Class: Gitlab::Auth::Ldap::Authentication

Inherits:
OAuth::Authentication show all
Defined in:
lib/gitlab/auth/ldap/authentication.rb

Instance Attribute Summary

Attributes inherited from OAuth::Authentication

#provider, #user

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from OAuth::Authentication

#initialize

Constructor Details

This class inherits a constructor from Gitlab::Auth::OAuth::Authentication

Class Method Details

.login(login, password) ⇒ Object 



13
14
15
16
17
18
19
20
21
22
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 13

def self.(, password)
  return unless Gitlab::Auth::Ldap::Config.enabled?
  return unless .present? && password.present?

  # return found user that was authenticated by first provider for given login credentials
  providers.find do |provider|
    auth = new(provider)
    break auth.user if auth.(, password) # true will exit the loop
  end
end

.providers ⇒ Object 



24
25
26
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 24

def self.providers
  Gitlab::Auth::Ldap::Config.providers
end

Instance Method Details

#adapter ⇒ Object 



39
40
41
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 39

def adapter
  OmniAuth::LDAP::Adaptor.new(config.omniauth_options)
end

#config ⇒ Object 



43
44
45
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 43

def config
  Gitlab::Auth::Ldap::Config.new(provider)
end

#login(login, password) ⇒ Object 



28
29
30
31
32
33
34
35
36
37
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 28

def (, password)
  result = adapter.bind_as(
    filter: user_filter(),
    size: 1,
    password: password
  )
  return unless result

  @user = Gitlab::Auth::Ldap::User.find_by_uid_and_provider(result.dn, provider)
end

#user_filter(login) ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/gitlab/auth/ldap/authentication.rb', line 47

def user_filter()
  # Allow LDAP users to authenticate by using their GitLab username in case
  # their LDAP username does not match GitLab username or
  # their LDAP username collide with another user's GitLab username.
  # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186848
  uid = if user && user.ldap_user?
          ::Gitlab::Auth::Ldap::Person.find_by_dn(
            user.ldap_identity.extern_uid,
            Gitlab::Auth::Ldap::Adapter.new(provider)
          )&.uid
        end

  uid ||= 

  filter = Net::LDAP::Filter.equals(config.uid, uid)

  # Apply LDAP user filter if present
  if config.user_filter.present?
    filter = Net::LDAP::Filter.join(filter, config.constructed_user_filter)
  end

  filter
end