.bind
-      rescue Exception => e
-        Rails.logger.error e.message
-        Rails.logger.error e.backtrace.join("\n  ")
-        false
-      end
-    end
+  def self.is_in_groups(uid, grouplist)
+    ldap = LdapFluff.new
+    ldap.is_in_groups?(uid, grouplist)
   end
 end
-- 
1.7.6.5




More information about the aeolus-devel mailing list