Authlogic and LDAP Part 2: Searching Active Directory
In Part 1 we configured authlogic to authenticate your password against Active Directory (AD).
But, you still have to manage users within the application and if we’re authenticating against AD we need some way of searching AD for new users. Here’s how to do it…
Modify your Ldap class so that it looks like this:
require 'ostruct'
require 'net/ldap'
class Ldap
LDAP_DOMAIN = 'ad'
LDAP_SERVER_IP = '10.193.168.52'
LDAP_USERNAME = 'ldap_username'
LDAP_PASSWORD = 'ldap_password'
LDAP_TREEBASE = 'dc=ad,dc=your_domain,dc=net'
LDAP_ATTRS = [
'cn', 'samaccountname', 'displayname','telephonenumber', 'mail'
]
LDAP_FILTERS = Net::LDAP::Filter.eq("objectcategory", "person")
def self.valid?(username, password)
init "#{LDAP_DOMAIN}\\#{username}", password
@ldap.bind
end
def self.search(search_string)
init LDAP_USERNAME, LDAP_PASSWORD
results, os = [], nil
filters = LDAP_FILTERS &
Net::LDAP::Filter.eq("cn", "*#{search_string}*")
@ldap.search(
:base => LDAP_TREEBASE,
:filter => filters,
:attributes => LDAP_ATTRS) do |entry|
os = OpenStruct.new
entry.each do |attribute, values|
eval "os.#{attribute.to_s} = '#{values[0]}'"
end
results << os
end
results
end
protected
def self.init(username, password)
@ldap = Net::LDAP.new
@ldap.host = LDAP_SERVER_IP
@ldap.auth username, password
end
end
We added a few constants which define the domain, the AD fields we want to return in our search and a filter so that we only return AD objects that are people. Bear in mind that your AD may be configured differently so these fields may need tweaking to fit your own scenario.
In the search method, we execute the search and create a new OpenStruct object for each search result. Then return an array on OpenStruct objects.
My Restful search controller looks like this:
class SearchesController < ApplicationController
def create
@searches = Ldap.search(params[:name])
render :action => 'index'
end
end
The index and new methods just render views so no need to explicitly define the controller actions.
Finally, my index view, which renders the search results, looks like this (in haml of course!):
- title "Searches"
- if @searches
%table
%thead
%tr
%th Name
%th AD Name
%th Display name
%th Email
%th Telephone
%tbody
- for search in @searches
%tr
%td= h search.name
%td= h search.samaccountname
%td= h search.displayname
%td= h search.mail
%td= h search.telephonenumber
- else
No matches found.
%p= link_to "New Search", new_search_path
It’s now very easy for us to make sure we populate all our user fields with valid information from AD.
Hope this helps!
Authlogic and LDAP Part 1: Authentication
In the Rails, Authlogic and Single Sign On post, we setup a central authentication app to handle user authentication and sessions centrally.
Let’s move on from that…
All our applications are on a closed network which uses Active Directory (AD). Users first authenticate against AD to get to our login page. They again authenticate against our database to get into our application portal. This is cumbersome and impractical because users in most cases have to remember two passwords.
“We don’t mind logging in twice, but why can’t we just use our same credentials?” they cried…
“You can!” we replied.
All our users use their email address and password for AD authentication. We need to configure our application to use the same credentials for application authentication because our application uses a unique username for logging in – not email address.
First, add this line to your environment.rb file (your version may differ):
config.gem "net-ldap", :lib => false, :version => '>=0.0.5'
Modify the UserSession model by telling authlogic to use our own custom method for password verification:
class UserSession < Authlogic::Session::Base verify_password_method :valid_ldap_credentials? end
Next, we need to modify the User model with 3 things:
1. Tell authlogic to use the email field as the username
2. Tell authlogic NOT to validate the password field against the database
3. Implement our custom password verification method
Your User model should look like this:
class User < ActiveRecord::Base
acts_as_authentic do |config|
config.login_field = :email
config.validate_password_field = false
end
protected
def valid_ldap_credentials?(password)
Ldap.valid?(self.username, password)
end
end
Easy enough.
Finally, we create a new class which will talk to AD. The valid? method will return true if the user credentials are valid.
require 'net/ldap'
class Ldap
LDAP_DOMAIN = 'ad'
LDAP_SERVER_IP = '10.193.168.52'
LDAP_USERNAME = 'ldap_username'
LDAP_PASSWORD = 'ldap_password'
def self.valid?(username, password)
init "#{LDAP_DOMAIN}\\#{username}", password
@ldap.bind
end
protected
def self.init(username, password)
@ldap = Net::LDAP.new
@ldap.host = LDAP_SERVER_IP
@ldap.auth username, password
end
end
Finally, you can remove the password fields from your users table using a simple migration.
What about security?
Ah, yes. One very important point is that as we are now validating users against AD by allowing them to enter their AD credentials in a web form, you should use SSL to make sure the details cannot be sniffed and that the form details are encrypted.
In Part 2, we’ll look at how to search for users in the Active Directory.
Rails, Authlogic and Single Sign On
This post is for Rails 2. For Rails 3 compliant code, see the first comment.
Introduction
We have a suite of integrated tools and we needed a single sign on solution. We looked at OpenID, OpenAuth and CAS but decided to roll our own so that we could manage all our user accounts, sessions, roles and permissions centrally. We are also behind a secure network (Active Directory) and the use of OpenID and OpenAuth was ruled out anyway…
What did we need?
1. A central app to manage user authentication and sessions
2. A satellite app which uses the central app to authenticate users
The Central App
Nothing special going on here. We have a Rails application which uses authlogic, and we have some basic CRUD screens setup to manage users, roles and permissions.
In your database.yml file define your database:
development:
adapter: sqlite3
database: db/development.sqlite3
pool: 5
timeout: 5000
Make sure you are using the database to persist session information. To do this, add the following line to your config/environment.rb:
config.action_controller.session_store = :active_record_store
Then, create a sessions table in your database by running:
rake db:sessions:create
Finally, make a note of the session settings in your config/initializers/session_store.rb file. This is important because these will have to be the same across all the applications:
ActionController::Base.session = {
:key => '_session_key',
:secret => '_some_very_long_string'
}
The Satellite App
Any satellite app that is to use our central authentication app also needs to be using authlogic. However, there are a few tweaks we will make to redirect some of the magic to the central app.
In your config/initializers/session_store.rb file, make sure the session information matches that of your central app:
ActionController::Base.session = {
:key => '_session_key',
:secret => '_some_very_long_string'
}
We also need the following lines added to the config/initializers/session_store.rb file:
ActionController::Base.session_store = active_record_store
ActiveRecord::SessionStore::Session.establish_connection("sessions_#{RAILS_ENV}")
Modify your user.rb model to look like this:
class User < ActiveRecord::Base
establish_connection "sessions_#{RAILS_ENV}"
acts_as_authentic
end
Finally, define the databases in your database.yml file. You will need both the application database as well as the authentication database definitions:
development: adapter: sqlite3 database: db/development.sqlite3 pool: 5 timeout: 5000 sessions_development: adapter: sqlite3 database: ../auth_app/db/development.sqlite3 pool: 5 timeout: 5000
Helper methods
Finally, add the following helper methods to your ApplicationController models in both/all your applications:
helper_method :current_user
protected
def current_user_session
return @current_user_session if defined?(@current_user_session)
@current_user_session = UserSession.find
end
def current_user
return @current_user if defined?(@current_user)
@current_user = current_user_session && current_user_session.record
end
def require_user
unless current_user
flash[:error] = "You must be logged..."
redirect_to root_path
return false
end
end
def require_no_user
if current_user
flash[:error] = "You cannot be logged in..."
redirect_to root_path
return false
end
end
Viola! We now have a single sign on solution with shared sessions across multiple Rails applications. We also don’t use any cookies so this could easily work across multiple domains.
Summary
This is a simplified illustration of our solution. Obviously this is for applications within the same “portal”. This solution is not “secure”. If you plan on using something like this for production applications you should use HTTPS to secure your cookies.
I’m using SQLite here, but in production we use ODBC drivers, meaning we don’t have to have all the databases on the same server. Just a consideration to bear in mind.
