samvera-labs / hydra-ldap

An ldap client for group management

Hydra::LDAP

A gem for managing ldap groups used with hydra

Installation

Add this line to your application's Gemfile:

gem 'hydra-ldap'

And then execute:

$ bundle

Or install it yourself as:

$ gem install hydra-ldap

Usage

Create the config file (config/ldap.yml) by running:

rails generate hydra-ldap

Made the filters, attributes and result parsing all parameters as frequently as possible, to try and make this usable to many LDAP directory set ups.

It might be helpful to look at the hydra-ldap-example.ldif, config/hydra-ldap.yml and spec/integration/ldap_spec.rb to see what type of configuration the tests are running for comparison purposes.

The attributes here would change based on LDAP configuration.

attrs = {
  :cn => 'Test'
  :objectclass => 'groupofnames'
  :description => 'my test group contains users, and owners'
  :owner => 'uid=abc123'
  :member => ['john', 'jane', 'fido']
  }
Hydra::LDAP.create_group(group_code, attributes{})

Examples of how to customize the results being returned, print out the cn attribute for the groups owned by this user (hoping these are helpful for NU).

filter = Net::LDAP::Filter.construct("(owner=uid=quentin,ou=people,dc=example,dc=org)")
Hydra::LDAP.groups_owned_by_user(filter, ['owner', 'cn']){ |result| result.map{ |r| puts r[:cn].first } }

uid = 'uid'
filter=Net::LDAP::Filter.construct("(&(objectClass=groupofnames)(member=uid=#{uid}))")
attributes = ['cn']
Hydra::LDAP.groups_for_user(filter, attributes){ |result| result.map { |r| r[:cn].first }}

filter = Net::LDAP::Filter.construct("(cn=#{group_code})")
attributes = ['default attribute is description']
Hydra::LDAP.title_of_group(group_code, filter, attributes){ |result| result.first[:description].first }

filter = Net::LDAP::Filter.construct("(cn=#{group_code})")
Hydra::LDAP.users_for_group(group_code, filter, ['member']){ |result| result.first[:uniquemember].map{ |r| r.sub(/^uid=/, '') }}

filter = Net::LDAP::Filter.construct("(cn=#{group_code})")
Hydra::LDAP.owner_for_group(group_code, filter, ['owner']) { |result| result.first[:owner].map{ |r| r.sub(/^uid=/, '') }}

These are all pretty similar to previous calls, if not the same signatures.

Hydra::LDAP.delete_group(group_code).should be_true

Hydra::LDAP.add_users_to_group(group_code, ['bruce', 'beth'])

Hydra::LDAP.remove_users_from_group(group_code, ['bruce'])

Contributing

1. Fork it
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Added some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request

hydra-ldap's Issues

Calling Hydra::LDAP.connection doesn't seem to work.

Calling the following method doesn't work in my rails app:

Hydra::LDAP.connection

I got the error: "Errno::ECONNRESET (Connection reset by peer @ io_fillbuf - fd:15 ):"

But after change this line of code to rename the self.connection method to other names such as self.get_ldap_connection: https://github.com/projecthydra-labs/hydra-ldap/blob/master/lib/hydra-ldap.rb#L14,

And then calling the connection method as follows, it does work for me:

Hydra::LDAP.get_ldap_connection

Is that because the method name "connection" a rails reserved word?

Attrs option to, e.g., get_user doesn't seem to do anything

Calling code such as:

Hydra::LDAP.get_user('mjg36', ['cn']).first[:cn].first 

seems to work, but I'm not sure what effect passing the ['cn'] has. If I omit that attrs arg entirely, I receive the exact same response. I am not sure what the intent of this argument is. It might be useful if passing in a set of attrs restricts the set of attrs in the result set so that the code below works as intended, pulling back the LDAP entry for 'mjg36' and only the 'cn' attr from that entry in particular:

Hydra::LDAP.get_user('mjg36', ['cn']).first

self.groups_for_user when no block is giving

Method self.groups_for_user in Hydra::LDAP returns nil if no block is passed. See https://github.com/projecthydra-labs/hydra-ldap/blob/master/lib/hydra-ldap.rb#L75

The method should return the result rather than nil if no block is given. Something along the lines of:

def self.groups_for_user(filter, attributes=['psMemberOf'], &block)
      result = connection.search(:base=>group_base, :filter => filter, :attributes => attributes)
      return result unless block_given?
      block.call(result)
end