LDAP through Ruby or Rails

Question

I've been attempting to hook a Rails application up to ActiveDirectory. I'll be synchronizing data about users between AD and a database, currently MySQL (but may turn into SQL Server or PostgreSQL).

I've checked out activedirectory-ruby, and it looks really buggy (for a 1.0 release!?). It wraps Net::LDAP, so I tried using that instead, but it's really close to the actual syntax of LDAP, and I enjoyed the abstraction of ActiveDirectory-Ruby because of its ActiveRecord-like syntax.

Is there an elegant ORM-type tool for a directory server? Better yet, if there were some kind of scaffolding tool for LDAP (CRUD for users, groups, organizational units, and so on). Then I could quickly integrate that with my existing authentication code though Authlogic, and keep all of the data synchronized.

Answer 1

Have you checked out thoughtbot's ldap-activerecord-gateway? It might be something for you to consider...

http://github.com/thoughtbot/ldap-activerecord-gateway/tree/master

Answer 2

Have you tried this: http://wiki.rubyonrails.org/rails/pages/HowtoAuthenticateViaLdap

Or looking these, although these are more in the lines of authenticating against AD:

http://wiki.rubyonrails.com/rails/pages/WindowsDomainAuthentication

http://www.noitulove.ch/ldap-authentication-plugin-for-rails/

http://saush.wordpress.com/2006/07/18/rubyrails-user-authentication-with-microsoft-active-directory/

http://xaop.com/blog/2008/06/17/simple-windows-active-directory-ldap-authentication-with-rails/

Answer 3

This is more anecdotal than a real answer...

I had a similar experience using Samba and OpenLDAP server. I couldn't find a library to really do what I wanted so I rolled my own helper classes.

I used ldapbrowser to see what fields Samba filled in when I created a user the "official" way and and basically duplicated that.

The only tricky/non-standard LDAP thing was the crazy password encryption we have:

userPass:

"{MD5}" + Base64.encode64(Digest::MD5.digest(pass))

sambaNTPassword:

OpenSSL::Digest::MD4.hexdigest(Iconv.iconv("UCS-2", "UTF-8", pass).join).upcase

For the def authenticate(user, pass) function I try to get LDAP to bind to the domain using their credentials, if I catch an exception then the login failed, otherwise let them in.

Answer 4

I began using ruby-activedirectory, and even extended it/fixed a few things, hosting judy-activedirectory in Github.

Doing the next iteration, I've discovered ActiveLdap has a much better code base, and I'm seriously contemplating switching to it. Does anyone have personal experience with this?