2014-10-13 15:24:05 +00:00
|
|
|
# Load a specific server configuration
|
|
|
|
module Gitlab
|
|
|
|
module LDAP
|
|
|
|
class Config
|
2017-06-08 23:30:54 +00:00
|
|
|
NET_LDAP_ENCRYPTION_METHOD = {
|
2017-06-09 18:47:20 +00:00
|
|
|
simple_tls: :simple_tls,
|
|
|
|
start_tls: :start_tls,
|
|
|
|
plain: nil
|
|
|
|
}.freeze
|
2017-06-08 23:30:54 +00:00
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
attr_accessor :provider, :options
|
|
|
|
|
|
|
|
def self.enabled?
|
|
|
|
Gitlab.config.ldap.enabled
|
|
|
|
end
|
|
|
|
|
|
|
|
def self.servers
|
2018-02-15 09:27:38 +00:00
|
|
|
Gitlab.config.ldap['servers']&.values || []
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
2017-07-26 23:12:20 +00:00
|
|
|
def self.available_servers
|
|
|
|
return [] unless enabled?
|
|
|
|
|
|
|
|
Array.wrap(servers.first)
|
|
|
|
end
|
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
def self.providers
|
2016-11-11 20:44:08 +00:00
|
|
|
servers.map { |server| server['provider_name'] }
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
2014-10-23 20:57:16 +00:00
|
|
|
def self.valid_provider?(provider)
|
|
|
|
providers.include?(provider)
|
|
|
|
end
|
|
|
|
|
|
|
|
def self.invalid_provider(provider)
|
|
|
|
raise "Unknown provider (#{provider}). Available providers: #{providers}"
|
|
|
|
end
|
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
def initialize(provider)
|
2014-10-23 20:57:16 +00:00
|
|
|
if self.class.valid_provider?(provider)
|
|
|
|
@provider = provider
|
|
|
|
else
|
|
|
|
self.class.invalid_provider(provider)
|
|
|
|
end
|
2018-01-11 16:34:01 +00:00
|
|
|
|
2014-10-23 20:57:16 +00:00
|
|
|
@options = config_for(@provider) # Use @provider, not provider
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def enabled?
|
|
|
|
base_config.enabled
|
|
|
|
end
|
|
|
|
|
|
|
|
def adapter_options
|
2016-11-11 20:44:08 +00:00
|
|
|
opts = base_options.merge(
|
2017-06-08 23:30:54 +00:00
|
|
|
encryption: encryption_options
|
2016-11-11 20:44:08 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
opts.merge!(auth_options) if has_auth?
|
|
|
|
|
|
|
|
opts
|
|
|
|
end
|
|
|
|
|
|
|
|
def omniauth_options
|
|
|
|
opts = base_options.merge(
|
|
|
|
base: base,
|
2017-06-08 22:46:06 +00:00
|
|
|
encryption: options['encryption'],
|
2016-11-11 20:44:08 +00:00
|
|
|
filter: omniauth_user_filter,
|
2017-06-09 17:29:19 +00:00
|
|
|
name_proc: name_proc,
|
|
|
|
disable_verify_certificates: !options['verify_certificates']
|
2016-11-11 20:44:08 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
if has_auth?
|
|
|
|
opts.merge!(
|
|
|
|
bind_dn: options['bind_dn'],
|
|
|
|
password: options['password']
|
|
|
|
)
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
2016-11-11 20:44:08 +00:00
|
|
|
|
2017-06-09 17:30:17 +00:00
|
|
|
opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
|
2017-06-09 17:30:38 +00:00
|
|
|
opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
|
|
|
|
|
2016-11-11 20:44:08 +00:00
|
|
|
opts
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def base
|
|
|
|
options['base']
|
|
|
|
end
|
|
|
|
|
|
|
|
def uid
|
|
|
|
options['uid']
|
|
|
|
end
|
|
|
|
|
|
|
|
def sync_ssh_keys?
|
|
|
|
sync_ssh_keys.present?
|
|
|
|
end
|
|
|
|
|
|
|
|
# The LDAP attribute in which the ssh keys are stored
|
|
|
|
def sync_ssh_keys
|
|
|
|
options['sync_ssh_keys']
|
|
|
|
end
|
|
|
|
|
|
|
|
def user_filter
|
|
|
|
options['user_filter']
|
|
|
|
end
|
|
|
|
|
2016-11-11 20:44:08 +00:00
|
|
|
def constructed_user_filter
|
|
|
|
@constructed_user_filter ||= Net::LDAP::Filter.construct(user_filter)
|
|
|
|
end
|
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
def group_base
|
|
|
|
options['group_base']
|
|
|
|
end
|
|
|
|
|
|
|
|
def admin_group
|
|
|
|
options['admin_group']
|
|
|
|
end
|
|
|
|
|
|
|
|
def active_directory
|
|
|
|
options['active_directory']
|
|
|
|
end
|
|
|
|
|
2015-04-14 15:09:05 +00:00
|
|
|
def block_auto_created_users
|
|
|
|
options['block_auto_created_users']
|
|
|
|
end
|
|
|
|
|
2015-09-08 16:34:18 +00:00
|
|
|
def attributes
|
2017-01-05 22:01:04 +00:00
|
|
|
default_attributes.merge(options['attributes'])
|
2015-09-08 16:34:18 +00:00
|
|
|
end
|
|
|
|
|
2015-12-31 19:22:51 +00:00
|
|
|
def timeout
|
|
|
|
options['timeout'].to_i
|
|
|
|
end
|
|
|
|
|
2016-09-29 19:08:27 +00:00
|
|
|
def has_auth?
|
|
|
|
options['password'] || options['bind_dn']
|
|
|
|
end
|
|
|
|
|
2016-11-11 20:44:08 +00:00
|
|
|
def allow_username_or_email_login
|
|
|
|
options['allow_username_or_email_login']
|
|
|
|
end
|
|
|
|
|
2018-02-05 22:35:34 +00:00
|
|
|
def lowercase_usernames
|
|
|
|
options['lowercase_usernames']
|
|
|
|
end
|
|
|
|
|
2016-11-11 20:44:08 +00:00
|
|
|
def name_proc
|
|
|
|
if allow_username_or_email_login
|
2017-03-31 15:11:28 +00:00
|
|
|
proc { |name| name.gsub(/@.*\z/, '') }
|
2016-11-11 20:44:08 +00:00
|
|
|
else
|
2017-03-31 15:11:28 +00:00
|
|
|
proc { |name| name }
|
2016-11-11 20:44:08 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-05 22:01:04 +00:00
|
|
|
def default_attributes
|
|
|
|
{
|
2017-11-08 21:32:12 +00:00
|
|
|
'username' => %w(uid sAMAccountName userid),
|
2017-01-05 22:01:04 +00:00
|
|
|
'email' => %w(mail email userPrincipalName),
|
|
|
|
'name' => 'cn',
|
|
|
|
'first_name' => 'givenName',
|
|
|
|
'last_name' => 'sn'
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
protected
|
2016-06-03 08:34:20 +00:00
|
|
|
|
2016-11-11 20:44:08 +00:00
|
|
|
def base_options
|
|
|
|
{
|
|
|
|
host: options['host'],
|
|
|
|
port: options['port']
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2014-10-13 15:24:05 +00:00
|
|
|
def base_config
|
|
|
|
Gitlab.config.ldap
|
|
|
|
end
|
|
|
|
|
|
|
|
def config_for(provider)
|
2014-10-14 11:11:53 +00:00
|
|
|
base_config.servers.values.find { |server| server['provider_name'] == provider }
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
2017-06-08 23:30:54 +00:00
|
|
|
def encryption_options
|
|
|
|
method = translate_method(options['encryption'])
|
2017-06-13 21:01:28 +00:00
|
|
|
return nil unless method
|
|
|
|
|
|
|
|
{
|
|
|
|
method: method,
|
|
|
|
tls_options: tls_options(method)
|
|
|
|
}
|
2017-06-08 23:30:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def translate_method(method_from_config)
|
|
|
|
NET_LDAP_ENCRYPTION_METHOD[method_from_config.to_sym]
|
|
|
|
end
|
|
|
|
|
|
|
|
def tls_options(method)
|
2017-06-08 23:57:13 +00:00
|
|
|
return { verify_mode: OpenSSL::SSL::VERIFY_NONE } unless method
|
|
|
|
|
|
|
|
opts = if options['verify_certificates']
|
|
|
|
OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
|
|
|
|
else
|
|
|
|
# It is important to explicitly set verify_mode for two reasons:
|
|
|
|
# 1. The behavior of OpenSSL is undefined when verify_mode is not set.
|
|
|
|
# 2. The net-ldap gem implementation verifies the certificate hostname
|
|
|
|
# unless verify_mode is set to VERIFY_NONE.
|
|
|
|
{ verify_mode: OpenSSL::SSL::VERIFY_NONE }
|
|
|
|
end
|
|
|
|
|
|
|
|
opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
|
2017-06-09 00:03:57 +00:00
|
|
|
opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
|
2017-06-08 23:57:13 +00:00
|
|
|
|
|
|
|
opts
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def auth_options
|
|
|
|
{
|
|
|
|
auth: {
|
|
|
|
method: :simple,
|
|
|
|
username: options['bind_dn'],
|
|
|
|
password: options['password']
|
|
|
|
}
|
|
|
|
}
|
|
|
|
end
|
2016-11-11 20:44:08 +00:00
|
|
|
|
|
|
|
def omniauth_user_filter
|
|
|
|
uid_filter = Net::LDAP::Filter.eq(uid, '%{username}')
|
|
|
|
|
|
|
|
if user_filter.present?
|
|
|
|
Net::LDAP::Filter.join(uid_filter, constructed_user_filter).to_s
|
|
|
|
else
|
|
|
|
uid_filter.to_s
|
|
|
|
end
|
|
|
|
end
|
2014-10-13 15:24:05 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|