devise_ldap_authenticatable icon indicating copy to clipboard operation
devise_ldap_authenticatable copied to clipboard

Non-use of "bind_as" when authenticating overrides @ldap bind information

Open jufemaiz opened this issue 12 years ago • 1 comments

Solution provided in Issue 25 however was not ever implemented.

When LdapConnector as @ldap in Devise::LdapAdaptor calls authenticate! it uses the following:

      def authenticate!
        @ldap.auth(dn, @password)
        @ldap.bind
      end

the @auth attributes are altered to the user's - preventing secondary usage of any net::ldap functionality where authentication to search the LDAP is required.

The use of "bind_as" allows for authentication testing, as expressed in the Net::LDAP documentation:

bind_as is for testing authentication credentials.

Thoughts?

jufemaiz avatar Aug 08 '12 02:08 jufemaiz

Thanks for bringing this up again, @jufemaiz. I agree that it's odd to override the adaptor's binding and produces unexpected issues when you subsequently perform an action that requires admin binding. I'll review the pull request involved and see if I can address this issue. If you had a fix or even just a failing test case prepared, I'd be happy to mix it in to make sure we fix at least the case you're targeting.

stevenyxu avatar Aug 17 '12 13:08 stevenyxu