if ci_badges.map(&:color).detect { it != "green"} ☝️ let me know on Discord or RubyForum, as I may have missed the notification.

if ci_badges.map(&:color).all? { it == "green"} 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.

I've summarized my thoughts in this blog post.

Use the LDAP strategy as a middleware in your application:

use OmniAuth::Strategies::LDAP,
  title: "My LDAP",
  host: "10.101.10.1",
  port: 389,
  encryption: :plain,
  base: "dc=intridea,dc=com",
  uid: "sAMAccountName",
  name_proc: proc { |name| name.gsub(/@.*$/, "") },
  bind_dn: "default_bind_dn",
  password: "password",
  # Optional timeouts (seconds)
  connect_timeout: 3,
  read_timeout: 7,
  tls_options: {
    ssl_version: "TLSv1_2",
    ciphers: ["AES-128-CBC", "AES-128-CBC-HMAC-SHA1", "AES-128-CBC-HMAC-SHA256"]
  },
  mapping: {
    "name" => "cn;lang-en",
    "email" => ["preferredEmail", "mail"],
    "nickname" => ["uid", "userid", "sAMAccountName"]
  }
# Or, alternatively:
# use OmniAuth::Strategies::LDAP, filter: '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))'

At minimum you normally configure :host, :base, and either :uid or :filter. The other options shown above customize connection behavior, TLS, username normalization, timeouts, and returned auth info.

For trusted header SSO, enable header_auth: true and explicitly choose the trusted identity source with header_auth_source: :env or header_auth_source: :http_header. See Trusted header SSO for the security requirements.

This gem enables TLS certificate verification by default when you use encryption: "ssl" (LDAPS / simple TLS) or encryption: "tls" (STARTTLS). We always pass tls_options to Net::LDAP based on OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, which includes verify_mode: OpenSSL::SSL::VERIFY_PEER and sane defaults.

• Secure by default: you do not need to set anything extra to verify the LDAP server certificate.
• To customize trust or ciphers, supply your own tls_options, which are merged over the safe defaults.
• If you truly need to skip verification (not recommended), set disable_verify_certificates: true.

Examples:

# Verify server certs (default behavior)
use OmniAuth::Strategies::LDAP,
  host: ENV["LDAP_HOST"],
  port: 636,
  encryption: "ssl",  # or "tls"
  base: "dc=example,dc=com",
  uid: "uid"

# Use a private CA bundle and restrict protocol/ciphers
use OmniAuth::Strategies::LDAP,
  host: ENV["LDAP_HOST"],
  port: 636,
  encryption: "ssl",
  base: "dc=example,dc=com",
  uid: "uid",
  tls_options: {
    ca_file: "/etc/ssl/private/my_org_ca.pem",
    ssl_version: "TLSv1_2",
    ciphers: ["TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"]
  }

# Opt out of verification (NOT recommended – use only in trusted test/dev scenarios)
use OmniAuth::Strategies::LDAP,
  host: ENV["LDAP_HOST"],
  port: 636,
  encryption: "ssl",
  base: "dc=example,dc=com",
  uid: "uid",
  disable_verify_certificates: true

Note: Net::LDAP historically defaulted to no certificate validation when tls_options were not provided. This library mitigates that by always providing secure tls_options unless you explicitly disable verification.

Tokens to Remember
Works with JRuby
Works with Truffle Ruby
Works with MRI Ruby 4
Works with MRI Ruby 3
Works with MRI Ruby 2
Support & Community
Source
Documentation
Compliance
Style
Maintainer 🎖️
... 💖	🧊 🐙 🛖 🧪

Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby. CI workflows and Appraisals are generated for MRI Ruby 2.4+. This test floor is configured by ruby.test_minimum in .kettle-jem.yml and may be higher than the gem's runtime compatibility floor when legacy Rubies are not practical for the current toolchain.

The amazing test matrix is powered by the kettle-dev stack.

Gem	Source	Role	Total downloads
appraisal2	GitHub	multi-dependency Appraisal matrix generation
appraisal2-rubocop	GitHub	RuboCop Appraisal generator integration
kettle-dev	GitHub	development, release, and CI workflow tooling
kettle-jem	GitHub	Appraisals & CI workflow templates
kettle-soup-cover	GitHub	SimpleCov coverage policy and reporting
kettle-test	GitHub	standard test runner and coverage harness
rubocop-lts	GitHub	Ruby-version-aware linting
turbo_tests2	GitHub	parallel test execution

Available as part of the Tidelift Subscription.

The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.

• 💡Subscribe for support guarantees covering all your FLOSS dependencies
• 💡Tidelift is part of Sonar
• 💡Tidelift pays maintainers to maintain the software you depend on!
  📊@Pointy Haired Boss: An enterprise support subscription is "never gonna let you down", and supports open source maintainers

Alternatively:

Install the gem and add to the application's Gemfile by executing:

bundle add omniauth-ldap

If bundler is not being used to manage dependencies, install the gem by executing:

gem install omniauth-ldap

The following options are available for configuring the OmniAuth LDAP strategy:

• :host - The hostname or IP address of the LDAP server.
• :base - The base DN for the LDAP search.
• :uid or :filter - Either :uid (the LDAP attribute for username, default: "sAMAccountName") or :filter (LDAP filter for searching user entries). If :filter is provided, :uid is not required. Note: This :uid option is the search attribute, not the top-level auth.uid in the OmniAuth result.

• :title - The title for the authentication form (default: "LDAP Authentication").
• :port - The port number of the LDAP server (default: 389).
• :encryption - The connection method. Allowed values: :plain, :ssl, :tls (default: :plain). :method is still accepted for compatibility, but is deprecated.
• :bind_dn - The DN to bind with for searching users (required if anonymous access is not allowed).
• :password - The password for the bind DN.
• :name_proc - A proc to process the username before using it in the search (default: identity proc that returns the username unchanged).
• :try_sasl - Whether to use SASL authentication (default: false).
• :sasl_mechanisms - Array of SASL mechanisms to use (e.g., ["DIGEST-MD5", "GSS-SPNEGO"]).
• :allow_anonymous - Whether to allow anonymous binding (default: false).
• :logger - A logger instance for debugging (optional, for internal use).
• :password_policy - When true, the strategy will request the LDAP Password Policy response control (OID 1.3.6.1.4.1.42.2.27.8.5.1) during the user bind. If the server supports it, the adaptor exposes:
  • adaptor.last_operation_result — the last Net::LDAP operation result object.
  • adaptor.last_password_policy_response — the matching password policy response control (implementation-specific object). This can indicate conditions such as password expired, account locked, reset required, or grace logins remaining (per the draft RFC).
• :connect_timeout - Maximum time in seconds to wait when establishing the TCP connection to the LDAP server. Forwarded to Net::LDAP.
• :read_timeout - Maximum time in seconds to wait for reads during LDAP operations (search/bind). Forwarded to Net::LDAP.
• :mapping - Customize how LDAP attributes map to the returned auth.info hash. A sensible default mapping is built into the strategy and will be merged with your overrides. See lib/omniauth/strategies/ldap.rb for the default keys and behavior; values can be a String (single attribute), an Array (first present attribute wins), or a Hash (string pattern with placeholders like %0 combined from multiple attributes).
• :header_auth - Enable trusted upstream identity SSO (default: false). When enabled, the strategy trusts the configured header/env key, performs an LDAP lookup, and skips the user password bind.
• :header_name - Header/env key used for trusted header SSO (default: "REMOTE_USER").
• :header_auth_source - Trusted identity source for header SSO (default: :env). Use :env to read only env["REMOTE_USER"]-style server variables. Use :http_header to read only Rack HTTP_ header keys such as env["HTTP_REMOTE_USER"]; only configure this behind a proxy that strips client-supplied copies.
• :header_auth_require_tls - Require TLS for trusted header SSO requests (default: true).

Example enabling password policy:

use OmniAuth::Builder do
  provider :ldap,
    host: "ldap.example.com",
    base: "dc=example,dc=com",
    uid: "uid",
    bind_dn: "cn=search,dc=example,dc=com",
    password: ENV["LDAP_SEARCH_PASSWORD"],
    password_policy: true
end

Note: This is best-effort and compatible with a range of net-ldap versions. If your server supports the control, you can inspect the response via the adaptor instance during/after authentication (for example in a failure handler) to tailor error messages.

• By design, the top-level auth.uid returned by this strategy is the entry's Distinguished Name (DN).
• The configuration option :uid controls which LDAP attribute is used to locate the entry (or to build the filter), not the value exposed as auth.uid.
• Your LDAP "account name" (for example, sAMAccountName on Active Directory or uid on many schemas) is exposed via auth.info.nickname and is also available in auth.extra.raw_info.

Why DN for auth.uid?

• DN is the canonical, globally unique identifier for an LDAP entry and is always present in search results. See LDAPv3 and DN syntax: [RFC 4511][rfc4511] (LDAP protocol) and [RFC 4514][rfc4514] (String Representation of Distinguished Names).
• Attributes like uid (defined in [RFC 4519][rfc4519]) or sAMAccountName (Active Directory–specific) may be absent, duplicated across parts of the DIT, or vary between directories. Using DN ensures consistent behavior across AD, OpenLDAP, and other servers.
• This trade-off favors cross-directory interoperability and stability for apps that need a unique identifier.

Where to find the "username"-style value

• auth.info.nickname maps from the first present of: uid, userid, or sAMAccountName.
• You can also read the raw attribute from auth.extra.raw_info (a Net::LDAP::Entry):

post "/auth/ldap/callback" do
  auth = request.env["omniauth.auth"]
  dn = auth.uid                                # => "cn=alice,ou=users,dc=example,dc=com"
  username = auth.info.nickname                # => "alice" (from uid/sAMAccountName)
  # Or, directly from raw_info (case-insensitive keys):
  sams = auth.extra.raw_info[:samaccountname]
  sam = sams.first if sams
  # ...
end

If you need top-level auth.uid to be something other than the DN (for example, sAMAccountName), you'll currently need to read it from auth.info.nickname (or raw_info) in your app. Changing the top-level uid mapping would be a breaking behavior change for existing users; if you have a use-case, please open an issue to discuss a configurable mapping.

The strategy exposes a simple Rack middleware and can be used in plain Rack apps, Sinatra, or Rails. With OmniAuth 2.x, initiate authentication with POST /auth/ldap; GET /auth/ldap returns 404 by default. Older OmniAuth 1.x deployments may still render the form on GET /auth/ldap. Handle the callback at /auth/ldap/callback.

Below are several concrete examples to get you started.

# config.ru
require "rack"
require "omniauth-ldap"

use Rack::Session::Cookie, secret: "change_me"
use OmniAuth::Builder do
  provider :ldap,
    host: "ldap.example.com",
    port: 389,
    encryption: :plain,
    base: "dc=example,dc=com",
    uid: "uid",
    title: "Example LDAP"
end

run lambda { |env| [404, {"Content-Type" => "text/plain"}, [env.key?("omniauth.auth").to_s]] }

Submit POST /auth/ldap to initiate authentication. With OmniAuth 2.x, the middleware renders the login form on POST when credentials are not already present; with OmniAuth 1.x, GET /auth/ldap can also render the form.

require "sinatra"
require "omniauth-ldap"

use Rack::Session::Cookie, secret: "change_me"
use OmniAuth::Builder do
  provider :ldap,
    title: "Company LDAP",
    host: "ldap.company.internal",
    base: "dc=company,dc=local",
    uid: "sAMAccountName",
    name_proc: proc { |username| username.gsub(/@.*$/, "") }
end

get "/" do
  '<form action="/auth/ldap" method="post"><button type="submit">Sign in with LDAP</button></form>'
end

post "/auth/ldap/callback" do
  auth = request.env["omniauth.auth"]
  "Hello, #{auth.info["name"]}"
end

Create config/initializers/omniauth.rb:

Rails.application.config.middleware.use(OmniAuth::Builder) do
  provider :ldap,
    title: "Acme LDAP",
    host: "ldap.acme.internal",
    port: 389,
    base: "dc=acme,dc=corp",
    uid: "uid",
    bind_dn: "cn=search,dc=acme,dc=corp",
    password: ENV["LDAP_SEARCH_PASSWORD"],
    name_proc: proc { |n| n.split("@").first }
end

Then submit users to /auth/ldap with POST in your app (for example, from a Devise sign-in page).

This gem is compatible with JSON-encoded POST bodies as well as traditional form-encoded.

• Set header Content-Type to application/json.
• Send a JSON object containing username and password.
• Rails automatically exposes parsed JSON params via env["action_dispatch.request.request_parameters"], which this strategy reads first. In non-Rails Rack apps, ensure you use a JSON parser middleware if you post raw JSON.

Examples

• curl (JSON):

  curl -i \
    -X POST \
    -H 'Content-Type: application/json' \
    -d '{"username":"alice","password":"secret"}' \
    http://localhost:3000/auth/ldap

  The request phase will redirect to /auth/ldap/callback when both fields are present.

• curl (form-encoded, still supported):

  curl -i \
    -X POST \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'username=alice' \
    --data-urlencode 'password=secret' \
    http://localhost:3000/auth/ldap

• Browser (JavaScript fetch):

  fetch('/auth/ldap', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ username: 'alice', password: 'secret' })
  }).then(res => {
    if (res.redirected) {
      window.location = res.url; // typically /auth/ldap/callback
    }
  });

Notes

• You can still initiate authentication with a regular form POST and then submit credentials as form-encoded data. JSON is an additional option, not a replacement.
• In the callback phase (POST /auth/ldap/callback), the strategy reads JSON credentials the same way; Rails exposes them via action_dispatch.request.request_parameters and non-Rails apps should use a JSON parser middleware.

If you need to restrict authentication to a group or use a more complex lookup, pass :filter. Use %{username} — it will be replaced with the processed username (after :name_proc).

provider :ldap,
  host: "ldap.example.com",
  base: "dc=example,dc=com",
  filter: "(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))",
  bind_dn: "cn=search,dc=example,dc=com",
  password: ENV["LDAP_SEARCH_PASSWORD"]

What :filter actually does

• If :filter is provided, the strategy constructs an LDAP filter string by substituting %{username} with the submitted username after applying :name_proc, escaping special characters per RFC 4515, and passes it to the directory search.
• In the normal password flow, a successful search returns the user's DN and we then bind as that DN with the submitted password.
• In trusted header SSO flow (header_auth: true), we only perform the search and skip the user password bind; if the search returns no entry, authentication fails.
• If :filter is not provided, the strategy falls back to a simple equality filter using :uid (e.g. (uid=alice)).

Notes on escaping and safety

• We escape the interpolated username with Net::LDAP::Filter.escape, which protects against LDAP injection and handles special characters like (, ), *, and \.
• Your static filter text is used as-is — keep it to a valid LDAP filter expression and only use %{username} for substitution.

Group-based recipes

• Active Directory (simple group):

  (&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))
  

• Active Directory (nested groups via matchingRuleInChain):

  (&(sAMAccountName=%{username})(memberOf:1.2.840.113556.1.4.1941:=cn=myapp-users,ou=groups,dc=example,dc=com))
  

• OpenLDAP (groupOfNames):

  (&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))
  

  or, if you can't use memberOf overlays, filter on the group and member DN:

  (&(uid=%{username})(|(uniqueMember=uid=%{username},ou=people,dc=example,dc=com)(member=uid=%{username},ou=people,dc=example,dc=com)))
  

Username normalization examples

• If your users sign in with an email but the directory expects a short name, combine :name_proc with :filter:

  provider :ldap,
    name_proc: proc { |n| n.split("@").first },
    filter: "(&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))"
    # other settings...

Discourse plugin (jonmbake/discourse-ldap-auth)

• That plugin forwards its filter setting to this gem. You can therefore paste the same filter strings shown above.

• Example (allow only members of forum-users):

  (&(uid=%{username})(memberOf=cn=forum-users,ou=groups,dc=example,dc=com))
  

• If users type an email address but your directory matches on a short user id, also configure name_proc accordingly in your app (or the plugin, if supported).

SASL enables alternative bind mechanisms. Only enable if you understand the server-side requirements.

provider :ldap,
  host: "ldap.example.com",
  base: "dc=example,dc=com",
  try_sasl: true,
  sasl_mechanisms: ["DIGEST-MD5"],
  uid: "uid"

Supported mechanisms include "DIGEST-MD5" and "GSS-SPNEGO" depending on your environment and gems.

If users log in with an email but LDAP expects a short username, use :name_proc to normalize the submitted value:

provider :ldap,
  host: "ldap.example.com",
  base: "dc=example,dc=com",
  uid: "sAMAccountName",
  name_proc: proc { |name| name.gsub(/@.*$/, "") }

This trims alice@example.com to alice before searching.

If your app is served from a path prefix (for example, behind a reverse proxy at /myapp, or mounted via Rack::URLMap, or Rails relative_url_root), the OmniAuth callback must include that subdirectory. This strategy uses callback_url for the form action and redirects, so it automatically includes any SCRIPT_NAME set by Rack/Rails. In other words, you typically do not need any special configuration beyond ensuring SCRIPT_NAME is correct in the request environment.

• Works out-of-the-box when:
  • You mount the app at a path using Rack’s map/URLMap.
  • You set Rails’ config.relative_url_root (or RAILS_RELATIVE_URL_ROOT) or deploy under a prefix with a reverse proxy that sets SCRIPT_NAME.

Rack example (mounted at /myapp):

# config.ru
require "rack"
require "omniauth-ldap"

app = Rack::Builder.new do
  use(Rack::Session::Cookie, secret: "change_me")
  use(OmniAuth::Builder) do
    provider(
      :ldap,
      host: "ldap.example.com",
      base: "dc=example,dc=com",
      uid: "uid",
      title: "Example LDAP"
    )
  end

  run(->(env) { [404, {"Content-Type" => "text/plain"}, [env.key?("omniauth.auth").to_s]] })
end

run Rack::URLMap.new(
  "/myapp" => app
)

• Visiting POST /myapp/auth/ldap renders the login form with action='http://host/myapp/auth/ldap/callback'.
• Any redirects (including header-based SSO fast path) will also point to http://host/myapp/auth/ldap/callback.

Rails example (relative_url_root):

# config/environments/production.rb (or an initializer)
Rails.application.configure do
  config.relative_url_root = "/myapp"  # or set ENV["RAILS_RELATIVE_URL_ROOT"]
end

# config/initializers/omniauth.rb
Rails.application.config.middleware.use(OmniAuth::Builder) do
  provider :ldap,
    title: "Acme LDAP",
    host: "ldap.acme.internal",
    base: "dc=acme,dc=corp",
    uid: "uid",
    bind_dn: "cn=search,dc=acme,dc=corp",
    password: ENV["LDAP_SEARCH_PASSWORD"],
    name_proc: proc { |n| n.split("@").first }
end

• With relative_url_root set, Rails/Rack provide SCRIPT_NAME=/myapp, and this strategy will issue a form with action='.../myapp/auth/ldap/callback' and redirect accordingly.

Behind proxies with unusual host/proto handling (optional):

OmniAuth usually derives the correct scheme/host/prefix from Rack (and standard X-Forwarded-* headers). If your environment produces incorrect absolute URLs, you can override the computed host and prefix by setting OmniAuth.config.full_host:

OmniAuth.config.full_host = lambda do |env|
  scheme = (env["HTTP_X_FORWARDED_PROTO"] || env["rack.url_scheme"]).to_s.split(",").first
  host = env["HTTP_X_FORWARDED_HOST"] || env["HTTP_HOST"] || [env["SERVER_NAME"], env["SERVER_PORT"]].compact.join(":")
  script = env["SCRIPT_NAME"].to_s
  "#{scheme}://#{host}#{script}"
end

Note: You generally do not need this override. Prefer configuring your proxy to pass standard X-Forwarded-Proto and X-Forwarded-Host headers and let Rack/OmniAuth compute the full URL.

• Header-based SSO (header_auth: true) also respects SCRIPT_NAME; when a trusted header is present on POST /myapp/auth/ldap, the strategy redirects to http://host/myapp/auth/ldap/callback.

Some deployments terminate SSO at a reverse proxy or portal and forward the already-authenticated user identity via a server-set environment variable or HTTP header such as REMOTE_USER. When you enable this mode, the LDAP strategy will trust the upstream header, perform a directory lookup for that user, and complete OmniAuth without asking the user for a password.

Important: Only enable this behind a trusted front-end that authenticates users before they can reach the OmniAuth endpoint. When header_auth is enabled the strategy logs a prominent security warning because it trusts the upstream identity completely.

Configuration options:

• :header_auth (Boolean, default: false) — Enable trusted header SSO.
• :header_name (String, default: "REMOTE_USER") — The env/header key to read.
• :header_auth_source (:env or :http_header, default: :env) — Which Rack env key form to trust.
  • :env reads only the exact server-set environment key, such as env["REMOTE_USER"].
  • :http_header reads only the Rack HTTP header key, such as env["HTTP_REMOTE_USER"]. Only use this behind a proxy that strips client-sent copies of the header before setting its trusted value.
• :header_auth_require_tls (Boolean, default: true) — Raise an error if trusted header SSO is used on a non-TLS request.
• :name_proc is applied to the header value before search (e.g., to strip a domain part).
• Search is done using your configured :uid or :filter and the service bind (:bind_dn/:password) or anonymous bind if allowed.

Minimal Rack example:

use OmniAuth::Builder do
  provider :ldap,
    host: "ldap.example.com",
    base: "dc=example,dc=com",
    uid: "uid",
    bind_dn: "cn=search,dc=example,dc=com",
    password: ENV["LDAP_SEARCH_PASSWORD"],
    header_auth: true,                  # trust the configured upstream identity
    header_name: "REMOTE_USER",        # default
    header_auth_source: :env,           # default; reads env["REMOTE_USER"]
    name_proc: proc { |n| n.split("@").first }
end

Rails initializer example:

Rails.application.config.middleware.use(OmniAuth::Builder) do
  provider :ldap,
    title: "Acme LDAP",
    host: "ldap.acme.internal",
    base: "dc=acme,dc=corp",
    uid: "sAMAccountName",
    bind_dn: "cn=search,dc=acme,dc=corp",
    password: ENV["LDAP_SEARCH_PASSWORD"],
    header_auth: true,
    header_name: "REMOTE_USER",
    header_auth_source: :env,
    # Optionally restrict with a group filter while using the header value
    filter: "(&(sAMAccountName=%{username})(memberOf=cn=myapp-users,ou=groups,dc=acme,dc=corp))",
    name_proc: proc { |n| n.gsub(/@.*$/, "") }
end

Flow:

• If header_auth is on and the header is present when the request hits /auth/ldap, the strategy immediately redirects to /auth/ldap/callback.
• In the callback, the strategy searches the directory for that user and maps their attributes; no user password bind is attempted.
• If the header is missing (or header_auth is false), the normal username/password form flow is used.

Security checklist:

• Prefer header_auth_source: :env for server-set variables such as REMOTE_USER.
• Use header_auth_source: :http_header only when your reverse proxy strips user-controlled copies of the header and sets the canonical value itself.
• Keep header_auth_require_tls enabled unless a separate trusted channel protects traffic between the proxy and your app.
• Consider also restricting with a group-based :filter so only authorized users can sign in.

While omniauth tools are free software and will always be, the project would benefit immensely from some funding. Raising a monthly budget of... "dollars" would make the project more sustainable.

We welcome both individual and corporate sponsors! We also offer a wide array of funding channels to account for your preferences. Currently, GitHub Sponsors, and Liberapay are our preferred funding platforms.

If you're working in a company that's making significant use of omniauth tools we'd appreciate it if you suggest to your company to become a omniauth sponsor.

You can support the development of omniauth tools via GitHub Sponsors, Liberapay, PayPal, and Tidelift.

I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).

If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in bundle fund.

I’m developing a new library, floss_funding, designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.

Floss-Funding.dev: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags

See SECURITY.md.

If you need some ideas of where to help, you could work on adding more code coverage, or if it is already 💯 (see below) check issues or PRs, or use the gem and think about how it could be better.

We so if you make changes, remember to update it.

See CONTRIBUTING.md for more detailed instructions.

See CONTRIBUTING.md.

Everyone interacting with this project's codebases, issue trackers, chat rooms and mailing lists agrees to follow the .

Made with contributors-img.

Also see GitLab Contributors: https://gitlab.com/omniauth/omniauth-ldap/-/graphs/main

This library follows for its public API where practical. For most applications, prefer the Pessimistic Version Constraint with two digits of precision.

For example:

spec.add_dependency("omniauth-ldap", "~> 3.0")

Dropping support for a platform can be a breaking change for affected users. If a release changes supported platforms, it should be called out clearly in the changelog and versioned with that impact in mind.

To get a better understanding of how SemVer is intended to work over a project's lifetime, read this article from the creator of SemVer:

• "Major Version Numbers are Not Sacred"

See CHANGELOG.md for a list of releases.

The gem is available as open source under the terms of the MIT .

See LICENSE.md for the official copyright notice.

• Copyright (c) 2011 Hubert
• Copyright (c) 2011-2013 Ping Yu
• Copyright (c) 2012 angel brown
• Copyright (c) 2012 Dmitriy Dzema
• Copyright (c) 2012 Dmitriy Zaporozhets
• Copyright (c) 2012 Pat Thoyts
• Copyright (c) 2012 Rashit Azizbaev
• Copyright (c) 2012 Samuel de Framond
• Copyright (c) 2012 Terry Tai
• Copyright (c) 2014 David Benko
• Copyright (c) 2014 Jakub Jirutka
• Copyright (c) 2014 Jason Hollingsworth
• Copyright (c) 2014 Mack Talcott
• Copyright (c) 2016-2018 Drew Blessing
• Copyright (c) 2016 Julian Kniephoff
• Copyright (c) 2016 Mike Tierney
• Copyright (c) 2016 Sasha Kotlyar
• Copyright (c) 2017 Michael Kozono
• Copyright (c) 2017 Tiago Botelho
• Copyright (c) 2018 tmilewski
• Copyright (c) 2019 Drew Blessing
• Copyright (c) 2022 Finn Bacall
• Copyright (c) 2022 Stan Hu
• Copyright (c) 2025-2026 Peter H. Boling

Maintainers have teeth and need to pay their dentists. After getting laid off in an RIF in March, and encountering difficulty finding a new one, I began spending most of my time building open source tools. I'm hoping to be able to pay for my kids' health insurance this month, so if you value the work I am doing, I need your support. Please consider sponsoring me or the project.

To join the community or get help, use the RubyForum or Discord.

To say "thanks!" ☝️ Join the community or 👇️ send money.

💌 💌

Many parts of this project are actively managed by a kettle-jem smart template utilizing StructuredMerge.org merge contracts.

Thanks for RTFM. ☺️