Add support for ldapwhoami (RFC4532) (now with tests)

[zeroSteiner]

I'm hoping to see #396 completed by adding the tests that were requested. In doing so I also fixed a problem I noticed where it was not always returning the response string.

Tested with Active Directory and OpenLDAP.

[zeroSteiner]

I was just wondering if there was anything I could do to help this along?

[HarlemSquirrel]

Thanks for tackling this!

Looks like tests are failing and I have a few questions

[HarlemSquirrel]

Why change this?

[zeroSteiner]

Without this change in place, the reply would cause an exception to be raised when it was being parsed.

[HarlemSquirrel]

I guess this is fine if it doesn't break other queries

[HarlemSquirrel]

What's the idea here?

[zeroSteiner]

There is an optional field that's included when the target is Active Directory that shifts the index. This accounts for both cases by accessing it as the last member.

[HarlemSquirrel]

OK, as long as it works with other LDAP directories

[zeroSteiner]

Let me add the scripts I used for testing. IIRC I tested both with OpenLDAP and Active Directory.

test_password_change.rb

$LOAD_PATH.unshift 'lib'

require 'rubygems'
require 'net/ldap'
require 'pry'

openldap = {
     :host => '127.0.0.1',
     :port => 389,
     :auth => {
           :method => :simple,
           :username => "cn=admin,dc=example,dc=org",
           :password => "adminpassword"
     }
}


ldap = Net::LDAP.new openldap
ldap.bind
result = ldap.password_modify(
  dn: 'uid=johndoe,ou=users,dc=example,dc=org',
  #old_password: 'admin',
  new_password: 'Password1!'
)
puts "password_modify: #{result}"

test_whoami.rb

$LOAD_PATH.unshift 'lib'

%Q{
podman run --rm --name openldap \
  -p 1389:1389 \
  --env LDAP_ADMIN_USERNAME=admin \
  --env LDAP_ADMIN_PASSWORD=adminpassword \
  --env LDAP_USERS=customuser \
  --env LDAP_PASSWORDS=custompassword \
  --env LDAP_ROOT=dc=example,dc=org \
  --env LDAP_ADMIN_DN=cn=admin,dc=example,dc=org \
  bitnami/openldap:2.5.17
}

require 'rubygems'
require 'net/ldap'
require 'pry'

openldap = {
     :host => '127.0.0.1',
     :port => 1389,
     :auth => {
           :method => :simple,
           :username => "cn=admin,dc=example,dc=org",
           :password => "adminpassword"
     }
}

openldap2 = {
     :host => '127.0.0.1',
     :port => 389,
     :auth => {
           :method => :simple,
           :username => "uid=johndoe,ou=users,dc=example,dc=org",
           :password => "password123"
     }
}

adds = {
     :host => '192.168.159.10',
     :port => 389,
     :auth => {
           :method => :simple,
           :username => "CN=Alice Liddle,CN=Users,DC=msflab,DC=local",
           :password => "Password1!"
     }
}

ldap = Net::LDAP.new openldap
ldap.bind
puts "[openldap]  whoami: #{ldap.whoami}"

#ldap = Net::LDAP.new openldap2
#ldap.bind
#puts "[openldap2] whoami: #{ldap.whoami}"

ldap = Net::LDAP.new adds
ldap.bind
puts "[adds]      whoami: #{ldap.whoami}"

[HarlemSquirrel]

Thanks for sharing the manual test results. Do you think you can get these tests passing?

[zeroSteiner]

@HarlemSquirrel tests are passing now! There was an issue with parsing the response from password-modify requests that deviated from the RFC which defines that it's in it's own format. The #extended_response attribute should be the unparsed data to closely adhere to the RFC spec, and extracting the password from it should require parsing it as per the other RFC spec.

[HarlemSquirrel]

Thanks for working on this!