# LDAP Authentication

**URL:** <https://www.ruby-forum.com/t/ldap-authentication/54823>\
**Category:** Rails\
**Created:** [March 14, 2006, 5:46pm UTC](https://www.ruby-forum.com/t/ldap-authentication/54823 "2006-03-14T17:46:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahul\_m](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/43a26b/32.png) [@rahul\_m](https://www.ruby-forum.com/u/rahul_m)\
**Post date:** [March 14, 2006, 5:46pm UTC](https://www.ruby-forum.com/t/ldap-authentication/54823/1 "2006-03-14T17:46:58Z")

</div>

I have to do user authentication for a project i’m working on. The trick  
is they want me to use the existing LDAP database for it. Does anyone  
know how to authenticate using LDAP in RoR?

~Rahul

---

<div class="post-metadata">

**Author:** ![rahul\_m](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/43a26b/32.png) [@rahul\_m](https://www.ruby-forum.com/u/rahul_m)\
**Post date:** [March 14, 2006, 7:25pm UTC](https://www.ruby-forum.com/t/ldap-authentication/54823/2 "2006-03-14T19:25:08Z")

</div>

> From the RoR wiki:  
> [Peak Obsession](http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticateViaLdap)

On 3/14/06, Rahul M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> 

–

---

<div class="post-metadata">

**Author:** ![rahul\_m](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/43a26b/32.png) [@rahul\_m](https://www.ruby-forum.com/u/rahul_m)\
**Post date:** [March 14, 2006, 7:37pm UTC](https://www.ruby-forum.com/t/ldap-authentication/54823/3 "2006-03-14T19:37:30Z")

</div>

And I hope you aren’t running the server on windows, cause I don’t  
believe  
Ruby-LDAP has been made to work there yet. =\

---

<div class="post-metadata">

**Author:** ![rahul\_m](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/43a26b/32.png) [@rahul\_m](https://www.ruby-forum.com/u/rahul_m)\
**Post date:** [March 14, 2006, 8:17pm UTC](https://www.ruby-forum.com/t/ldap-authentication/54823/4 "2006-03-14T20:17:15Z")

</div>

I tried that method at first, but soon found ActiveLDAP does a few  
extra things that slow it way down just for authentication. I pulled  
out just the authentication code and found it much faster. Only need  
Ruby LDAP installed.

# Note :base and :bind\_format must have your LDAP base. I have removed non SSL connection attempts too.

require ‘ldap’  
def self.ldap\_config

end

def authenticate(username,password)  
auth\_config = {  
# best if this is set in your environment  
:host =\> “[server.com](http://server.com)”,  
:port =\> 636,  
:base =\> “#{your\_base}”,  
:bind\_format =\> “userid=%s,#{your\_base}”,  
:allow\_anonymous =\> false,  
:user =\> username  
}  
auth\_config[:port] ||= 636  
auth\_config[:retries] ||= 3  
conn = nil  
tries = 0  
begin  
# Connect to LDAP  
begin  
# SSL using START\_TLS  
conn = LDAP::SSLConn.new(auth\_config[:host], auth\_config  
[:port], true)  
rescue  
begin  
conn = LDAP::SSLConn.new(auth\_config[:host], auth\_config  
[:port], false)  
rescue  
raise AuthenticationError, “All authentication mechanisms  
failed”  
end  
end  
# Enforce LDAPv3  
conn.set\_option(LDAP::LDAP\_OPT\_PROTOCOL\_VERSION, 3)

```
   # Authenticate
   bind_dn = auth_config[:bind_format] % [auth_config[:user]]

   # Rough bind loop:
   # Attempt SASL
   auth = false
   begin
     auth = conn.bind(bind_dn, password)
   rescue
     return nil
   end

   unless auth
    raise AuthenticationError, "All authentication mechanisms

```

# failed" end return auth rescue =\> e # Retry tries += 1 raise e if tries \> auth\_config[:retries] retry end end

I hope I didn’t cut too much out when removing my server info.

-John

–  
John S.  
Computing Staff - Webmaster  
Kavli Institute for Theoretical Physics  
University of California, Santa Barbara  
removed\_email\_address@domain.invalid  
(805) 893-6307