I won’t cover a complete Ruby and Rails/Ramaze/Sinatra installation. This post assumes you have that much down pat, so we’ll pick up the ball with installing FreeTDS, unixODBC, Ruby ODBC

If you’re using Ubuntu 8.10, you can get away with installing everything from packages with the following:

apt-get install  unixodbc freetds-common tdsodbc \
             libodbc-ruby1.8 \
             libdbi-ruby1.8 libdbd-odbc-ruby \
             autoconf make

NOTE: I wrote this article and right before publishing, attempted to replicate these results on both mac OS X and CentOS 5. Both failed to work with the technique I thought I had all nice and worked out. I spent several hours over many months trying to find out exactly what’s different between the packages, but never got very far with my investigations. For a long time, it looked to me like both the ODBC packages and the FreeTDS packages need to be tweaked to properly handle [SERVER]\[DB_INSTANCE] construct that MSDE uses vs. just [SERVER] that the full-fledged SQL Server uses. This, after all, is the convention of the Windows ODBC driver and DSN definitions. However, there’s a really simple solution that I hit upon on Actual Technologies’ website that led me to a true universal solution and that’s to learn the port the INSTANCE runs on and set up the DSN specifically to that port!

But beware, the above doesn’t get you all of the freetds tools, most importantly the tsql command which can help you with debugging issues before getting into the ODBC game (that is, direct TDS connections to your SQL Server). So, to cover the most distros possible, I’ll document the “from source” approach for *nix systems and macports for Macs so you’ll find two sets of installation instructions for every step.

Preparing your Environment

I prefer to pull down all source packages into my local user directory under a “~/src” folder. The instructions that follow assume you’re in this folder. If you’re not, then please make the appropriate substitutions as you follow along. Additionally, I configure and compile most things as a regular user then use sudo to install system-wide as a “super user.”

Install unixODBC

unixODBC provides the ODBC connectivity for the TDS driver.

wget http://www.unixodbc.org/unixODBC-2.2.14.tar.gz
tar zxfv unixODBC-2.2.14.tar.gz
cd unixODBC-2.2.14
./configure  --enable-gui=no
make
sudo make install

On Macs

sudo port install unixODBC

On CentOS

sudo yum install unixODBC unixODBC-devel

Install FreeTDS

FreeTDS provides the open source implementation of the protocol implemented by both Sybase and Microsoft SQL Server.

wget ftp://ftp.ibiblio.org/pub/Linux/ALPHA/freetds/stable/freetds-stable.tgz
tar zvxf freetds-stable.tgz
cd freetds-0.82/
sudo ./configure  --with-unixodbc=/usr/local
sudo make
sudo make install

On Macs

sudo port install freetds

On CentOS

sudo yum install freetds

Install ruby-odbc

The ruby-odbc package provides the ruby bindings for ODBC connectivity.

wget http://www.ch-werner.de/rubyodbc/ruby-odbc-0.9995.tar.gz
tar zvxf ruby-odbc-0.9995.tar.gz
cd ruby-odbc-0.9995/
ruby extconf.rb
make
sudo make install

On Macs

sudo port install rb-odbc

Install ruby DBI

wget http://rubyforge.org/frs/download.php/655/ruby-dbi-all-0.0.23.tar.gz
tar zvxf ruby-dbi-all-0.0.23.tar.gz
cd ruby-dbi-all
ruby setup.rb config --with=dbi,dbd_odbc
ruby setup.rb setup
sudo ruby setup.rb install

Configure FreeTDS and ODBC

If you’re connecting to either SQL Server 2000 or SQL Server 2005 Standard, Enterprise, etc., then the typical approach is to add an entry for the server to /etc/freetds/freetds.conf and then reference that entry in the /etc/odbc.ini. Sometimes, these files get installed in /usr/local/etc. If so, then I will usually symlink the files into /etc for convenience, so that’s what’s referenced below.

My server is called “apvdbs01″ (the WINS name) with an IP Address of 10.0.2.2 and the database I’m connecting to is called “test_development” while “username” and “passwd” should be substituted with an valid user account and credentials for successfully connection to the database server.

Add a server entry for your server (which I typically give same name as Windows Server) to /etc/freetds.conf, so that host points to the SQL Server address:

[apvdbs01]
host = 10.0.2.2
port = 1433
tds version = 7.0

TDS version 7.0 is for SQL Server 2000. If you have SQL Server 2005, then tds version is 8.0.

tsql –S apvdbs01 –U username –P passwd

Once you can connect directly with the TDS drivers, move on to adding the ODBC driver entries.

Add the FreeTDS ODBC driver by editing “/etc/odbcinst.ini” (make sure “/usr/local/lib/libtdsodbc.so” exists first):

[FreeTDS]
Description     = TDS driver (Sybase/MS SQL)
Driver          = /usr/lib/odbc/libtdsodbc.so
Setup           = /usr/lib/odbc/libtdsS.so

Add a new DSN to “/etc/odbc.ini”:

[test_development]
Driver          = FreeTDS
Description     = ODBC connection via FreeTDS
Trace           = No
ServerName      = apvdbs01
Database        = test_development

So, “FreeTDS” is the driver that we gave for the lib TDS ODBC connector in the odbcinst.ini file (this allows you to install and maintain multiple versions of the libtdsodbc.so file). We reference this driver in the odbc.ini file with the “Driver” entry and we reference the actual server data in the freetds.conf file via the “ServerName” entry.

Now that you have ODBC configured for FreeTDS, test it with:

	isql test_development username passwd

But that doesn’t work for MSDE!

The above will get you connected to a standard or enterprise SQL Server 2000/2005 installation, but does not work for an Embedded SQL Server 2000/2005 installation. After trying many permutations, I finally came up with a configuration that actually works. One of the key things to know about MSDE is that the MSDE server instance is in the form of “servername\instance” rather than straight up “servername” as with standard/enterprise installations. This is known as a “named instance.” The trick to connecting? Find out the port the named instance is listening on and connect to that port rather than the 1433 port!

You can determine the port used by the instance by using the Server Network Utility in the Microsoft SQL Server program group on the Windows server where your database resides. Select the instance name from the drop down list and select TCP/IP from the list of enabled protocols. This will show you the port number for that instance.

[test_msde2000]
Driver         = FreeTDS
Description    = ODBC connection via FreeTDS
Server         = 10.0.2.2
Database       = my_test_db
Port           = 1348
TDS_Version    = 7.0

I could then connect to the MSDE instance like so:

isql test_msde2000 username passwd

Test ODBC connectivity from Ruby

If both tsql and isql commands work, then you’re well on your way to connecting to SQL Server via Ruby. To test Ruby with the above ODBC configurations:

irb
require "dbi"
dbh = DBI.connect("dbi:ODBC:test_development", "username", "passwd")

Connecting with Sequel

One of my favorite tools for connecting to SQL DBMS’ is Sequel, which is maintained by Jeremy Evans. To connect using Sequel, install the gem:

sudo gem install sequel

And then give this a shot:

irb
require 'rubygems'
require 'sequel'

DB = Sequel.odbc('test_development', :db_type => 'mssql', :user => 'username', :password => 'passwd')

References

http://www.freetds.org/userguide/confirminstall.htm

http://www.unixodbc.org/odbcinst.html

http://www.actualtech.com

The Stage

I am setting up a Ubuntu server with Apache 2.2 and authenticating users against a Windows 2003 Server’s Active Directory. This is standard fare when all you need is a require valid-user directive. But when it came to getting require ldap-group directive going, I really stumbled. And on multiple fronts, too. I am not a Windows guru by any measure, nor am I an LDAP guru, so there was a huge cultural and vocabulary barrier for me to cross on both the LDAP vernacular and the somewhat different parlance surrounding Microsoft’s documentation on Active Directory. Its like a Southern Redneck talking to a Scottish Highlander about home-brewing beer.

So here’s what we’re going to do:

• Apache 2.2
• Microsoft Active Directory (Windows 2003 Server)
• authnz_ldap module

For this effort, I am authenticating users that reside in the MyBusiness -> Users folders and I’m restricting access to the Auditors Security Group, also residing under MyBusiness. The domain I use is “sample.local” herein. See the screen shot of the Active Directory structure and details of the Auditors group below:

There are plenty of resources out there about getting the authnz_ldap module working with Apache, so I won’t be covering this part of the setup. Instead, I will focus on the gestalt of the actual configuration.

Will the Real AuthLdapUrl Please Stand Up?

There seems to be no real standard way to set the AuthLdapURL configuration string. I think I visited ten or fifteen web sites on the topic and each one was a little bit different! And none really explained fully the chosen syntax and LDAP selectors being used. Fortunately, I came across a site dedicated to explaining CSVDE, which turned out to be a bit of a rosetta stone for me.

CSVDE is a tool I had never heard of, but yet is apparently installed on every Windows 2003 Server. After about five minutes of reading and 20 minutes of perusing the CSV export I generated, I knew exactly how to construct the AuthLdapURL configuration string. Well, with one caveat, that is. I still am not sure what “(objectClass=*)” does for me, but several examples had it and I kept it.

Know your Users

All of my users are maintained under group policies and they reside under the domain’s root node in “MyBusiness” and “Users” under that. Standard Windows accounts, especially system administrator accounts reside in a “Users” folder directly off the domain’s root node. This was one of the first points of contention that I had to understand when looking at the vast majority of other people’s solution. Simply put, know which “Users” you wish to work with in Apache.

Knowing I wanted to authenticate users under the MyBusiness node, my AuthLdapUrl becomes:

AuthLDAPURL ldap://ad.sample.local:389/OU=MyBusiness,DC=sample,DC=local?sAMAccountName?sub?(objectClass=*)

Bind a User so Apache can Query

You do have to bind to Active Directory so that Apache can actually query. To do this, I created a User under the standard “Users” folder (where administrator, and other such accounts traditionally reside). I don’t know if I applied correct rights or not, but the account is no more than a “Domain User” member. I called the user “AD_VIEWER” with description “Account to bind Apache to Active Directory for authentication.” This leads to the following Apache directives:

AuthLDAPBindDN "AD_VIEWER@sample.local"
AuthLDAPBindPassword bottom_secret_password

I tested the above getting the usual “require valid-user” directive working with Apache. Once I was sure I could do this much, it was time to turn my attention to restricting access to users that are members of a specific group.

Where’s my Group?

I struggled for quite a while with the groups before I finally got wise and set the debug level to get more details into the apache log files. The debug logging level can be set with:

LogLevel debug

And this leads to quite detailed information about what’s going on with Apache and Authentication. For example, before I got my ldap-group configuration correct, I was seeing this:

[debug] mod_authnz_ldap.c(721): [2934] auth_ldap authorise: require group: testing for uniquemember: CN=Code Connoisseur,OU=MyBusiness,OU=Users,DC=sample,DC=local (CN=Auditors,OU=MyBusiness,DC=sample,DC=local)
[debug] mod_authnz_ldap.c(737): [2934] auth_ldap authorise: require group "CN=Auditors,OU=MyBusiness,DC=sample,DC=local": authorisation failed [Comparison complete][No such object]
[debug] mod_authnz_ldap.c(852): [2934] auth_ldap authorise: authorisation denied

Note the “No such object” as this was telling me the group itself was not found. I tried many permutations without success until I found the CSVDE program and was able to dump the Active Directory to Excel for further inspection. I realized with the CSVDE output that I was doing both the
AuthLDAPURL (the above AuthLDAPURL is correct as I have spared you from my mistakes). The correct ldap-group config string for accessing a Security Group defined under MyBusiness is:

require ldap-group CN=Auditors,OU=Security Groups,OU=MyBusiness,DC=sample,DC=local

In short, you have to exactly declare the selector for your Active Directory Group or Apache will fail to find it. After getting the group setting right, I now see “attribute member” and “Comparison true” in the logs, which indicates that the group was found and that my user is a member of that group.

[debug] mod_authnz_ldap.c(377): [3134] auth_ldap authenticate: using URL ldap://10.0.1.5:389/OU=MyBusiness,DC=sample,DC=local?sAMAccountName?sub?(objectClass=*)
[debug] mod_authnz_ldap.c(474): [3134] auth_ldap authenticate: accepting mwlang
[debug] mod_authnz_ldap.c(715): [3134] auth_ldap authorise: require group: testing for group membership in "CN=Auditors,OU=Security Groups,OU=MyBusiness,DC=sample,DC=local"
[debug] mod_authnz_ldap.c(721): [3134] auth_ldap authorise: require group: testing for member: CN=Michael Lang,OU=Employees,OU=Users,OU=Users,OU=MyBusiness,DC=sample,DC=local (CN=Auditors,OU=Security Groups,OU=MyBusiness,DC=sample,DC=local)
[debug] mod_authnz_ldap.c(730): [3134] auth_ldap authorise: require group: authorisation successful (attribute member) [Comparison true (adding to cache)][Compare True]

The complete Apache Config

Bringing all of the items discussed above together, we arrive at this Apache configuration. I am using Virtual Hosts to uniquely identify the service. Also of note, I am using Ramaze to provide the functionality of the actual site, so please do take this into account if you’re copying and pasting. This config is a complete virtual host entry:

<VirtualHost *:80>
    ServerName audit.sample.local
    RackBaseURI /
    RackAutoDetect on
    DocumentRoot /var/www/balancer/public

    LogLevel debug
    <Location "/data_entry">
        AuthBasicProvider ldap
        AuthType Basic
        AuthName "Sample Realm"
        AuthLDAPURL ldap://10.0.1.5:389/OU=MyBusiness,DC=sample,DC=local?sAMAccountName?sub?(objectClass=*)
        AuthzLDAPAuthoritative on

        AuthLDAPBindDN "AD_VIEWER@sample.local"
        AuthLDAPBindPassword bottom_secret_password

        AuthLDAPGroupAttributeIsDN on
        require ldap-group CN=Auditors,OU=Security Groups,OU=MyBusiness,DC=sample,DC=local
    </Location>
</VirtualHost>

Bootstrap Passenger

Begin by Bootstrapping Ubuntu.

The next step is to run the script for installing Passenger. The standard passenger install against the standard Ruby 1.8.7 package managed libraries are installed with the following:

(assuming you’ve downloaded the bootstrap scripts and are in the ~/bootstrap-scripts/ubuntu/intrepid folder already, execute the following script:

./bootstrap-passenger-std.sh

Passenger’s install prompts you two or three times. Simply press and ignore the additional configuration instructions (the bootstrap script carries out these instructions for you).

Set up a demo Rails project

cd /var/www
sudo mkdir rails
cd rails
sudo rails demo
cd ..
chown -R www-data:www-data rails

Set up a Virtual Host Entry

Apache2 on Ubuntu makes it fairly straightforward to set up a provider for the Rails application, simply create the following in /etc/apache2/sites-available/demo:

<VirtualHost *:80>
  ServerName localhost
  DocumentRoot /var/www/rails/demo/public
</VirtualHost>

And then enable the site:

sudo a2ensite demo
sudo /etc/init.d/apache2 reload

End Result

If all goes well, you should then be able to browse to http://localhost and see the rails greet page. Your system will look something like this:

OS: 2.6.27-7-server x86_64 GNU/Linux
Apache: Server version: Apache/2.2.9 (Ubuntu)
Passenger: 2.0.6
Ruby: ruby 1.8.7 (2008-08-11 patchlevel 72) [x86_64-linux]
Rubygems: 1.3.1
gems:
 - actionmailer (2.2.2)
 - actionpack (2.2.2)
 - activerecord (2.2.2)
 - activeresource (2.2.2)
 - activesupport (2.2.2)
 - fastthread (1.0.1)
 - passenger (2.0.6)
 - plist (3.0.0)
 - rack (0.9.1)
 - rails (2.2.2)
 - rake (0.8.3)

Where to go from here?

After you have Passenger working, you may be interested in trying it with the so-called Enterprise version of Ruby which claims 33% memory footprint reduction overall for a typical Rails application. If so, you can flip over to the Enterprise version by running the following bootstrap script:

./bootstrap-passenger-ent.sh

This script will download and compile Enterprise Ruby and install Passenger against this version of Ruby, disabling the standard passenger modules in Apache (if they’re installed as per above) in the process. Does it make any real difference? We shall see! I am benchmarking performance of both standard and enterprise and will be reporting on my findings soon.