From c029597e7a2de9e7f0f799488f35bb045350c39a Mon Sep 17 00:00:00 2001
From: Margarita Barvinok <brita@umich.edu>
Date: Wed, 28 Jan 2026 23:26:21 -0500
Subject: [PATCH] update ldap-lookup with service account

---
 Gemfile                            |  2 +-
 Gemfile.lock                       |  4 ++--
 config/initializers/ldap_lookup.rb | 24 ++++++++++++++++++++----
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/Gemfile b/Gemfile
index 625c9ea5..1e45513d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -53,7 +53,7 @@ gem "omniauth-saml", "~> 2.2"
 gem "omniauth-rails_csrf_protection", "~> 1.0"
 gem 'repost'
 
-gem "ldap_lookup", "2.0.1"
+gem 'ldap_lookup', '~> 2.1.0'
 gem "pundit"
 
 # Use Active Storage variants [https://guides.rubyonrails.org/active_storage_overview.html#transforming-images]
diff --git a/Gemfile.lock b/Gemfile.lock
index 0ff53d17..01bf8c4b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -173,7 +173,7 @@ GEM
     launchy (3.0.1)
       addressable (~> 2.8)
       childprocess (~> 5.0)
-    ldap_lookup (2.0.1)
+    ldap_lookup (2.1.0)
       net-ldap (~> 0.18.0)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
@@ -399,7 +399,7 @@ DEPENDENCIES
   jbuilder
   jsbundling-rails
   kaminari
-  ldap_lookup (= 2.0.1)
+  ldap_lookup (~> 2.1.0)
   letter_opener_web
   omniauth-rails_csrf_protection (~> 1.0)
   omniauth-saml (~> 2.2)
diff --git a/config/initializers/ldap_lookup.rb b/config/initializers/ldap_lookup.rb
index 76cb35de..a659debf 100644
--- a/config/initializers/ldap_lookup.rb
+++ b/config/initializers/ldap_lookup.rb
@@ -1,16 +1,32 @@
 LdapLookup.configuration do |config|
+  # Server Configuration (defaults work for UM LDAP)
   config.host = ENV.fetch('LDAP_HOST', 'ldap.umich.edu')
   config.port = ENV.fetch('LDAP_PORT', '389')
   config.base = ENV.fetch('LDAP_BASE', 'dc=umich,dc=edu')
 
-  # Optional: set for authenticated binds
-  config.username = ENV['LDAP_USERNAME']
+  # Authentication (optional for anonymous binds)
+  # Leave unset to use anonymous binds (if your LDAP server allows it)
+  # config.username = ENV['LDAP_USERNAME']
   config.password = ENV['LDAP_PASSWORD']
 
-  # Encryption - REQUIRED
+  # If using a service account with custom bind DN, uncomment and set:
+  config.bind_dn = ENV['LDAP_BIND_DN']
+  # Note: LDAP_BIND_DN replaces LDAP_USERNAME (LDAP_USERNAME can be unset), not LDAP_PASSWORD.
+
+  # Encryption - REQUIRED (defaults to STARTTLS)
   config.encryption = ENV.fetch('LDAP_ENCRYPTION', 'start_tls').to_sym
+  # Use :simple_tls for LDAPS on port 636
+  # TLS verification (defaults to true). Set LDAP_TLS_VERIFY=false only for local testing.
+  # Optional custom CA bundle: set LDAP_CA_CERT=/path/to/ca-bundle.pem
 
-  # Optional: attribute overrides
+  # Optional: Attribute Configuration
   config.dept_attribute = ENV.fetch('LDAP_DEPT_ATTRIBUTE', 'umichPostalAddressData')
   config.group_attribute = ENV.fetch('LDAP_GROUP_ATTRIBUTE', 'umichGroupEmail')
+
+  # Optional: Logger for debug output (responds to debug/info or call)
+  # config.logger = Rails.logger
+
+  # Optional: Separate search bases for users and groups (UM service accounts)
+  # config.user_base = ENV.fetch('LDAP_USER_BASE', 'ou=people,dc=umich,dc=edu')
+  # config.group_base = ENV.fetch('LDAP_GROUP_BASE', 'ou=user groups,ou=groups,dc=umich,dc=edu')
 end