SquareSquash/web — pull request #15 by localshred (2013-01-22 22:52:50+00:00)
Title: LDAP Authentication Failure: Connection reset by peer

I'm setting up Squash to use LDAP authentication. I've been able to get all the way to the point where the LDAP auth helper is binding a second time (after locating successfully my user) with my user DN and the password.

Calling `ldap.bind` on line 46 is issuing a Connection reset by peer error. This causes the auth process to explode.

```ruby
# app/controllers/additions/ldap_authentication_helpers.rb:43
if (entry = locate_ldap_user(ldap, username))
ldap.auth entry[:dn], password
unless ldap.bind
logger.tagged('AuthenticationHelpers') { logger.info "Denying login to #{username}: LDAP authentication failed." }
return false
end
else
...
```

I've put a `binding.pry` in just after the `entry` var is assigned, and it's `:dn` appears to be valid, and the `password` var does contain the appropriate password.

The following log is from when I rescued the exception and printed it's message, the `ldap.get_operation_result`, and the backtrace:

```
[LDAP Bind Failure] Connection reset by peer
[LDAP Bind Failure] #
[LDAP Bind Failure] /home/jamhead/.rvm/gems/ruby-1.9.3-p374@squash/gems/net-ldap-0.3.1/lib/net/ber/ber_parser.rb:157:in `getbyte'
/home/jamhead/.rvm/gems/ruby-1.9.3-p374@squash/gems/net-ldap-0.3.1/lib/net/ber/ber_parser.rb:157:in `read_ber'
/home/jamhead/.rvm/gems/ruby-1.9.3-p374@squash/gems/net-ldap-0.3.1/lib/net/ldap.rb:1238:in `bind_simple'
/home/jamhead/.rvm/gems/ruby-1.9.3-p374@squash/gems/net-ldap-0.3.1/lib/net/ldap.rb:1209:in `bind'
/home/jamhead/.rvm/gems/ruby-1.9.3-p374@squash/gems/net-ldap-0.3.1/lib/net/ldap.rb:718:in `bind'
/srv/squash/releases/20130121000001/app/controllers/additions/ldap_authentication_helpers.rb:48:in `log_in'
/srv/squash/releases/20130121000001/app/controllers/sessions_controller.rb:70:in `create'
```

I'm open to this being an LDAP issue or a misconfiguration on my side, but wondering if you have any ideas where I could go from here. If the LDAP library is to blame, we should probably be accounting for the fact that `ldap.bind` _may_ blow up.

Part of me thinks that doing multiple `bind` calls on a single LDAP object may not be supported, but it's just a guess. Thoughts?