You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm not sure the LDAP login option has ever worked since we added the omniauth-ldap gem back in #131 (we were missing some additional pieces needed beyond just adding the gem).
I recently had a need for the LDAP authentication setup, so I had fixed the issues in master a couple months ago: 362b917
However, after merging in all the Rails 4 upgrade stuff (#312), the LDAP login option became broken again. The issue now is that LDAP login page doesn't have the Rails CSRF token on it, so Rails is rejecting the callback endpoint.
This CSRF issue is pretty similar to the issue we've seen with the developer login strategy: omniauth/omniauth#674 For the developer strategy, we've just disabled CSRF, since it's only used in development, but we probably don't want to do that for the LDAP strategy.
The text was updated successfully, but these errors were encountered:
I'm not sure the LDAP login option has ever worked since we added the omniauth-ldap gem back in #131 (we were missing some additional pieces needed beyond just adding the gem).
I recently had a need for the LDAP authentication setup, so I had fixed the issues in master a couple months ago: 362b917
However, after merging in all the Rails 4 upgrade stuff (#312), the LDAP login option became broken again. The issue now is that LDAP login page doesn't have the Rails CSRF token on it, so Rails is rejecting the callback endpoint.
This CSRF issue is pretty similar to the issue we've seen with the developer login strategy: omniauth/omniauth#674 For the developer strategy, we've just disabled CSRF, since it's only used in development, but we probably don't want to do that for the LDAP strategy.
The text was updated successfully, but these errors were encountered: