title: How does omniauth-ldap work?
body: <p>I'm currently working on a rails project in which I am in charge of user authentication.
  We've decided to use third party authentication and I tried following an example setup.
  The example is done by Kevin Thompson and is called <a href="http://www.blackfistsecurity.com/2011/12/rails-authentication-using-devise-and.html" rel="nofollow" title="Rails authentication using devise and omniauth-ldap">example</a>.</p>
  
  <p>According to the LDAP sever's documentation, the steps I need to do are:</p>
  
  <ol>
  <li>Connect to the LDAP server.</li>
  <li>Bind anonymously (no DN and password).</li>
  <li>Search for the LDAP entry using the username</li>
  <li>Retrieve the DN for the username if found.</li>
  <li>Rebind with the user's DN and password that they supplied.</li>
  <li>If this rebind succeeds, the user is authenticated.</li>
  </ol>
  
  <p>I've followed Thompson's example, except that I'm not using nifty; using devise for user management and omniauth-ldap for authentication.  However, it's not quite working, and I'm wondering if it has to do with a discrepancy between what the server documentation tells me to do and what omniauth-ldap is actually doing...</p>
  
  <p>Specifically, my problem is that I always get an "Invalid credentials" error.
  Is this because of a mismatch between what I need to do and what omniauth-ldap is doing?</p>
  
  <p>Advice or suggestions are greatly appreciated!</p>
  
  <p>A little more information about how I've set up (to maintain anonymity, I replaced some things)
  I can post more of my code upon request.</p>
  
  <p><b>config/initializers/devise.rb:</b></p>
  
  <pre><code>  config.omniauth :ldap,
      :host =&gt; 'ldap1.its.domain.ext',
      :base =&gt; 'ou=People, dc=domain, dc=ext',
      :port =&gt; 389,
      :attrs =&gt; 'uid',
      :method =&gt; :plain,
      :uid =&gt; 'uid'
  </code></pre>
  
  <p><b>app/controllers/users/omniauth_callbacks_controller.rb:</b></p>
  
  <pre><code>class Users::OmniauthCallbacksController &lt;     Devise::OmniauthCallbacksController
    skip_before_filter :verify_authenticity_token
    def ldap
      ldap_return = request.env["omniauth.auth"]["extra"]["raw_info"]
      username = ldap_return.uid[0].to_s
  
      if @user = User.find_by_username(username)
        sign_in_and_redirect @user
      else
        @user = User.create(:username =&gt; username,)
        sign_in_and_redirect @user
      end
    end
  end
  </code></pre>