Ruby/Rails user authentication with Microsoft Active Directory

Firstly you need to know that Active Directory is actually an implementation of LDAP in Windows 2000/2003 Server, and it follows most of the convention in any LDAP server. After that, it is relatively simple to use Active Directory as your authentication server. I’m going to show you how to use Active Directory to authenticate your users, but not to do stuff that changes the Active Directory entries.

What you will need to try this:

• An Active Directory Server which you have an account (this might be your Domain Controller, in Windows parlance)
• The Active Directory Server needs to be accessible through port 389, the standard LDAP port. If you are using a corporate Active Directory, your system administrator would have probably sealed off all ports except those necessary (which normally doesn’t include port 389)
• Ruby/LDAP installed. There are other ways of access LDAP servers including the easier ActiveLDAP but Ruby/LDAP shows a lower level of access. In any case ActiveLDAP actually wraps around Ruby/LDAP so you’ll need that anyway. I’ll include a short writeup on getting Ruby/LDAP on your Windows machine

That’s it! Let’s start.

Getting Ruby/LDAP on your Windows machine

For this I’m assuming you are running Windows XP. For Linux or other variants you can try to build it yourself. The Ruby/LDAP project is an open source project that provides a library for Ruby applications to access LDAP servers. To install it on Windows, the best tutorial I’ve found is at Olivier’s Toolbox. This gem (pun intended) even provided a RubyGem that you can download and install!

> gem install ldap-0.9.5-mswin32.gem

Alternatively you can try following Olivier’s instructions to build the gem or even try it from the source itself if you’re not into Windows.

Authenticating with Ruby/LDAP

This little piece of code below (open sourced under MIT License) is a concise and direct method of authenticating a user with Ruby/LDAP and getting the groups that the user is assigned to.

require 'ldap'

class Auth
connection = nil
host = "localhost"
port = 389
dn = nil

def initialize(dn,host="localhost",port=389)
@host = host
@port = port
@dn = dn
end

def login(login, pass)
begin
conn = LDAP::Conn.new(@host, @port)
conn.set_option( LDAP::LDAP_OPT_PROTOCOL_VERSION, 3 )
conn.bind( login, pass )
@connection = conn
return true
rescue => e
false
end
end

def get_member_of(username)
result = @connection.search2( @dn, LDAP::LDAP_SCOPE_SUBTREE, "cn=#{username}", ["memberOf"])
members_of = Array.new
result.first["memberOf"].each { |str|
members_of < < str.split(',')[0].split('=')[1]
}
members_of
end

def close
@connection.unbind unless @connection == nil
@connection = nil
end

end

# testing the code
auth = Auth.new("CN=Users,DC=myserver,DC=com",ad.myserver.com, 389)
auth.login("sausheong@myserver.com", "password")
groups = auth.get_member_of("Sau Sheong Chang")
auth.close

Note that your username needs to be in the form of username@domainname. This is apparently a peculiarity with Active Directory, which is different from more standard LDAP servers. The rest of the code is quite self-explanatory. If you want something that allows you to authenticate quickly, this is the shortcut:

require 'ldap'

class Auth
connection = nil
host = "localhost"
port = 389
dn = nil

def initialize(host="localhost",port=389)
@host = host
@port = port
end

def authenticate(login, pass)
begin
conn = LDAP::Conn.new(@host, @port)
conn.set_option( LDAP::LDAP_OPT_PROTOCOL_VERSION, 3 )
conn.bind( login, pass )
return true
rescue => e
false
ensure
conn.unbind unless conn == nil
conn = nil
end
end

end

# test the code
auth = Auth.new("ad.myserver.com", 389)
if auth.authenticate("sausheong@myserver.com", "password")
puts "You're authenticated!"
end

Drop me a mail if you have any questions on the code.