# File lib/ldap_fluff/freeipa.rb, line 5 def initialize(config={}) @ldap = Net::LDAP.new :host => config.host, :base => config.base_dn, :port => config.port, :encryption => config.encryption @group_base = config.group_base @group_base ||= config.base_dn @base = config.base_dn @bind_user = config.service_user @bind_pass = config.service_pass @anon = config.anon_queries @member_service = MemberService.new(@ldap,@group_base) end
# File lib/ldap_fluff/freeipa.rb, line 20 def bind?(uid=nil, password=nil) @ldap.auth "uid=#{uid},cn=users,cn=accounts,#{@base}", password @ldap.bind end
# File lib/ldap_fluff/freeipa.rb, line 25 def groups_for_uid(uid) service_bind begin @member_service.find_user_groups(uid) rescue MemberService::UIDNotFoundException return [] rescue MemberService::InsufficientQueryPrivilegesException raise UnauthenticatedFreeIPAException, "Insufficient Privileges to query groups data" end end
In freeipa, a simple user query returns a full set of nested groups! yipee
gids should be an array of group common names
returns true if owner is in ALL of the groups if all=true, otherwise returns true if owner is in ANY of the groups
# File lib/ldap_fluff/freeipa.rb, line 51 def is_in_groups(uid, gids = [], all=true) service_bind groups = @member_service.find_user_groups(uid) if all return groups & gids == gids else return groups & gids != [] end end
AD generally does not support un-authenticated searching Typically AD admins configure a public user for searching
# File lib/ldap_fluff/freeipa.rb, line 38 def service_bind unless @anon || bind?(@bind_user, @bind_pass) raise UnauthenticatedFreeIPAException, "Could not bind to FreeIPA Query User" end end