devise_ldap_authenticatable
devise_ldap_authenticatable copied to clipboard
Non-use of "bind_as" when authenticating overrides @ldap bind information
Solution provided in Issue 25 however was not ever implemented.
When LdapConnector as @ldap in Devise::LdapAdaptor calls authenticate! it uses the following:
def authenticate!
@ldap.auth(dn, @password)
@ldap.bind
end
the @auth attributes are altered to the user's - preventing secondary usage of any net::ldap functionality where authentication to search the LDAP is required.
The use of "bind_as" allows for authentication testing, as expressed in the Net::LDAP documentation:
bind_as is for testing authentication credentials.
Thoughts?
Thanks for bringing this up again, @jufemaiz. I agree that it's odd to override the adaptor's binding and produces unexpected issues when you subsequently perform an action that requires admin binding. I'll review the pull request involved and see if I can address this issue. If you had a fix or even just a failing test case prepared, I'd be happy to mix it in to make sure we fix at least the case you're targeting.