CODEWITHSUNDEEP
ruby-on-railsauthenticationdeviseldap
Viktorija
Viktorija

Reputation: 31

LDAP groups authentication fails: Invalid Binding Information

I'm using devise_ldap_authenticatable to log in into my Rails app via LDAP. Log in works for user (with username), but does not work for groups: when I try to check if user is in a particular group I get:

'Net::LDAP::BindingInformationInvalidError in Devise::SessionsController#create

Invalid binding information

Extracted source (around line #244): raise Net::LDAP::BindingInformationInvalidError, "Invalid binding information" unless (user && psw)

I tried several suggested solutions but they all failed with the error mentioned above.

First attempted solution

I tried changing config.ldap_check_group_membership=false to config.ldap_check_group_membership=true in devise.rb:

config.ldap_create_user = true
config.ldap_check_group_membership = true
config.ldap_check_attributes = false
config.ldap_use_admin_to_bind = false
config.ldap_ad_group_check = true (also tried false with this one)

and setting groups in ldap.yml file like this:

authorizations: &AUTHORIZATIONS
    group_base: OU=US,DC=um,DC=com #also tried without group_base, with group_base DC=um,DC=com
    required_groups:
        - CN=D US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com
        - CN=B US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com

later like that:

authorizations: &AUTHORIZATIONS
    #also tried without group_base, with group_base DC=um,DC=com
    group_base: OU=US,DC=um,DC=com 
    required_groups:
        ["memberOf", "CN=D US  Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com;CN=B US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com"]

Second attempted solution

After this failed, I also tried changing ldap_check_attributes=false to ldap_check_attributes=true in devise.rb:

config.ldap_create_user = true
config.ldap_check_group_membership = false
config.ldap_check_attributes = true
config.ldap_use_admin_to_bind = false

and setting attribute in ldap.yml file like this:

authorizations: &AUTHORIZATIONS
    require_attribute:
        memberOf: CN=D US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com
development:
    host: <%= ENV["LDAP_HOST"] %>
    port: <%= ENV["LDAP_PORT"] %>
    attribute: 'userprincipalname'
    base: 'DC=um,DC=com' 
    ssl: <%= ENV["LDAP_SSL"] %>
    <<: *AUTHORIZATIONS

I have access to AD, I know, that group is correct. When I look at my account there, I see something like this: 

memberOf:  CN=D US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com;CN=B US
       Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com

What am I doing wrong?

Upvotes: 2

Views: 1714

Answers (1)

Viktorija
Viktorija

Reputation: 31

Today I managed to find one solution that worked. I've changed devise.rb file like this:

 config.ldap_create_user = true
 config.ldap_check_group_membership = false
 config.ldap_check_attributes = true
 config.ldap_use_admin_to_bind = false

and ldap.yml like that:

authorizations: &AUTHORIZATIONS
    #group_base:
    #required_groups:
    require_attribute:
        memberOf: CN=D US Workers,OU=Workers,OU=abc,OU=US,DC=um,DC=com

development:
    host: <%= ENV["LDAP_HOST"] %>
    port: <%= ENV["LDAP_PORT"] %>
    attribute: sAMAccountName
    base: DC=um,DC=com
    ssl: <%= ENV["LDAP_SSL"] %>
    admin_user: <%= ENV["LDAP_ADMIN_USER"] %> # currently my own: CN=name surname,OU=Workers,OU=abc,OU=US,DC=um,DC=com
    admin_password: <%= ENV["LDAP_ADMIN_PASSWORD"] %> currently my own password
    <<: *AUTHORIZATIONS

If I find better solution, I'll post it. Feel free to suggest your way too.

Upvotes: 1

Related Questions