Question

Is there a way to authenticate a user to LDAP with email (mail) and not cn or DN? We are using ruby ldap, and possibly active-ldap (we have been having problem with it, though). All we need to do is authenticate a user and then create a membership in our system based on the authentication success.

Answer 1

Login to ldap with a administrative user and search the user by email and password with a filter:

require 'rubygems'
require 'net/ldap'

ldap = Net::LDAP.new :host => server_ip_address,
     :port => 389,
     :auth => {
           :method => :simple,
           :username => "cn=manager,dc=example,dc=com",
           :password => "opensesame"
     }

filter = Net::LDAP::Filter.eq( "email", "[e-mail]" )
treebase = "ou=Users,dc=example,dc=com"

@auth = false
ldap.search( :base => treebase, :filter => filter ) do |entry|
    ldap2 = Net::LDAP.new :host => server_ip_address,
         :port => 389,
         :auth => {
               :method => :simple,
               :username => entry.dn,
               :password => "joe's password"
         }
    @auth = true if ldap2.bind
end

puts "user authenticated" if @auth