def authenticate(email, password, client_ip)
      return nil unless email && BarkestCore::EmailTester.valid_email?(email, false)

      email = email.downcase

      sources.each do |source|
        if source == :ldap
          entry = @ldap.search(filter: "(&(objectClass=user)(mail=#{email}))")
          if entry && entry.count == 1  # we found a match.
            user = User.find_by(email: email, ldap: true)

            # make sure it authenticates correctly.
            entry = @ldap.bind_as(filter: "(&(objectClass=user)(mail=#{email}))", password: password)

            # do not allow authenticating against the DB now.
            unless entry && entry.count == 1
              add_failure_to user || email, '(LDAP) failed to authenticate', client_ip
              return nil
            end

            # load the user and return.
            user = load_ldap_user(entry.first, true, client_ip)
            unless user.enabled?
              add_failure_to user, '(LDAP) account disabled', client_ip
              return nil
            end
            add_success_to user, '(LDAP)', client_ip
            return user
          end
        else
          user = User.find_by(email: email)
          if user
            # user must be enabled, cannot be LDAP, and the password must match.
            if user.ldap?
              add_failure_to user, '(DB) cannot authenticate LDAP user', client_ip
              return nil
            end
            unless user.enabled?
              add_failure_to user, '(DB) account disabled', client_ip
              return nil
            end
            if user.authenticate(password)
              add_success_to user, '(DB)', client_ip
              return user
            else
              add_failure_to user, '(DB) invalid password', client_ip
              return nil
            end
          end
        end
      end
      add_failure_to email, 'invalid email', client_ip
      nil
    end
def authenticate(email, password, client_ip)
      return nil unless email && BarkestCore::EmailTester.valid_email?(email, false)

      email = email.downcase

      sources.each do |source|
        if source == :ldap
          entry = @ldap.search(filter: "(&(objectClass=user)(mail=#{email}))")
          if entry && entry.count == 1  # we found a match.
            user = User.find_by(email: email, ldap: true)

            # make sure it authenticates correctly.
            entry = @ldap.bind_as(filter: "(&(objectClass=user)(mail=#{email}))", password: password)

            # do not allow authenticating against the DB now.
            unless entry && entry.count == 1
              add_failure_to user || email, '(LDAP) failed to authenticate', client_ip
              return nil
            end

            # load the user and return.
            user = load_ldap_user(entry.first, true, client_ip)
            unless user.enabled?
              add_failure_to user, '(LDAP) account disabled', client_ip
              return nil
            end
            add_success_to user, '(LDAP)', client_ip
            return user
          end
        else
          user = User.find_by(email: email)
          if user
            # user must be enabled, cannot be LDAP, and the password must match.
            if user.ldap?
              add_failure_to user, '(DB) cannot authenticate LDAP user', client_ip
              return nil
            end
            unless user.enabled?
              add_failure_to user, '(DB) account disabled', client_ip
              return nil
            end
            if user.authenticate(password)
              add_success_to user, '(DB)', client_ip
              return user
            else
              add_failure_to user, '(DB) invalid password', client_ip
              return nil
            end
          end
        end
      end
      add_failure_to email, 'invalid email', client_ip
      nil
    end
Attempts to authenticate the user and returns the model on success.