From ae774b90ce3c7f0accde4ba3db1012a459f65fb7 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Wed, 5 Jul 2017 16:26:27 -0400
Subject: [PATCH 01/10] add LDAP authentication

---
 Gemfile                                |   1 +
 Gemfile.lock                           |   9 +++++++++
 app/assets/images/ldap_icon.png        | Bin 0 -> 22308 bytes
 app/controllers/sessions_controller.rb |   2 ++
 app/models/user.rb                     |   8 ++++++++
 app/views/sessions/new.erb             |  12 ++++++++++++
 config/initializers/omniauth.rb        |  13 ++++++++++++-
 env                                    |  14 ++++++++++++++
 8 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 app/assets/images/ldap_icon.png

diff --git a/Gemfile b/Gemfile
index 6fd584d2..fbdeab91 100644
--- a/Gemfile
+++ b/Gemfile
@@ -65,6 +65,7 @@ gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
 gem 'omniauth', '1.3.1'
 gem 'omniauth-twitter', '1.2.1'
 gem 'omniauth-google-oauth2', '0.4.1'
+gem 'omniauth-ldap'
 
 gem 'bigbluebutton-api-ruby'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 4178690f..6779b2fa 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -116,6 +116,7 @@ GEM
     multi_json (1.12.1)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
+    net-ldap (0.16.0)
     nio4r (1.2.1)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
@@ -134,6 +135,11 @@ GEM
       multi_json (~> 1.3)
       omniauth (>= 1.1.1)
       omniauth-oauth2 (>= 1.3.1)
+    omniauth-ldap (1.0.5)
+      net-ldap (~> 0.12)
+      omniauth (~> 1.0)
+      pyu-ruby-sasl (~> 0.0.3.2)
+      rubyntlm (~> 0.3.4)
     omniauth-oauth (1.1.0)
       oauth
       omniauth (~> 1.0)
@@ -151,6 +157,7 @@ GEM
       mimemagic (= 0.3.0)
     pg (0.19.0)
     puma (3.6.0)
+    pyu-ruby-sasl (0.0.3.3)
     rack (2.0.1)
     rack-test (0.6.3)
       rack (>= 1.0)
@@ -184,6 +191,7 @@ GEM
     rb-fsevent (0.9.7)
     rb-inotify (0.9.7)
       ffi (>= 0.5.0)
+    rubyntlm (0.3.4)
     sass (3.4.22)
     sass-rails (5.0.6)
       railties (>= 4.0.0, < 6)
@@ -254,6 +262,7 @@ DEPENDENCIES
   mocha
   omniauth (= 1.3.1)
   omniauth-google-oauth2 (= 0.4.1)
+  omniauth-ldap
   omniauth-twitter (= 1.2.1)
   paperclip (~> 4.2)
   pg
diff --git a/app/assets/images/ldap_icon.png b/app/assets/images/ldap_icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..74bee5ff3a2fa80a1de6de2474f5629e335e8732
GIT binary patch
literal 22308
zcmdqJg;$i_7d8wipmcW*Edxk5hzu~Kv_p4?bVv%)B`vLlC?JhAN`nXpNVkA=cYkM|
z-}kQd{td5dJ?mM_-1mun&aP`;d!p3U6mYSquuxD?a24S&O%xO~1oFQ}7~qpO>-Tfu
ze-GWCD{4Oi|NI|WMxvlFpeVv*w0*L7=6(IO$3J2oES6;`@=c$|y?s|1#$~2}?rNfr
zx*hU$qBUlI_elTindI!cgOh`SNvW>Gc>Y&U)OI66a`kVOuNVm!IH%7uEYq&<Q2e7A
z`sc*m_ZrX7Z~bo=0)HJa)nuCtNuJXLNB%$iFaHNb426&~d6-^X><VMVcPB5tO~&Kw
z`mjG}n;up_nb7|1(VGt;&o-ti+6mAY(eIXQg7#@~0{<P(t5NUhV($oX(tIoUPIuor
zZ~bQe^~uZP`RIrB4-~7^n0rMNNxXL^5tvEww^HK$gTv1uqa@PWk+xI%O#w<;#rSbK
z#sZ$NM|^hj()QlG_zBiPMC*<)#G_97O9PL0hYS*j?l7OT-CMFWCZ?`Fe;pE&mjM%C
zzNuu$A3ng81w-ufcW-Wdzy3Y7+?~kHb0Z_?p~6Tbgw01h->2rqB;N1&993MugGPu`
z`ejrkdQ9IhwDxzJW1|sUpXjs&y(~<$@XrKKKh)Vg^AO-D@-<gaT9dK+hRLG$n7#k#
z!&6B-uQYDR*m72GA9K?cW~wA^uadR}c*S$&nR|tuO+kLQS&gZs{LM&5>aL7k8fJkz
z(L0Lm)pef4H;1@tme1~<!KWwxgno?>ue^0(`$oG5vnYP)0liAuVHRd3W2U`kqb!=H
z8}cBee6;urhVgqr{DY(9pEpjuKmY7qapOE()wgu^;*P*wIVO_kFtoaif=4AR+Xy5U
zUi@Q8Qh8d)ex3Qc^7i2H`S_bAuOT%`4dZBPV(cVo4x@r<iAp`Ln>p4bl*P|5BHPU~
z4u=x`0}UNcsd8tz3LXYAqQ^_F)4UeiRMx4V%ybpS_=p>w9wr(e4k{MPhQ4`MeQ7E_
zp<DO2Ab@KssPLr+^XNy7jKlXjneo#scJB?}qZQ{kG(?_+ypo6He15h6Qfh8Cq)vxx
z%I5>ERM5eR3CtsQz^wC6BFB59%y>N(J9c=?%DQ;sGyexfkG03<N?TeB9`EnicC>w>
z8*%M>rc^B<QVhjjPqX^S&Xk*X3e)HjrqxK<b=bKp)E=)riHetHRZpSwu60!HlUGcO
z$h(GV{1B$nAlWI|)?An#d0X!-@Ugtr#Dj*f>gLbX3+rz^|5)8{7@`T<8Y3Z=v&(pE
zIkc)iHob(-M~Y2d)p8`F{<4I28}RfOdU|>hq^YN$omNyx`<bK#$<lRJmy<Xe=kDIX
zANUg!ei5K}#8K)^+dh!BRaxFd%1F1XKvbh2oWWw(P$q%z-fQKyjhX-SFiw`_lO*o^
zPw?2mOd5uV-);U1fgShA?vJo!cNaZ5x}H^Lmlg&pj5f2#@Q+_@p82{PFd3JZ$?7oG
z>o6R%51uVmM@twAh++ceiKm4Xw+lZWvAYOmT<eq^^zqe_oY1ag=yM3RH22CvKkl(M
zmyzSPj#mnu?@^9~v2_Y#jBwywg#IiwpgQ=K87lJoSAl(`nt<4B==KnMN28Tqr0bMO
zE<pg+A_0uecAr)~_xj>#u8B7VZ9phk=%%q-Hu1|L_8&U@*zbtwJ6*#bK@qS#aP|t9
zy%B;wPRb8%WQ;MGskkEsLt@z0|2FYsX=L})uJq4cU@(js)YQxQTC3uM+eJ(p*7wvp
zt#G+XGz=X6kZZU~6pue2OL+w(IzEx|5W!bWK>lKAS&WO1v~8+iyCqb{YC2s1=Jxi1
z?Jgw&ZA72Is043=>mD4MY5ZeQxu4_$!lp%m^EQQig4VhULImX;2{ZVY(7~eRrdQkd
z`{FOFEH(I+G}ZHBw)uMG&l)jpL}a|EaV<C3a9F6HT_WnCoND+get1f{a20}Z)5ur}
z>MU+UGL-jzFkddbgPfl-TAD)BcyT7US9e#z$nX1x2uuLh8#57>>}Fb{FCvt9asgrO
zM7*3Yxj9Rnp9*^GjZV~G!aNZA%0wh{R{Y(`1sdxnt^Kano=F?=_PIMfC#2xLPEt6%
zp%|Im<{?cnT*-eqsdmN>GezO0&Pw-bokVa(U$CPtHrb2e-re;y29AmT!|1{ea;T!s
zQv%JqLo?i5L@WJmsLY6KBzp(Z9NwH*5D9pA-MWYww@qE~$tx!Z?YoN}V*w8zIR(ai
z_5oF|m09w*c5u)%&G7RJ2nz>NHRuqH*arCC(eck=A*tl7D-qZ|9|gqUSWs+|nPe9_
zNE&}XT5|BKbhOCXV22elkzu<GmJv4GW)u0$;l*1Oiu-FMIkz@%N4nh~<w(qgN2+lE
zqnu|bMQ4*Ru<9e<)IrX?sis{2qA}=Ft!!Z)DuzX<XudFobF+GM2!G+?YRF`?gq`TY
zM538OF8t^3i;8`@{b$cSXdp={{;{-+ZMFhrYJ(A}&F#si{-{aZG|szPfrlMlj-r1U
zkwZBjMOx0)_@H5p{uSv-eCmIgs19uE<@Gh@!A0}<0cN8fJE2{tS<TYKWr53W2Gero
zF@asQRNDspy^*KUPafl`aQj?ZIE;|*2|wLAG&j=KH;QJTz2qXK;Pdw3RcgfIbVN{q
z$0IDZuRzT4uQm_jj+F?hE!G<pG}_6j<aAWsE8Nycm1rC{!L^Q5`2>6dzTwOGd>lFk
z)x=(MN;x_9LiYQc4T8Iq9%CGg=RlJZ6-9S-{ntB28tnf)TCjr?c9WCK8M>#xxV$``
ztuzbD0+NQI1lx6gxfteTgD@ptTWeSzgvk+}_Do=`y&Uk)pX?3z8VNV~Yvgrva&*{W
zs)^V8e3ZsSn}iT~UZrc|hyT9Gk7z_jw*9^&u5mr@;NuQvQ$6g4WzN3-EPHualQl9r
z$p0`3j@Q`ld^4$&{L~J{*DE*r&;(wXp$^x`^}k2CyU`_mJ{R~VlG&mTWl<tXpj^5p
z5_?Heuz3T;5+~pR>YDfqr>>b2UF19+M4G|UtySb%_A|eQ3Dp1k^uN<yiiyyko%~a9
z<6_5RKYIl(A!HO5Xb%l^HxdQboQ919>c9N%38&CF$9=0m8%9GtDIujw?0ocngTDls
z_Nr@Hq1j4Ic*kG-w<*_YyFY&Ze2tt6vNd{SIOi!xi68gLY?%s5^{q#(!tJ<#-onNx
z9Vt1&`s!*r!NFGBos%ciiq2_JDxx-ZTg1eUlg8d_XU?Y9K;$s_Puh2X1iV!3$R63G
z5#Ox6fP7?p{808M)4uk~tJ3orpbyM{29Ki;>)e$aQXd2`8bb=lj_@#2^CX(l_xHpg
z;PxfDBvdRUJQ!>}z{4P|AL~hyW9ufz2>1vBq_uc9A=4MK^~eP^@v*X@;?IlV_PeUZ
z7oCXuYy9S*wcXQcyIz(5<Bil#$Y{}=r7&HK*%Nu|E_aEd;U(-4wXK2@vNg70XBnhE
zkU$_tF$q;G?bJ`67CjBKcoGo8gK?FentF=7!#&3jqawrmoNJc$!iZh$e7Spd(0+u-
z<q=_V{LEV{=^);xB>=Y*uGG@`E`G)6?Zc&wp&jYh*8KY<%tneX;!AEbOKww3QfH;;
z!ISiFUp;-4C;e!@$^_Hbka+XQp*YU%n|B>Ki-U15q&^nBQg1w_Pn~l6EbBqSm+0CU
z#XhL^%sCo+la5^TZw?4RWR$XrDWl3O>1rBhBjOiiYESV#6uctfntx!sabW(+LKuWp
zm2WlvsL&<GVzwC$iQ}lozG&$e^n9H<OK*_SbOsKn??*Jh<Y$VEkm?p#?9kZ<kufIb
z-Z%e@cbqnQ%CDRqMSh2a5RFl^kLF0r;xIj{IJ9^BJ#n4~ajDa`mUED!WW2{EOo1`9
zAMUXnJL;iAn-K!^3B-)i@gABvx1m#&-*Kt&YApsA$lA!^?s`$&H*5bkkuivm1D}6~
zs=bL;!qI8(WC7SN*k+{m3!I^>cVWjrtDjaeP*!st>X4ZFIbkl$ExfJ&CX95}9?X1^
zt0HW7Zes!|mTd5|at6T*%dFq=GiqyDFC3p$B={L7z9v`s*^_T~`I%jbkXB9$Xv^W>
zaQ&95It?&KuunQIet;(xD+#mfoZw@r5!M=D3y$WCh1%Egfqf=AZlFO(FwvW2Y6Sm!
zN?tgS|79#@ePaA?(P`br;iX(JV^kxJ(9Ip^+Iy)daTXPi4-|zG@y`S}r498T2fY)I
z)byECqXt_1$V95(k#n)CNA~9}dYr#s&K(X;A_OUx@YzXNf$zSq$O-XX;S;^1qRBH&
z_OWmXbvyrF&)By+&4D9SiXKx;zLZuIlSouCjJ`cGI>8^Tu<)g)TGjK>;VsMz#FQ7^
zsl=`$t2FWL7(Hy04~=KkOXto<@kV&znk;&BbKc`HGXu^I9UTkdyOlfxm(QsN+3G%l
zZkIm(cJipbW}$zH9b8@nxjgedsB6u)c=r}KLFe3;v048}JDpb)y8D3<^;ylam$;R|
zeU4>QV|%gJ@PR~li0dEqui%S9s;SOb`&xHRCHfvXN$N^1#Q1?lXe&oVatetZ|3YaS
z-0fJJt{NZZhVRE8E4!{pq(KXoiS5;2lr2<9oLHxBP%wWSnWmHQ2|ynujt%hsFp(+N
zdhw5#+VykY3lEZ{-}T%SaTP<f{k+r9%JLt)I|JJraFa6=bx^^e`yRkLphHoeH0QHL
zUGub6L<jjo-ojMO`Xuc?PwNL}?R@Wr>jj^DH|#;*74UcOwO$gQRDCmGR=!JKOG0kZ
zOJ81L+Mi!JcYmbT(pL9|Wq<)uiL*NB6!+6;*a>}dX4GYnTeb7vP@GbTvqJszTBX6^
zbwx@6G;e#-)`tZB;_`d_a;W6s4T&&HU?x>pgkM(bzO+$)K)LPIPi(D&jjv;Jy-#WO
zO$mghoA7kv=JN~QS!R222DVya4bddG^Xi*txAO)6%=B7|P!_H+9H|5;&q3BUYfQWu
z+_@O{d#f`R@HrzIaK6wt1c4{NtQ{qO_uzX*RhcR}dk3T+?Xn4*KP4cd4P&;b(LY!^
zU4zF8o)7ILrsVAO+)h^h7(Kwncz&^<l~q|&p3I`G2}Kai8Z8$2ue_pOqFrsY74VmC
z@WJU>b;(gL9E2)%svbwn^)fs@#m6}O$|hufpGcPmeGDcmX&fl_-``Z-ICHa*rD}`L
zCovRsc)LOI$#wR|JjL?xGb2?ScLlw-L=~z+lRs21$*es|y@Kb1|Mouh?@>txF)T%P
z?w)WHV@VAU9IdL^vWxNYWS>=nu%bpkl*K?drq=<eY0#)jQ^g*791fsAQCm!{Kv;!=
z{?k5%z72`CwWL;ED`)QVQSmZKCC*#z3Atb1=6UlghN3I;owqhT*gmgEewC^H?k$Lg
zBje5VO+*VG`Epc&8(lb|Q@@<f<H}^G2WD7Zu0QAC6rPL$k5}slH<PDE#hclCWs%;y
zUWx#vG3R`;eb}{io86s+f}O^!t3AOHWTe9-hN0+qc!EaqsTUm1Ykv76GcUU)aC@un
z14^+#-elfCDoO@@>?l3=W$qkO9LC`fbXPb}Qqu!REZm_Ajw^?{7wF6hQclzUQC>1=
z4$^S8UH_4P*ifFR-C*m6NB(WQ@1g|;tTYrk+0vAJVT8f8h{y&Bc3QmW3GNdhUc#K)
zx$Wpbjd#BwBZM0dC-b`3-~QR$IbWH5;S5t)WKd4St1{h80oVa@=s$HxznYY#n;o4<
zY3NrZY!k1hpi5*!s+cqLEzp1ei|WB;C{$0ZGo(oCzSWV<>yH-@B1WaHe%r<)4<fP{
z^p`4Y?y_4>6}w$QJhL2P7&*b{$`N<1dr#{v7*v^?Xhr-C!#5~AuwJSRhJ|G{Cu8V3
zm-m8vOC+X<35pP_X>L>YHSOje;q7DK&dz?&9QVq-Rq43lsgq^N28AWT{qd37PWe8N
z-Q&QcEqKCk#oT3r(gH6$Q?wqc?D0@6&i#TWQQrTKU=Q30x{AEeNW4nZO&AFAyl)*i
zGn@RuC6OuY66N)UC4qHNt*2N;$3Mdu{j=FQf4>l|4may3ibYpuqchTp!$1EP33li9
zZwd#|@I&D|$vlUBz=n`@*T1qDJ>h5-e;HBfu>{olr^Wu!;Io;(GjzVdk3q!HD1TY(
z>#p3+4`z20MWQQLA_Jhw@83d_8w&;TW{y6y|8<v}(Ii>g3wkAI5s_XH!vIB~`C^9t
z%(?#z`!AZ{dw=r>QRr(9>;1r(*=6C*js|Z0Tw^WK9m9S$(HnH-57+7YUAf`TKvKc1
zq%J?w6wAiKHT39^f1e3>tW5H_Z_^VZDj)g=I6M$0E{degOJ^5D!yUUYl(HeA<Z=Go
zy=_1(5<_YQrv6iZ&UwzWUWGv-x^gUv7_g>M=9T+>3j*1q+1?~lIVeJd3`8m~?i<l1
zrOKQ0`zTZU2UM$<S)NB1(wU%~OMQ>KwvZ#l)=iPTyhGjjyuvs{BC4mzEwbzHFu*F!
zqU-UHuOXpy_F(lI6W03_HxNrf!xQ-L1MzEEFGDDGA{m<)S{NhC!sCcI>P}5d$(tdm
z9fz%Ds4hvRsa%xz(+@W%CI$qLjyzQpQ`0*_SW5G8j9Cl&upW}momOxi9RHq;v}lh`
zT5PSxyiPcYj+bG5m$O4e`=%o$r)xbPQgH?6q4N(&*q{jS4IxF}E-^?2xeW5L#MBKk
z<YS3_A#x*!!*vk{BW=1v=5hqsx^F%GZhy`XJCV|csxUJpiZ={AVR|!6D>vLa{7SZd
zayW^U5sDx@GvRSoFxdY9ZYPA}kfzWom8N$+KEJrm2Iaf{H(3vyPV@HY58mEF9Hm}#
zgkUIEjtLI1S&sHy0@^n!|Gw_3`gq$A+f+e<(K(-sU1O%+>$M-}v0o9*dyNpXt3VOV
z9ThKkp5H$UW>K~P6CPc^Jo`}O_sj!_k21XzBPPs`qyLFe533kjhPwMXO5pvI{U?8@
zuyr45Pt+bW*bsHBEg9%rtBGTiMImDuq(jhy;vSA6ERcEFFnK+&YpiQ-Zoz4k*nCkZ
zrB>p+eYkMJPVbr?I+IrVI;UG;5fw$9pa{Mi17F|tF3~?T5#PTq@Q8(*RhrsuxH#k;
zb@}<bCW#2O6%<+59X)2Qy1QEl1PRv~G!5gzdE$3aTSJZwZj!q0P%u1hm@euc{*#OG
z>YRKF3N-9Ad0-tX0ag_OB<NOl?xsZ|70SHuDbuT^<x4z|d@7<+;P>2`*4+WsD_54o
z=h-r;nR(kWifnZLp7=mqmm%6f8y<Z3^ArX!#0YQX5`H*Lfr0b}RVt_u-^f^c&tynB
z%)Zj}OKs~nEnf$}<P8dtyUCD2zg*tj$i$tjfD@PsY)Gy_n3=b0Zlcmf$clAjXg3~S
zGPU|Hk;c0&gO8U_zvBLkZvu8HQmP$Q-x*|ABZQGs779+}0Cf1FSN62hG|Uc}_n%xD
zBOhX-&|Eq`=KEOoIsl3&ln#1r!Q<_N{{UO}eOe$Q^b>a;SVi90?rBW?GqbH7dJ@_<
z8}6B60f;NJxDAR?vvw?5g~bmYD-YonO(JmR(wc;|_a~cC=Vt{439~{tnAo}$$o*e6
zPK0@sl;(xjmWhPQy&e}P=*n9xBchdk0!4Hp_p8^~XzYQLueJ4;<++{bS(RyGAlED+
z=E0yuvCC&fWq8yq-@64*mv?Ep2K&Jqk6^_ln!$_Zs}v&IV1OS^lyHn)n!=*-na=h2
zliigqA?MkrFepNn1cw8wLOK~ozgZMMP?9lBtGLATYFCz_&xu+s0^K3fc-k=G3a<j}
zvAA20K=kwijbcedl=%(F99o)+WIS-@E!wF<OyL@I21rLa@{VTn-<>0${VKi-b7Jq}
z{IFixm}xr|+K_RgO1ww4Y5(V{8WWF)`HU;jiOnk091NQZxDZGZ)Jg74IkG0`7H$>Y
zmZ1~m7VToV;GNiu%vAhIlSD_6nA2`VWg7~3T-V8PgFELjx?(;P0WP&om0BG7Hnz)I
zwB^ZHY<Y{(NXrpk+xM)iY|DFLR{0hLxY+-DgaqS828`%I_JZdJt_>;hc4kff_H@pf
zFM-b;sdORRUPV-@Enj*@i2BKC_A9w9`;jM*(S~X_IR)}Y^Zy0W5f$H%c@7Qsgd!5#
zOWvm^pbfP}>={X*a!06o;Ar+c*Zf_NVFR8<0Gi!>B|%n}>=QU|R(pDsW|!1k7{Ux(
z$`dgRJ4=6K2*BjP3Ir_w_Z;!V5XQAld<S4csnQ&5$bloHYPOzu1a4;d8qX^oSF&v_
zu(*S>c-Gp3A390!mVtP8HcK!9mAHk67{~>Y8`T3wV_{*0SuEVS(llpjS`brC0gPwY
zB4CT~cUBalk-ewKo+x${pZmD;d7B8ic<b1|4364k(U)^chF*U>%>XuQ%=!>}!bYO=
zpDGbmI?~a|^-UQ{)icw_7b#Sk(vATQ*4>qWAZ14SsXHqE8DUcLDlpKtQ{dweCL^h_
zVRP`@@o)lOh_LiKM}U`g^-Rh2et2})Knr&f|8I|`@b>RgV(en!E>HxD|J{e9zgPM|
z*}?}`%p3Wde587rKc)-)X&0vuI4wiRCJP3b@WvrJ@>QXTxL0NcEAA?MTW42QZtkrc
z6weQHuorZdj;dV`1SLwlf!EeR+%=wk*m(3j<8I6s<eh8k4oEdMqdai`H@?vl>L0JD
zhG}qBY5gk3j)yq2&9t@ht`aDX+4c?yo1PI)%nT&6z>TfxEL4pusl;1;X0~zx35R`6
zcfiE`8uT<WxN-7v@+!bNWPoyWm~?&OMhpm#GyeEW33qGhax(M;ww8(D3(+GE#JBcr
z@6D_x)32Y)h-u%z>i~w4&!ql#M|zY=3@y=~r`j}QApF(|6i{Ax;6TRD1YHS)N&*xR
zxr%|fw8oB8i`Gp8a-X;moScKL(wLOJX`!^p_km9UvM+qhAK&;1idbk5J_45mh)|#k
z6bmpOFoJN_qE$-ze{o%56oBM`G@p(`(>Smveh%V-=nrhju7h5?GEmw^EcT!5!m<j+
z-($?f2`_h5$M@AhBttFNZtr+o8^3CJJRF_cHn_}As(SCVBWTn<Gxqzdi^fyRL2>a+
z5l#mNNn_~=ZC8w#SStl1auBm*{p0(%iA7d#&A>$U=<UJP1O`|R6Nps8%rng*e|4!?
zRDQuq`w!>skco`lJoLtA=!$bMS_kw0!4w25lk3_xpjyJuTnYWDjlK;)cZudWoYJbX
z7~uvo<<~rA;<4O;YKbzQpg6XiYdyl7-=U2j6N*nc|H@=K&Y1_(MsK|Ce1+%LOW+ep
zG^{CORJAH^+6nNzSUbTPuPl&%17DamT{k+l=)J*t1@6d&stZA-9oEFvme2|QQD{u;
zK8X4*#;E<k)iqNmK}TXZ-zL2PIzZwIuwbp7d7I3T?tqX!m0bVt7%$vE)(YI&bUT;L
z_`-ml{><C?-Z4644FKIb;)8Xe&=Gp$#h7d3nRan(PsbnhUEX;!Z`W17p)!q><fw*!
zSFt6hWuWr$efP_Lx<?FPF7e%CM^8O1pB!mgBrbVH##`CX8%yKWoq?p23(@uk&q?w@
zJ`<r_4kb5nX1-~L*^{IV?XB7C!(QPMsmt3%=e(#WbVW4cjF(OZ(qwmg0pMzQn4NN4
zn2-tIusk=WW4<agIyK5?dOtBF7Puc3@AvAQP}YQ1z`y<PnoR!iOt*~j`y9^}<#!tm
z-xg&4_YL0_3G;}HD~2*nnnC_B-w}n=#(z5;Z;rcOB@A0JRi?kfK+CsyKbqS^2W*$e
zn&g9ok#KH=0iM@~R&RB1zvri2J{WmC9Gli2i$~oXRXd?{Y7L$8YUq5oU5R5<DKzdv
zz$lh+I{p=`Y^ce8rCg9v)50m0S2_WFD^>D$Iuw*w+NG{0s{Rn=q-gZocaoLS<(W*k
zqZh&0JU`dr@3zh@@#((~2y`BK=7A-?)%1JilzNZvqZ#%@W^0dQ7fj#RCc>3GeQR)Q
zeh}#B=1k9no-7?<$M&nf50f5IwMQ5)L?WqjS!GVTV;k@WD$yM*;tpq?CZ>I(*?Pt~
z+#b{5TtQF2&%dxFQ&?1Y9qT>b{|>$MQ{zj!El?SgDfG+kj&1=!ReM9k8v?t6FJlpz
z|BPi@wQ%$*C#X*1A40x<Eh{6ZZ9g!c{<Y6LqE6woBV^tF*F$3D9SD?B_rJwu0~0aj
z^?n_n2sdoxtX#mboeGpxR54np->_?fDiOltVdvHQj4W8aqJ@?!(Dt6j56%rCb*Ji>
zH!__P(lEkv0AHV6`3QZS0Ley6byzxPRCviG`Hu-%+I$P!9vAchTdi1FA_(7n%p`59
zYQH&JaADj4qY+tXUdTJ=gC2u?V|NqZehI%4$F`gP(efrf9tg9Ub9U=`^lEHBhmc}%
zNYF*F<K)~1LT3?dBDr?v|Az|z;z?*lnF4hJ1VZ&q^3>>27>R7zF|T%eiTzePLl71l
z*1$^XITOL^wZhkDPv3t3UT*@f1_w}PjqyKBV&SYfI+d{kb#M}=uaXZC-=bow$MxI3
z(9LbUXZM$<9KhA7^m6%53DKbo@S|@DZ7FzaxX_M57wCty@tXWU5ze1OtWqYFnU(w&
z8Pdv^7gU$8dLuALMugeLFcSa7@}*IKGW9&ee-bf!1zbwf0&wNe#K~>(4Ge}+a<4wf
zgT-vpI&UKbw-fAnT&+r>$=Xheb6SF^HCmj%39q!H;u&)=O%}2DO_6tclLM=A07V>)
z;*%+*l~N)cUsrd+q8L?bDc@@QBVNllWS9i$eA@BeIXlGaot!J|_2Gb(xSYbf9-j1L
zKe<8{00}H%6u@Rm?RWmk{Fbfs7?hzA8RZ0v{YYWfsUb^JCi^vD&NPJ`jqY^~7N|RH
zP&AFt05q_H>p|i_vFlrrKTpo%9KzWVe$>st=kpaBo1g^w1c0!u=@gWdeh-K3!U!3!
zr<@~0bXYEvpB35+2u+wd>BN8sj_>xY0Rjfl8AxYRfTJ+1U2F<+E&xefxCNQo$Xxe|
zNjv~7I)`&-LGY6Jv0v(2jVa-X-RTwD#bJ#BtoL`Ec)Ig)?n@XU>-7|OKs!M08$-o4
zNE|D6S4I6$0$a_=&*(Qn!qj(wSAPn;(7Q9W=bP9QZJ(U?mefdCkib4I##A1wp~Km?
zrN)FtPjn3dcC5+@#RYonLLRWEwcCHh{qh>Y^pZ8xDF(s<-j@w~(d<7h+f>*Cz-l{i
z?;`WRH2VGUkOQ?X7f>QPxkAe?AjpXRWzm9)mDaMG2G?~c)j#|%XN}ARCl_OM>bA(I
z#>|vap{Zz6X}QQ23fIMN)eB2FtBZ~&bgg*h^n>34dEqUU_!15^$;;B5^F|lMkr#-A
z0}DBaEPd_W!k+cq@r@Ty8<o;lZ-RN_?<w`wibj>dj>F4PgB~sVn?E=c=)2bX_XQvg
zl+qUpEFp{>(z8)G78QkgJYZOWCxE!))1)*-7wrp2Sn`{Ngyya0hN>rtYJFl8${_j>
zTfO;2OsQ&f&#-6kP0IskP~vV66<OV~ARt_&-7exr#3coeMaA|(#Dc@2@>c@{ifR*8
z##<rdzejk)&<JUhk?!L|Mgv6_n8_oy%%XJ;U3ql78YZ7Y;gB7&=1RG~|D3s5NYNYn
z-8WNo+33+ZP_+$>j8{ZL_#ZMJK1h{=OxK;_M8*@4*<tHy6_dC4Wx}QThz#?YY+1Ra
z<UJlj#6Ed5FsvCPM#-Rh`%f77O0q5MHy&m7EAb62hV?zNq&Y6)LR9a?$XIGO0%Q)n
z$JsAZ;|i1i&A$BH+YUP|)+w#;vpJ2f?4T(KD_u)5Ahe0DztX>%_BZihBof9AtCG;l
zXz7-s7t{~~rOmgnoD+OD6T-6HMgfx-5aLnvcsQ6^ZA!Qq9-I6Gxr*~{2EP2G4$Bcj
z0paf8AU22|EwXTEHdV-lkd*q4l!c0K;^EJ}+C&auNk@43;xCWLpcVd$ju0j>3y&s7
zZ>eD=Hw#B@9%7=+H?bCNDd+?1_)qRWc=*K=QjU(-$OD1!z8n<TTa1IV-hDvJvwZM9
z1zov^RoN1jtiWuctC+b#L0I!af*k#e>wm{ZeO&}a7%r(X8^?Br=NU^Gd&EXw_phyh
zG#7%>+6MBrPKZr=(#etnqySI^T<!&vpYrh=d!$5W8E4x^Llg_Wzb3`qdX1oVFs{r$
zgjL6QPittTME5f#xv1%-ee`mc&XF5C=KaX<7$756yDsEHbhfhfmg$_4mXi|$A*8O7
zNvgy|{p|cBVWI_N06OFQc|@e~&U&v74hjY-mcCM#0Y-k(UK3ts+skU;&StC^5XrrF
zv;Z3`O_vrWvg2N`>a9)u0?I1wCx5lI4DYm<cv#2)+6qdeLV>lWP`qy^W=5W%)L3iL
zdFM4$OKhj|t;*zQ$oP|K0mejQJub3e0B+8=^A&Md!En^gb)hNmI1vHh>hhKz69E>-
zh07~!<2m)1I-ReNI5g*t)C!fWZ+}Cq+W$hlA)cQ|i~s%_*+lYFGNQOgTyc8s>z2x@
zC`B9`F*2L|ef$)Nk?fb#>sgorQ<82%dio<KXCzMk1}+A8I1SEfj6;-pQBxEgi&vUI
z;T~rF+0UUFT9J2ekg3yKn+dw-0M6R5g=sE>=|)qJ*{oMG_0ZoVOk0l8tca;CdaX!(
z8_FQ~vv}U7o0+mcHVVlb2p9>fCRrKkkSSrn$6qk=Hh}^ZKwJSR7>5{MPFGimr3w@-
z51dPyQ(0#WwY_WM0Gk+DqI18{nX+Cb#;pu8R@!WNJPih({M|cAp<2R*A)IFvn>Ebc
zGgCqa{A+@axM-=I2V}Y@P!v1Ok}Hip=}6PO%ICEdcSh2{^pk#2t?1nu^{73=F_p8T
zH8wQqy{(IkPjuQz2T8Y(DxBo;njA-i^U$MgQPu~#*!3@;CJDU2an3e~r5>V*(rJ!g
z0>!Dy(l%ueDCDE%e;2j74gujZ65+s{%+re;-FY~o!QN4(i#^0OfTXa1ppE!Nn@Q-o
z7d;_uOl0`8pCN(-@3zIDiTb)R=<8~I9b7i#7M2*^2;l+{ieBud7lSITFcOYE_ZE(c
zhmq)1tCqv{DkFcb0)|h6XCN=w5vb78QY0q_F9tNyfU1el&in&If)}3{XIG<vYJDS9
z7BB=h08m!iRoxXb@7`I7HG-AhyzaNu7Cc+3@;+agH&R`SlCZR_j=OaugMK$$w9H>d
zsOQF1<QQ}?IoiUNY9udClln#GW+J4&*Wtf%U(w`a2V&*GPIDZ43zOw-7NA{h`alBo
z0aRa}quaSQ+|Tq+Y0O65>s4VlZvzJl;S&T;OZWM@@Wq4K{qO&dycgpGB`Ch&>KkT>
z+qh{T?@7X&<+|3-4*TS^QE=k_f2XkwK=H(fc)9_Z<%d%l+yO8*x-ts*4?3<oeLQpo
zo323GNcaWv-);xYYT)N_tYX}tdOmn8|5uq`;fGy)bi6Evb-kX;DWHbbN{}N@pvVEw
z{8{x1Fh}lFt5=HJKSM|@>f7moy#_!8UKZ)(5ZxQ<^|-gaYk<(B!pz+h|0?@s2&c{J
z%5r^a6{z4dF1W#yqN;$(P>_L*jhUfiz=|2DsAA9?Y&G%P0*xP6C(q@tyo<78Za6rW
zvqJFsJ-oY+Ck33e$at85rCNj`{~Zvvu`Z)x${O3UG&gm`h^WLw_=$yf8fH+-M>JrK
z4i^W!T^S`5W&X1Ua)sV>=?@m0DoL=5|GA@zZ%)K&*!k><+br$x)Bjjp6la*1kB7Zx
zwQ5h=6@z9BbZfaC-o_{}At6_+5j()@m=g*j;m*hoHQ`>2IvsZca?45i&rT_SvwO}L
zF-IbNcl<Nzy#PedgCyT<KsBm6?^SmAWWCUmcg3EJAHaFxusp`uDITkK$S85dV06~M
zxGr3qxRkvI!5c7gwV&-koo)_KpFkJ22aa(Sh0U3-{eg$+KT~C0p~_2-yl=9HU}^d?
z@KY*;%)V(Ri|+*_sDtC6SF%WAAv0t%FgTTSm$y0~x!(t<4U*+_=XI@;#>rR45!QdP
zUcbHs?mdW86cv6_LW^a~!<;RlNRr4_W<LcI;>XhH>h7L8jNxQ6-J9~bS&tF_y}iOZ
z%pCsTHe=EsDW-6K`nQ6a9{XmNW0E=t{`GRD2Gq<SO9y&kf1}$X0jCWI(k`#<Js@I~
zGcb(B{eJBxx~DIayB4j&Ik?hc@+#*IxC>}msnjhR9>5$8q@GdauE>uF0MC$nJ(K~=
zYB=CkbO5V8Cs0B0Vor)!v|r*XDxYnfm`SXo5~#1`HEVKq85y>7jx<)n0w3*vW;xQs
z%Fq~+dpkk%i#`vWSO!eL#n3_;n`}f8lxz++xW-(sMGH*ViU{(PqhqR8CY3)e^`^%q
z?;YXxvn_B<j&pJ>64IroI2<byt%Y%1oO=&<tv=uDQxhOT*5tnjIk8qJ0p<%t0qk!y
zgym%ni?5*w2X#=J-4h~<ODZNRq+;HzP}ejBJeG?E0?S4p-~vzG)*ylbQH<)`Nbs>&
zR>~`E$a2!(Y@eM8N)bPrNvp&&O9MLQHF(mK>F2_u!hk=ES)LWLJq!hfR`_eYX43DC
z&RG9JhFFv;_AOc-Z_N^GOcf{06~6<VOTud#=NIijUPDyv3E(cdoagf)d=ehnb#=<^
zC9b<oLGh>;>k8H6pX20ST|r}4G70k|8(JXv_{JuvfyT-Dcv<M&{l;)jGU&55R^=<r
z?9F!RHc@KdFIC`{P|jqJdPw*mdvtZX>_Wp{^l-ie;Y$A=E5j|)VD>ua#FLb-F-1o!
zG9?{OIq?(lOgo(w(pNk2VZjY6vBr==#^cmAw!aniYU?=c8Y!ukz6bTQHV{#@^01$U
z_}T5zkOf6}r(mlHDLBUm&TK)^tVCv(@)Drfjxowi163?@d_3HmQg3>QtJDc-OhkeA
zscv-ZGRz1Wdm6e{E3u@83?5wB__xIm;o>s~B;HgdhrUr4ixq0Jv7M}d#DfY*ADzfM
z_t3bcm@(<U@Xktk%9`T}&@q>mvx+;{EE^%C$@#H9|84ZBRZ*5<MThf$;bA@}$HW`V
z3Z958`XyMCcIIw-kcqe+pdJLrZkL1T5?s8gGR<94d5zUdy@LqqPmsYCaBPunKY-x;
zZ(E1}2Gt7~4t&IG*H92xPCMx;zYg(_OUqxed6{A+;cd&7)B$Knt{{@ypeWSZe9T*^
zEK&e*YDZgbDGi3~M}P4JCif*sl&He<c%H0`;)`+U^}cSz*5ykO{W$znIjS3<hZdx5
zgt%IUv9#Zf`NEW?H{31%3)1<VCFB!VY7GvXD^lFWF(8U@{fa;8x!FNY%0vFYc)fem
z@~ReSBPiG&f@m=j3&|ZJK1v4BE^VS`S$dPHD-TqxTwov+xD5b3M+&$M|9$K-<@4oT
zeA0j4AO5gGi(lyQTO3br@Cxl?0Eg~!JY4_=$a(kQ14V2NP>w^1jQO4N45L2fP#A{$
zz;t(?YNER<za1OPLe$B_^b~1HkanPa5D=H~cu0h--5U&Z0~|aOvShIC-rhXjFVUk6
zQl=a+W~Vu~Gxo0L9k5!BhuPwc*xeb~IYRsyy*>{}plz4Gp0G$^n26TEfyAOe>>CS!
zM1ctYkJtDrL{MxNpr4PcZS`|OAWmXdqcr+1m3dLrqYxLoy@{=>n1)Hlk^ViA3a}v8
zV$nc`#g0{;+s}pg)n|^XRNa7~Oi@4PoOqbxq`CfUgc5#yQ27eN5B&Uq6GG)PgCL%B
zaSL@mNbOJ>D@HVZxR=d_V4o66*1N!67~y6Asl?JI@ra_(v>%**_^@-0shS-K)?p-a
zHVMO^gp;pw)=w-;0?jz@|F8@ob__#_-x+<{fVqKZ%pyRZQE!Waqgg3mW18{vm&O;6
zK4_${bc^u{34=5`8ZzDM1#)&mJJ-l6>c17wWq;u7LENd5na+ciW!GyBcp-88hz`B4
zWCIrxcum%(RW5_HiF&DUsR9|<mucybN_F;B-{WXhqL@CHN!oZsf`0kMwQ?5cxSA#3
zjH27ZU8TUh@J3k%hhI~*&!(L(^r7%DEi)e|q>@2vkSN3Z5W&W$Vd70$!K?f|u)^p0
zvu_$G7GxYf$grPEncP`PhjSnRKTcVuWDfi9#t8yMV5(=Wi5n+ank(-}wo~pp7t|*W
zkQJ2wU~>|gafR0|*DKqg0s@iQnz@!!`0yy}UEW)AxrpDvAF*`xWQaiRpPV)n@)<x(
zpC0TYa~+Mh+OaBxv@*oujj%@)78*2!gozoHR#0K>_9uf!fMd%D^n{QwjB#Z5U0~?Q
z3V?jdbYrY=yf0ZHkfc$>1IMSYvp-^ynPz{HgFqlPyrUEV;?mKujO})X!C=-F0H$(5
zcL3#{u4WuhcV;mBa(C|(uN|y<gCdjHu-$FuD;blZDR`G3klWCT=j|g;Uk0OMlbM!r
z$Rj@m{CRG%kWT=Yv!>or1fTFV0XjWMO@9JBkDX~DDHW78LP4`hI0I*Y*jx&t(~#~V
zjy^aRug5l3;B!mUF5cM&^wK{FtvIkGc`NWIfD5<!v_U){8Mz?<x*tA~QNQ{n<k)`H
zK$})AL6;>9gB98UrCxFs#i_f)dg{`S7VAC0239{paXJ(vOAci+9%BJ(Au3P{r)V-&
zg~GoT_J|`z56Mr4M|qp8sD&(Z<D+5lAW)uqJAMM{1A}=G9pgyIQ@5E8Qrpb2B}7KT
zt=C`tBBNzA$1$n=L|z<{{x~W!@`MFwIH2Z*w@5sC|G`vrM;9BUwuFS6F^N3*XsqlA
zl>hx1H_~gZMN+oe{Uy?K1{e<@8k$xKk${v#uUGd1S|rejdHW1$DP^G65J<<!Kqy|;
zc;$8lN-_!b$CURI0z$(6u8nj|RAN%7F)K3!Lc}v+$A7aX^8<!HU{<gHFIMQE*9};8
z^?PZlfrI}&h|&=J-x}ZY4J6TOk(TlISpJ_olE?v6OU2cf;Hh4_+f-Q^Hj?Bc1A|#A
zk*f{yc7t&((Xmm;Qr1B|1o^2oRjBIAO5jltfclEOii8<Tdd3j&!F%&Ftfyw}Xu;k5
zSjdzc!be&Y*9yuf>1zFN2HGW&hnnBMR=M2r_@9_YH^}#QYYm3D_$P@~VKC;OAn9=t
z-~H4Gq*rT-`lD#A5hy+wJ%qB?aEz=BNHz_LdQgC^g{P&icGQCWc+eP?l^cQL(ob?M
zXb+Ciw#lujk*uEHW-Fxb$6Kv5@a%|ry}nC#t^Ww`+sYU`22E$BG9-;rU20+S35cAu
z?Yz+b8eREN3xW2W-^--5vgB?_^L@IFZ<o}S>Gl0E1e6LT+s@dj{>7>(xMh!d0D&fx
zLs1ZX%>+=yh+vREYk7tsWTzr1Fo0`eZsM~U#C5O566a@(Cam`&I~<RPDgpO(94IxF
z*(q45Hg6y_-1k$7HH_bvZSgKlO+@D1I+V&s)fP`q(jDAaNTW>6{*Eg__UxQ}D5)}V
z;iD?=9>YEmA7OmR8_=G~FE(F&alX$9%4;wM-nd_|^b-8DIvr?NVp{T!yjnFishmPk
z&}`Lx+m}zYNWRrVx%J7#O~;X(rdN`IXCqp$dymcENoUNamYy3axzWQ(dK7K{t(yFg
zoiXFh@uqA4Fw(dl$AUltu!%oqx1y=EVQe=zSR-qu%wd3@HrMQfw$OS_BjGYnl41?2
zv4xGCf-_Dt&Nb#TVZK8~G2z*k!fC%ay7;|+^)S_|2(NAr!^?BD*u_HBK{1j$Cn@G(
zJz#r4zWkz2kFwc&ALmE*B3R>_L=_@<fU~yw(rQG2tPK8zUFmZ5blvsv*x;1}ck|{e
zW{Y;TC9fGM_N5G*Bn^G7(dTlgvBBw%eMCb$OPuwAqN~~<T?GRdo|eLvdrq<jlzq4x
zOuyooHU!Pg#ZT|Fo*4*5!Jc3%&((R9HU6gp9ioHG8R#0Vn*P-2B{t;vCn~<uNcaQ-
zTM4%T0kAp{Sfc_KXoI!x#|?@OP;^bs*r@(RKP=3aNJT2gfq32P$YDdQxnl9OnOXI?
zH%D5EILa`Dz!hX(_=dvhq}jYAd-;l@eQ=MAz@8BFZLPHT{xWolWD?w%VAf2J2lH!M
z$EI;VphD!$3h5fJ+TQiY9m@ku5F3if<Evtr&hOrxhFPz>iXQY0jukaox_AHSOJ(5p
zO2}P7H~FVL&X=W^6y9;-Gd66D3SK!LZ|nvtL)jx4Gf+se0k9l-0XF2&y=y<tdFTN0
z&%w3)O(D;;U926PZW_RafaAwmzG$LoZI-}FKWLbeZ2A{BkYbN9{^(a*)kYL3iic1q
z5ZM(Ah@(n3z`oZ!cIEZTmgHvo8-xc2UIe3dN>=Ch?NG<$Mxt*s11kYK*_Z%|Yi20k
ztX^O982hI?;Yy|4%`l)QHb6tRTQ-h?dc7wPJ5qUO-$I<8;cqcQoN)*3NOl!<Oe><F
zU<U-11dtP%Y@GE@T8zC}rti4f6u$v71IWTb!wx{k<m|pF3`FKN*tk-bP&EUkjq6*9
z*gj%U%MH^yJ~+V?)VMx|aLi5S_O3m%8@m7ABX7gTAl@H_zUCY0Z70oaB<}YRkPjX1
z8cy_tvjvHGSr-u}fUQwn=_8K{3KSTiECMnDyS=VAuBYWpc{kT1c~|_dn<<8>18G2(
zk}+&cXT1{+XYcLf22^2+x|UdL{WK;!ZM?DO<|L9*_cq2sz4y2E6+5C$&i0NN+~Y2+
zg+PKu(~l)+#6mPzavI#^QOk*GVKzQd2PB4gS!-APF~Ac<Hvw~ztLILjOs5~pg8x-c
z$0ETx!AK(|zqA>vf}k=0jl4N;X3I#yWgmOCYV~8?#wogh-yHgyXr?4t0G&;RT0G!t
zKyx*I)FCYG0lw34TXpK=wJS47r^RDKCbp|<D8M1U6~qmOF$Sz<vYUT^lXq+DEJ4NF
zYg4gt{2v9RDl*=9^m3Qe4+JGMhBM6|CMT~!0EZVoOL?n9WVj<GASoq{WTsPzk5^1{
z^8BT<Omy28Wyx+8LnkX6TY{2}Xk_8lu8{LMPOetf8d?x@3;LO~HtEghZ-&iH2f*Xg
z{kRS;Xm;0Fn|=GQu>qR`19<$q#ps`}%l<6Immvf2CTR^Bd+4XnB4pc*3HTPLd)A~u
zQr=$lCBRC3sFuG~MZF1h*iXAGKz1$pd13*w4f6Pq7*{XDXqcbLRQYSCSa4b)Sgth)
zY@M4wMvI^j;%QV8!y0r%-=v_cQyLfxcSJR_2B3f;pWKZ~ZElq*F5ocN%=rrqvonkB
zY2aeCI9SL1X6QedE+d1gyG9*d<SNnc*vThM(x0ukR9*iT+;ZF(_`5T%UTKOu(w*!s
z5+mpF3!IQPkJON&7q;Gxl(!=WNP*3QZjV$wQGx+819Yu*1k!MO(TlY@sX2IMw^C7&
zl`&S&mZeqXy#&OML}!Vs_$$3KEL3lABVNH9W%n$6uMb7n_rmmnR_+(**dk3e;<#}$
zo(L^pwvX0ru7Mmj72(0?4iwzkDHa?9FGy%Z;pDpe_PVW<mbJrC%5e$pAc_Vn;AESV
zY$$ER#x!`{8Q8KS-b~z|59J{QV2oKK6&hKYS<`WnE3hD&&l864Gnl+O2zPIz$kYZx
z$Eg;k2p)wW^nB|XzV)tKpX16MQl*N3a4OEPt;SK!MZtgMV2fbjkz!9gRb_`)XA3hT
z!xtm<8XZ)Z6Xy=w^3Eoe?uD17-ol;Y6gP80CT&%C?eB=rR&ph|Lu2M6p5bSWWzPE&
zS3hNxj;eVn+Z93@zHcakG1ri`aU3BZ!6dHqU_DmjO9{s2%NJD(B{ho)xYx5Cfri{(
z(yds=@}xtcF-n{~j_^N5ml^1YH2^*cDToG8zCINzv*q%5S<}$kyWJb%_d?R3UUO||
z@8$5SRR>SC<+m#?$y$lpx!5+bdJ52IGX%v!^3R+zg|QT?vM1O|?00lePYY@!saQno
z8YskvbgMqx)qRb-$S(~BTt%7tXBTq(oc)8{d&TdPcY5ZkGD_%+d&%!|t*p~iH#$_0
z8^~8(s!YQ;7Od)Bno=H3l~$X|t@LFNJaIFt54(5u{yQJa25Qg;|IR*D($g=QpKJLp
zHF0E0#FM4h3~m{a$A^#6{hMcG?FlLB0QmUaw>K&k3TrIS>%1dyyHoi)cz8~CZ>RJo
zJ!kG;?2d>U?%er;2CxtPjDz~wR<^oxX^j3*#1q$93_kHXhe}9*H$pEEB45}Yc6-Y6
zib~&g#_jV1FoM~=C?IR6yH|+^7t~}TN7#ZFywLKiFU@c@2tTMY{nF(`-M90{7!oTW
z7&A*M*FKQyDSLNsqT%X+hho^>z1QI7#b|uDte2U}i89qU5Nfvk4QC5*AC~~vD{R&d
zl)d2kiA}hRAO;MHTE0iAT~lATiSH530c@o3TN_jbo^&-%yr5!V%2e_qfXb;L8{&-H
z+_?i?`YBW=*K{UoOWO!LV?p;vThJk5gtyR|oc6~fK4PQ)+jX39kgFh#)m`u0CRu&n
z=ORB8ph2ceW^PkK|3J@5$=P^x8oi+e>&~h7wBm^P#&t$rME=n_#o**HmyCRVOwG$D
zV9~3Y(_ucI%Amq{z{Ub;Z7|oraL82i6d2kpD=T}cQyI_WwSTnbXMoB@mZzW(Lc6V%
z>|eG@W_%#|kKBe~CerW_+ILykA@=kUJ+uo^9{CJ{WFR-`xVzG#jdK@!<@~BEIOxK}
zn})pEp#Y?Itvrt8w6bEL<yG2509B|oEHpz2ilCy(%Cf!OGIZ{d|Cc{`8%9=I@7hq0
zf<o4b{9S;lOjL@ywe}T2>1=6Mo;PwZ+$mouC@uM4C@Th<N#tepX$Dd;06Wxcti@cX
z{w;ChYe1k+R~dSIz3tZ$ST;RNbT(N*(~}dyX3^8Vr(aTL*ZW^_mN5rVtLJ{v&I$q=
zJ1@xaE;mV6fOU<glBDbMJG)R}?iTI5yLwqK;J-W~Qhe;{Neya5%hD+E++M}YD@E-G
zxBep!MH(!ctr3+FQ;@g~6lvAYc7{cUuSa8fI=na5Y0M)<X=&1#w{WpJUk3I0_N0i3
zgHcloGSvYEUk$8*)Nt_Ts$Y8Sas*Q%%9lgl_q<PT1{`E1sn$Joaa=Jkw3f}!m%o4)
zcN4zaG-AoVevZ@T%{x3X4v4*PnY+cfq?=+Da0ujPQ~8g~G+ZD2QBMHZ4b=NfVyMWQ
z@dy2y6Og{VptpGcE7!?ZFLn>3P|wgbXIz!3+;31ufP&T*kPcZs!PeOc5S%M;Rb!hI
zCrnr|Kj)d4+Uy1$Yw`3q7W@M`@BhUQ{+M2=L6jr;$sK#GZV=Gg3-TkmShC(s+q&`2
zvLt~*UqfJqU64xvQez;%`SLop8>p*jYa0r(a>Ej&A48ft^GhUC0|ZCs#-af4==`g;
zN0_$cg^-$=ESWp(!T>#gkbD6E@N}@1tLw@C84}4s0t1+S1}<j}zbff1a+$@O6=ZcR
z@R2P8z!x=4C_T9M9A{>3pv`WLCLk+g2MxQ{mut%6DdakI4?#IKE@uWOC8`Q9n_ub%
z@_?o_dCQ#i+9pRu-u!~!{>Mo7Ub^aF=NSDT+Y~sRPMqY%>1EYxZ+_*}p7IPyG|;h8
zWr*Z~r}*C|@q)V50|01%LeuD<KM>DrQ$c$HTW<E3-vxg*w7_taZ1=Y^(3?0By#p^A
zgeLsYs$D90f?MMhhTWWY4ysk;)LpG5+WeL&Zqz*pLIG8s2;flQhXo4!FM}o-2(+t0
z854)Pn*RjE+6uno7C6u^T8Wt#-g!k#yGHyyz_Z>tK`~#eW)_NUgK7L|OX8B~M*@&o
zsEK$n;Eh34Q?1!PUtNLxYMhdll$r7_@(H&W8<+oXHc{-)qe??LRIrVCmkD^v+V(Nu
z!x5J+TrW|i8li<fYg%z8QvY0Syfy7!yFPIiaVP{$I_)8(R=TC#M+2p7odrkLSc!Bh
z<4ZKp>(Vp8FFOoneQ<Vd#sR+?QLbLqOP-O{Yt<VBaB<zzXd@px1n4;EQ;w>;S#_g(
zq<U1!t^|CHPTUp`zA<QvcP<tUG`$?f+1mk>Sx~`F{1;``7!4tV${>Bb=&R=dLWP+P
zD0*4!Aw2mNO1<edaynJkPpw!Qd2_^@$DSIAv5^1g*Q5E!pl<@dRpNwUn7mi+@%(}@
z3n^O|FWcJ2*0j+0H1?GgVns*}-XQtZy*z|&0otknVdjklcf{J8ij>Z^rLkv6jULfW
zA>-TFAC%V6&P%Q1)lX0P{+a{)`GP{6?m|gaf_ra*8%@EhJ$iJ7%bP2k0m)tk37DK(
zwZXVWnY!=i>OuSVqP3a5ChiBoHhgT_-%?~(O0a1pdW)`%$(@;P(YRa&0m(>s*NWTH
z%=DH`e6Eone0(xbD=o|i7cVmnxx~#m7hOVRcb6Lr0d|_&oa>#f3Wv700-1&Y^5&JC
ze+Q=PWozg)DXacmAOuXr!&mf_(mPukbkL3Q_qGlaRqAu4oh_iQao#tRsTxUvj&n78
zP@+~Hx-rnutJvDEW2d;k+8}6ZS<Wjemd|99KQ%uM8#}5rR!~@fCuPafbg<2$)v%a~
z?3DqH?y*+LUa|4-{%@Z}u9GIUA&X`psZ81Gwc9x<;YQfoQ~-;3G5B-7giaPW2K~J>
zH?gAYP$m7!j%x<oL;P(jY?QuvJOuQP#;5q~c^6@}z&`U^xD#`Eb5pPZDYAiN$!9ff
zGc$z~rQtkmx1?>s9JTy?i8Gl~x3wqw3obd-G$+mazPy<EO&EA5qN*_p`ckYtq(~MN
za!fV+uq6`pNtv{eP&P7O)h78OO@t}Zbf&aBBI2$zmiW&Vn4omw5>8=#A2Xw`TfIx>
z-eS%pwf@K!#(~uM1EP;=x4on*plJ|))<GPoHF2M!7ZYcH97yw(Y9!tZb8DRn;jkU|
zmDrCbd^|f^D!=0XQ)*~h5!R!|12}y@Rtc9E=iL0cs3y%b3_#ow=(35pQSl(S0(feU
z8%X+)J;pr|($Ad?z>g7RYBskxF4s!@;#M7FjqQ0J9a16L#%Le3fX_`AN@rq<Fj;Y(
z)>%ZShzGweP@3DS6zjPZJF;0qw=zD6TheB%444t6PY@`Twy&kI)1uajy8gCr7k8{x
zx}GW7fG#Ac=#ZW0+)VM@#eu@cj_}ZP-O`^4ZvgtZ`l-vFSl$g1ttnDM<#(_lzGYLv
zUC|dhPj>e+97OF(?b{VnyKzo&4acLrC3vN|!a^W$Reb`ACK1m6Uo+SF*W|K<BN$K&
zO@TyuQ|W?$p=l5h<<L8!BfUyE6e)tzL<A9#B1NPK1Pn!b5a}Qtr1vH*80w)H@8+H_
z_fNR_nBD#D?(EFGyED%-X_0_0+m%3rp-${&%xOgj20e%Vb~3pf%Lz~?gfL<|_TJc0
z_H*1S+j5iz@6qXlZ*_{(FGo#(yJ>hALTSxWj35Th%IX;jRV4#OO@vV<MmJ?Bw2cBw
z%60ZWgg`_=zEC+|j`gfU__#*y*^~!0)70OkwMSDG`LJtLaYjX+fQoe$U?R|N>BT*+
zJ4ypPZ{U@M=009&6X+BY_+t9ATP5FBa2{H9h4*~Ckx3>iF-^fca*2ZJ){SvLMtg-z
z9ZKKa)s{G209uA*xYtXH(|r}vk12Ipp$B-VlwSiAsw_iK$4eaW`1E-d8W7ZL1;ear
zNMt@6l85;>nIiKUpyPZ*roW&;ut_!d7iXK5?jE9;u(dOX0Rbs`9bbRqcI$?X>EIh(
z%qX`AJQfPZv)(OSIv6$NL?!qP#GaGD29@n2))j3@3nXp#&aLy2A2qoS;1_e*1OxpT
zt15J<*3waUjs<|m9QJrEfjmunypT}|?|asj^3&~b?BmEK&B7dxn4*F<aHnwi`sr*?
z*|yEvr3g>tGane3G0e+q-PkegwQRhTwKypT(kw!TR{^<F?}2gJQYK4YBT>(1JoGUR
z@Y1V)zdVo_Um@5qsT&5pn(|0kIe*v;;H|5B*vT#dU<%i>tH-7vgG(tp9>ZK^{SJ7i
z7EqJL`21P39$<Dc^Wy<bRIYZPQ^bGn-qcBx_pnc6dgP#6YioR&{yk+cU0Q(ZaeU9`
z5zGY@6ddj=-@cQHsZPI3+J{^NT4$=m%mctn5@`=Wbstkay2|HqtQY{{jp+@BGbT`{
z6qm{*94(5|Z|eB)pE9!Dc0&!+kFqsMmOaY%1D_B#m_{vQ5TN9Pn50n=Z)>nE#6GIG
zB%rzqeRMvUaH-(lYRqaf;L3sm8vr315=}WFX<;JC-~_J{j0{d-p6Nk2zA`>3&C6u5
z_Gq&B+dH82WOf$y$?8tz&D7!GSyN=#(qA4zMiiK~RajT*By&Q>x$_l<be}K83NwJa
zuo+pugzVlt1J8SxF9UWwz3whD^L-oJ6rl`QU98;L+s=^rpde5&1VBjht+Iaj1G+Td
zZ5<zo=Ly|;uakv;G(BF(#T#5&Noi%UbjzAJ)(rU&Uq?mU4uE=kT6_iRfHEPbIYUFu
zHc%!)`YsE^@DWRQljBihhFN3uDo7^mmI-zm6~RKGT`$0kwrUC!h$V%RC6s*9EFyu6
zNB_6&lUtf$cXQ_J2wwN~Q|)SuxmZ_1<JM)#>Q}Qfd8fnqS2{tHPdoH;HAbW>fqq*>
z^5w0WNx-*O27GHJrGNNQH34z}pY&p}<iYl9$=5-}vR|g^1M*0X7ZU}==i;5Yi(MVH
zHhcqFkUTfIuY&i%9NbW&<sk?i{7X|u*R4nF#M>jAIcz$(xg-CF$Ns0d?j$A}|9w&F
z+-cLV&bgRq#{bVPVPRpqPp1yCjh6Ume!`(xRg3UjXs+0J8gpfJvh?)V)ym|W?v@_g
zE~AUlsdl>b5(|CMtDL8N<<R%%bC1?E`OY2$P3`&B^_}xMok1BU0yo=tV<mjnEH;0g
zoKLN%*KQu{a`{_B;L;StLT4oEd8NX6BUhp7g%`<lY9(u$D89jk1(*j?**()*&r31s
zXdw4F3=I+Oozkd1|28j^u<ZY13enX1)@qpAY<b3hzi^bJ9M1rW_{%NN>`(QHsz8Uv
zji=TyxLn(CrKu?DeC0esmJSYSN=J@o*3bB|HS0$$WGP0ooh^S<KN%WYD<ci23X6~5
z`*r-VQ&p4O-kJf<9+%Vm{e|yb4Het{X-6-92;Be^!!yvs<FnMYA7hBN*7ipfAzZtw
zUBiAvt+L_I5P7BJ<tEm99wykUzqfxmM`d5wx~^G|w!V8-JVUqx;mkVS3g@1#^|)C>
zr2;cLB%2gW>CV1wDEK2h2jZ^cZIZ@bgVQVQ^yttF2(@c~%Xk(vyG#XW)sed_LLeFK
z@$Wy~8cA@RFZbMG$dFf@i_=IWO0pn1<}NEj4&R#=t7^_xB;SH=*Emp_GHD{n8g2>m
zZ4q93+3wtw{h=Ko!c1;xBZ{~aQ|F-sX8s}qg$Pv?2pQ4_Ig4mgEyOv{M0Hk%L@yth
z#5i#xz5<aXYrWoocJ_qGiWBMMk;R}TE-T|IE84-D<Z;u1r1QEQo3K0-zYfRp3WiO!
zFlK7I>*G(zm*?Sv6}7q31RaQ_>2qJ@aQ52g-+#tc&r%t_wQJPB5*9W7bv@^NXBiVV
zCUQmo{p*<cjT%h&h=oPY;i1&d)og|4xfC|JaVz#`MGEkM5Q8K#h&A`H<hOc#U#=6A
zc|yMw;+nA8{oT3USDxjilVF~?l<p4I!9^b-y~_57$_oVpatLvkB?#xwQYd*F6?Lds
zRrc5MQ@3^Py<_Pol=3zpE#&6_HkOv5DDp(D|1kn?UwgJ}_y_y*{CJl%U(!Db==i<<
ziJFwSW!`IIb`CeAQnh|0<0x4`;ftB1+oCpJ(vYpofJcU^^-BC+CzT=8lAMhd-C&kI
z?%}y@P*9NB1=b}WCvkf=`_a>kz6U)Bqy*DVC3ilXyPI;E_4T@WoT+vfN+Ryv*YGLk
z8wp>3V^f9Uk!_>x3A?=aU>CaE1*cgbs<{v3OlO^|t}*hozE-}>L#N|@lxzy@S}#h<
z=Hmp$^v}%m2{2Jh#HO%t|8r#Dd+|o)4J(Cyhm!8nHn-i>KL*$$+$iXwgk4ap3Oq~q
zO-WBup0QFGa4#9M6t(#{?yHbGQ#d$BcVKq`!E(7$YI?6?-XAw6!C>%djgE<V;-q`A
zn0<IgX1|Bb-8GRx^Jj?jG9QZPLsW>Z!~M_%BBT1UW^sLSQ6SA*3Q?JlITu~O*(Mq!
zt;D*Pu&PIt435J^HC<4-NC6X|bMm3pzJZnOMv^8oHk38tCGtGnE<~&=GN#^7&%XD-
z#Ej~NsHB%p9J{IbBURNqKg2^BnXg*)z%Qlr$Z8VC&2IhTfT7K3UWm@CMU3K?!Y14m
zV@+vf(cvYEy4>95-bdZKvTt|GxFFMVD3b$R8dfOg4NP$?OPXH0pwIIIC?hu*+vWyj
zD%#kY>+AJLxJ*xGSkas7_drgBROUOer+RnSv25*L`%N!~mmmoH8uO%$dfUYBV#qh$
z3N4?|^rZnWKlxf|hTN?)%sX#*N9ts)LX*02O7NU6bxFA@y+A=99{#XJc2?Z-V_>1O
z3GLm^lIwDG+Y1XhlD59b9qQr|{5N9L6qK?s^pZ}-BFQKh+1yCobf9%}0txE7gq1>j
zXJv1JqtFOta-M=vg|^=~=h4|2>~O63)FoP_$QoZqy#K?}#J)5I5iWuL9}&j2&b`+u
zggL*78F3j8^hfx?jO7olN)*boOX<ZC<&bsozd`?8gfz^!p~bpH;Y;QKecAqK2GYbk
zy?-Oc8%QH-<YycVXJVdzgS9ORq1eo`JY2PxEDS^*-Dw9^bjg953i=16xuqoGsF4hg
zes)ySA<0UM<nVOje(H)(#!uA~<{@N5?^c7ujaw6*lU}-eXSQJ^+p(Y<G=enb{c}j!
zqk7W2YEi4X#%j+-mXtumti81zEXT_k^7mf!fYOmOZH1Bi>BfM8>$sN=hlE85o|W@=
zcc;oQIA?sRgsQiRoG)2aLolQWf@~q@SZwo}+c9Eo;7i-QE?UgtHd08*;<eyX436Yl
zu0y1WbLXz-dN3=EB}EbB&Bf}!UTONI;3#`naRh@SvMGj`)kTeR=cQ8@9Dm>76qbF5
z3;|_=xkn#U1TRnX;QW^4vuQFm%JHmoDZr095wql`jZ%b@nw2#mhA+d&qcX$y@0a1S
zR3-(OeaYzQZ9SZ_41~LfQ+DK*?0Ms<8zi65Us&XnVz~24!;3&9FxB~gQD>{WP^e0F
zpJ$rbKWcC9)H)@Uz?i$s%PAUeq}CwCLUmmi^EJfkij~zbEq!wdmC8dY4+w%%NXU|m
zIxGt7v^q37jPqM@5Jd4jQBc!RABvPl8;c=TcdvYd={H=ojJ?2g8T7LmYm&Mytp`>u
z@G+ArSxZQY69&|1sC?f+lPFEZxsJ{crc=>iwj_$urkV1fP;+7aj{dj>SWmZxZ9bV$
z%K~}RyW4aUlp3B6PhD&Ghbq@S{WFGdaKRXDc%4;L!V?p19JICZ!0s~E<dZGM$ml;+
zblH24rVW0a@Fo_bip_)i32~Mess=%(`IaMTL{IV;V2OS1oNA>~FE3qVrTTDOX|6Bn
z3H+q0K6Sd&?=7?$Q`-Y`yz1v8^PW_Kw&V9lH_-eppCL+@m;~scGJce5wu(sw8nm=#
zn@BHb(ici7Dp<TRSK8N6py$BB{QINNy7&I_`Fojz4r}yHo`D$_uIB387xA<PKlHP;
z%5<K0a*>%mM}$UCyiE7Vn<|1^$c|Il^MF!KT{VU<;ioq{Qg~d+4)i|%>5Gtp_V`Ih
zLyTQyu08&hMVXFX+M0oJTu7e<XJl!^OT_5UCGkC;@FM&Od%E0c9t0)!HnN$$xT&Kf
z<>QB}wGaFPy&lefc9CCe=-DDvgaRNL^kB<n@KYzk78YA((F3<&kv$%sT6;6T82EFV
zX6cz3xOeEhMXJ=Si7c51q{k6{-MSCqm~VzO<R6he7#y3|)qPZ-B0^&Zt}TS$SMo<W
z^kRav>dq}&0<J8Vv;*LSVCx4?AaRwA7W!u0IFD~4OS!dU_EZgwi_K&W)iS^z`B4TF
zwy9~&cxDf%FD_kyb#PqjL?PmW+*cRt8{P%LEl{VkuMXY-3;v~6eYk=M^paLSz1?`z
zUg29BO)bbO#$6*elfM^yu%TI(@xCeE57d_Zzxru!{-KeSOKpR=Ym?Tc@=!ymNWn7r
EKOGJ<R{#J2

literal 0
HcmV?d00001

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 01f1f979..75bdbea0 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -16,6 +16,8 @@
 
 class SessionsController < ApplicationController
 
+  skip_before_filter :verify_authenticity_token
+
   def new
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index aa51beae..798e24d1 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -47,6 +47,14 @@ class User < ApplicationRecord
     auth_hash['info']['email']
   end
 
+  def self.ldap_username(auth_hash)
+    auth_hash['info']['nickname']
+  end
+  
+  def self.ldap_email(auth_hash)
+    auth_hash['info']['email']
+  end
+
   def set_encrypted_id
     self.encrypted_id = "#{username[0..1]}-#{Digest::SHA1.hexdigest(uid+provider)[0..7]}"
   end
diff --git a/app/views/sessions/new.erb b/app/views/sessions/new.erb
index 5b5694b4..2fbe9b70 100644
--- a/app/views/sessions/new.erb
+++ b/app/views/sessions/new.erb
@@ -49,6 +49,18 @@
                 </div>
               <% end %>
           <% end %>
+          <% if omniauth_providers_configured(:ldap) %>
+              <%= link_to omniauth_login_url(:ldap), class: "signin-link signin-link-ldap" do %>
+                <div class="signin-button center-block">
+                  <div class="signin-icon-wrapper">
+                    <%= image_tag(ENV['LDAP_ICON'].present? ? ENV['LDAP_ICON'] : 'ldap_icon.png', alt: "L", class: "signin-icon") %>
+                  </div>
+                  <div class="signin-text-wrapper text-center">
+                    <span class="signin-text"><%= t('signin_text', provider: ENV['LDAP_NAME'].present? ? ENV['LDAP_NAME'] : 'LDAP') %></span>
+                  </div>
+                </div>
+              <% end %>
+          <% end %>
         </div>
       <% end %>
     </div>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index b5b3be0a..45584723 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,11 +1,22 @@
-Rails.application.config.providers = [:google, :twitter]
+Rails.application.config.providers = [:google, :twitter, :ldap]
 
 Rails.application.config.omniauth_google = ENV['GOOGLE_OAUTH2_ID'].present?
 
 Rails.application.config.omniauth_twitter = ENV['TWITTER_ID'].present?
 
+Rails.application.config.omniauth_ldap = ENV['LDAP_SERVER'].present?
+
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :twitter, ENV['TWITTER_ID'], ENV['TWITTER_SECRET']
   provider :google_oauth2, ENV['GOOGLE_OAUTH2_ID'], ENV['GOOGLE_OAUTH2_SECRET'],
     scope: ['profile', 'email', 'youtube', 'youtube.upload'], access_type: 'online', name: 'google'
+  provider :ldap,
+    host: ENV['LDAP_SERVER'],
+    port: ENV['LDAP_PORT'],
+    method: :plain,
+    allow_username_or_email_login: true,
+    uid: ENV['LDAP_UID'],
+    base: ENV['LDAP_BASE'],
+    bind_dn: ENV['LDAP_BIND_DN'],
+    password: ENV['LDAP_PASSWORD']
 end
diff --git a/env b/env
index ba0ad89f..764187e6 100644
--- a/env
+++ b/env
@@ -36,6 +36,20 @@ TWITTER_SECRET=
 GOOGLE_OAUTH2_ID=
 GOOGLE_OAUTH2_SECRET=
 
+# LDAP Login Provider (optional)
+#
+#   You can enable LDAP authentication by providing values for LDAP_SERVER and LDAP_PORT.
+#   For information about setting up LDAP, see: (LINK TO LDAP DOCS).
+#
+LDAP_SERVER=
+LDAP_PORT=
+LDAP_UID=
+LDAP_BASE=
+LDAP_BIND_DN=
+LDAP_PASSWORD=
+LDAP_ICON=
+LDAP_NAME=
+
 # If "true", GreenLight will register a webhook callback for each meeting
 # created. This callback is called for all events that happen in the meeting,
 # including the processing of its recording. These events are used to update

From 0eb26ae8ec0983a2e9a08b1b074794ad1ef67a87 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 09:08:49 -0400
Subject: [PATCH 02/10] only use LDAP when enabled

---
 app/controllers/sessions_controller.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 75bdbea0..812f45ad 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -19,6 +19,10 @@ class SessionsController < ApplicationController
   skip_before_filter :verify_authenticity_token
 
   def new
+    # If LDAP is enabled, just route to it instead.
+    if Rails.application.config.omniauth_ldap
+      redirect_to "#{relative_root}/auth/ldap"
+    end
   end
 
   def create

From f8d2540665b3aa9c018bddc4e334b0b6143a43da Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 09:16:53 -0400
Subject: [PATCH 03/10] remove LDAP login button

---
 app/views/sessions/new.erb | 12 ------------
 env                        |  2 --
 2 files changed, 14 deletions(-)

diff --git a/app/views/sessions/new.erb b/app/views/sessions/new.erb
index 2fbe9b70..5b5694b4 100644
--- a/app/views/sessions/new.erb
+++ b/app/views/sessions/new.erb
@@ -49,18 +49,6 @@
                 </div>
               <% end %>
           <% end %>
-          <% if omniauth_providers_configured(:ldap) %>
-              <%= link_to omniauth_login_url(:ldap), class: "signin-link signin-link-ldap" do %>
-                <div class="signin-button center-block">
-                  <div class="signin-icon-wrapper">
-                    <%= image_tag(ENV['LDAP_ICON'].present? ? ENV['LDAP_ICON'] : 'ldap_icon.png', alt: "L", class: "signin-icon") %>
-                  </div>
-                  <div class="signin-text-wrapper text-center">
-                    <span class="signin-text"><%= t('signin_text', provider: ENV['LDAP_NAME'].present? ? ENV['LDAP_NAME'] : 'LDAP') %></span>
-                  </div>
-                </div>
-              <% end %>
-          <% end %>
         </div>
       <% end %>
     </div>
diff --git a/env b/env
index 764187e6..a2a59d4e 100644
--- a/env
+++ b/env
@@ -47,8 +47,6 @@ LDAP_UID=
 LDAP_BASE=
 LDAP_BIND_DN=
 LDAP_PASSWORD=
-LDAP_ICON=
-LDAP_NAME=
 
 # If "true", GreenLight will register a webhook callback for each meeting
 # created. This callback is called for all events that happen in the meeting,

From 034c5ba6177f2f6cfcd0ea1ee5d0e3c9d2cd79f1 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 11:45:56 -0400
Subject: [PATCH 04/10] handle invalid credentials

---
 app/controllers/sessions_controller.rb | 6 +++++-
 config/initializers/omniauth.rb        | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 812f45ad..eeb9d325 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -42,6 +42,10 @@ class SessionsController < ApplicationController
   end
 
   def auth_failure
-    redirect_to '/'
+    if params[:message] == 'invalid_credentials'
+      redirect_to '/', flash: {danger: 'Invalid login credentials.' }
+    else
+      redirect_to '/'
+    end
   end
 end
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 45584723..3ce3796e 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -20,3 +20,8 @@ Rails.application.config.middleware.use OmniAuth::Builder do
     bind_dn: ENV['LDAP_BIND_DN'],
     password: ENV['LDAP_PASSWORD']
 end
+
+# Redirect back to login in development mode.
+OmniAuth.config.on_failure = Proc.new { |env|
+  OmniAuth::FailureEndpoint.new(env).redirect_to_failure
+}

From 704dab1e5c34a4e72776405cb2d52d8229ba4b1a Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 13:17:12 -0400
Subject: [PATCH 05/10] add footer to Youtube prompt

---
 app/assets/stylesheets/main/landing.scss | 6 ++++++
 app/controllers/sessions_controller.rb   | 2 +-
 app/views/landing/rooms.html.erb         | 1 +
 config/locales/en-us.yml                 | 2 ++
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/main/landing.scss b/app/assets/stylesheets/main/landing.scss
index 664d8524..99d10488 100644
--- a/app/assets/stylesheets/main/landing.scss
+++ b/app/assets/stylesheets/main/landing.scss
@@ -114,3 +114,9 @@
 .tooltip-wrapper {
   display: inline-block;
 }
+
+ #youtube-footer{
+   font-size: 10px;
+   text-align: center;
+   margin-top: 10px; 
+ }
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index eeb9d325..3c723844 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -43,7 +43,7 @@ class SessionsController < ApplicationController
 
   def auth_failure
     if params[:message] == 'invalid_credentials'
-      redirect_to '/', flash: {danger: 'Invalid login credentials.' }
+      redirect_to '/', flash: {danger: t('invalid_login') }
     else
       redirect_to '/'
     end
diff --git a/app/views/landing/rooms.html.erb b/app/views/landing/rooms.html.erb
index 0ec86587..a1dda2b7 100644
--- a/app/views/landing/rooms.html.erb
+++ b/app/views/landing/rooms.html.erb
@@ -76,6 +76,7 @@
             <%= t('upload') %>
           </button>
         </div>
+        <p id = 'youtube-footer'><%= t('youtube_footer') %></p>
     </form>
   </div>
   <div class='mail_youtube_popover'>
diff --git a/config/locales/en-us.yml b/config/locales/en-us.yml
index 3016c399..36c5f549 100644
--- a/config/locales/en-us.yml
+++ b/config/locales/en-us.yml
@@ -92,6 +92,7 @@ en-US:
   home_page: Home page
   home_title: Welcome to BigBlueButton
   invalid_file: You may only upload an image file (jpg, gif, png).
+  invalid_login: Invalid log in credentials.
   invite: Invite
   invite_description: (share this link below to invite others to this meeting)
   join: Join
@@ -182,6 +183,7 @@ en-US:
   watch: Watch
   'yes': 'Yes'
   youtube_description: This recording was recorded with BigBlueButton. For more information check out %{url}.
+  youtube_footer: this will upload all webcam and audio data
   youtube_privacy_options:
     public: Public
     private: Private

From a0c39c91a5a4cea98bf53c5e1978a656165d8570 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 14:16:55 -0400
Subject: [PATCH 06/10] add LDAP docs link

---
 env | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/env b/env
index a2a59d4e..a66471a4 100644
--- a/env
+++ b/env
@@ -39,7 +39,8 @@ GOOGLE_OAUTH2_SECRET=
 # LDAP Login Provider (optional)
 #
 #   You can enable LDAP authentication by providing values for LDAP_SERVER and LDAP_PORT.
-#   For information about setting up LDAP, see: (LINK TO LDAP DOCS).
+#   For information about setting up LDAP, see: 
+#     http://docs.bigbluebutton.org/install/green-light.html#ldap-oauth
 #
 LDAP_SERVER=
 LDAP_PORT=

From d80fd262bc3516902d01acdf9c0aebaf472f5b56 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Thu, 6 Jul 2017 14:41:54 -0400
Subject: [PATCH 07/10] add LDAP method as environment variable

---
 config/initializers/omniauth.rb | 2 +-
 env                             | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 3ce3796e..b08cd1ea 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -13,7 +13,7 @@ Rails.application.config.middleware.use OmniAuth::Builder do
   provider :ldap,
     host: ENV['LDAP_SERVER'],
     port: ENV['LDAP_PORT'],
-    method: :plain,
+    method: ENV['LDAP_METHOD'].present? ? ENV['LDAP_METHOD'].to_sym : :plain,
     allow_username_or_email_login: true,
     uid: ENV['LDAP_UID'],
     base: ENV['LDAP_BASE'],
diff --git a/env b/env
index a66471a4..935e3456 100644
--- a/env
+++ b/env
@@ -38,12 +38,13 @@ GOOGLE_OAUTH2_SECRET=
 
 # LDAP Login Provider (optional)
 #
-#   You can enable LDAP authentication by providing values for LDAP_SERVER and LDAP_PORT.
+#   You can enable LDAP authentication by providing values for the variables below.
 #   For information about setting up LDAP, see: 
 #     http://docs.bigbluebutton.org/install/green-light.html#ldap-oauth
 #
 LDAP_SERVER=
 LDAP_PORT=
+LDAP_METHOD=
 LDAP_UID=
 LDAP_BASE=
 LDAP_BIND_DN=

From 43496a6cf1bfc650a60e3d6c4dfe3f0256d7cbcc Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Fri, 7 Jul 2017 10:23:19 -0400
Subject: [PATCH 08/10] change sessions#new test to allow redirect

---
 app/controllers/sessions_controller.rb       | 2 +-
 test/controllers/sessions_controller_test.rb | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 3c723844..1f649ce2 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -16,7 +16,7 @@
 
 class SessionsController < ApplicationController
 
-  skip_before_filter :verify_authenticity_token
+  skip_before_action :verify_authenticity_token
 
   def new
     # If LDAP is enabled, just route to it instead.
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index 544c2b77..0bfa08e4 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -8,7 +8,12 @@ class SessionsControllerTest < ActionController::TestCase
 
   test "should get new" do
     get :new
-    assert_response :success
+    # We redirect directly to LDAP if configured.
+    if ENV['LDAP_SERVER'].present?
+      assert_response :redirect
+    else
+      assert_response :success
+    end
   end
 
   test "should redirect to home on auth failture" do

From 0040baecbfe183111e182a9156a9169e4fd80aa2 Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Fri, 7 Jul 2017 10:32:01 -0400
Subject: [PATCH 09/10] display ldap error to help with troubleshooting

---
 app/controllers/sessions_controller.rb | 3 +++
 config/locales/en-us.yml               | 1 +
 2 files changed, 4 insertions(+)

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 1f649ce2..ea5fdc1c 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -42,8 +42,11 @@ class SessionsController < ApplicationController
   end
 
   def auth_failure
+    puts params.inspect
     if params[:message] == 'invalid_credentials'
       redirect_to '/', flash: {danger: t('invalid_login') }
+    elsif params[:message] == 'ldap_error'
+      redirect_to '/', flash: {danger: t('ldap_error') }
     else
       redirect_to '/'
     end
diff --git a/config/locales/en-us.yml b/config/locales/en-us.yml
index 36c5f549..623476dc 100644
--- a/config/locales/en-us.yml
+++ b/config/locales/en-us.yml
@@ -102,6 +102,7 @@ en-US:
     connect: Connect in real-time with others
     collaborate: Collaborate with friends
     teach: Teach students online
+  ldap_error: Unable to connect to the LDAP server. Please check your LDAP configuration in the env file and ensure your server is running.
   logged_in_description_html: You are logged in as %{link}
   login: login
   login_description: Want to record a meeting?

From 0b1ae2497f45b3c173d7170ef0790a5fcade81be Mon Sep 17 00:00:00 2001
From: Josh <josha5@outlook.com>
Date: Fri, 7 Jul 2017 10:32:48 -0400
Subject: [PATCH 10/10] remove debug code

---
 app/controllers/sessions_controller.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index ea5fdc1c..4e0ef13c 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -42,7 +42,6 @@ class SessionsController < ApplicationController
   end
 
   def auth_failure
-    puts params.inspect
     if params[:message] == 'invalid_credentials'
       redirect_to '/', flash: {danger: t('invalid_login') }
     elsif params[:message] == 'ldap_error'