LDAP authentification for udata with optional Kerberos suppport.
Project description
udata-ldap
LDAP authentification for udata with optionnal Kerberos suppport.
Requirements
To use LDAP only authentication, you only need the udata-ldap extension.
To use SASL and SPNEGO, you need a functional kerberos client environment.
On debian, you can install the requirements using:
apt-get install krb5-config krb5-user libkrb5-dev
Usage
Install the plugin package in you udata environement:
pip install udata-ldap
Then activate it in your udata.cfg:
PLUGINS = ['ldap']
NB: if using Kerberos SASL and/or SPNEGO, install it with:
pip install udata-ldap[kerberos]
Configuration
udata-ldap makes use of flask-ldap3-login and so use the same parameters as described here.
Some extra parameters are available:
| Parameter | Default value | Notes |
|---|---|---|
LDAP_DEBUG |
False |
Enable verbose/debug logging |
LDAP_KERBEROS_KEYTAB |
None |
Path to an optionnal Kerberos keytab for this service |
LDAP_KERBEROS_SERVICE_NAME |
'HTTP' |
The service principal as configured in the keytab |
LDAP_KERBEROS_SERVICE_HOSTNAME |
socket.getfqdn() |
The service hostname (ie. data.domain.com) |
LDAP_KERBEROS_SPNEGO |
False |
Whether or not to enable passwordless authentication with SPNEGO |
LDAP_USER_SPNEGO_ATTR |
'uid' |
The ldap attribute extracted from SPNEGO handshake to match the user |
Testing configuration
udata-ldap provides two commands to help with the configuration:
udata ldap configwill display the LDAP configuration seen byudataudata ldap checkwill allow to quickly test your configuration.
Testing localy with docker
An example docker-compose.yml is provided to test localy wiht a freeipa server.
To use it, you need to copy the file ipa-server-install-options.example to ipa-server-install-options and edit it with your own parameters.
ex:
--unattended
--realm=DATA.XPS
--domain=data.xps
--ds-password=password
--admin-password=password
Changelog
0.3.0 (2018-10-09)
- Display errors on login form
- Force email into the login form
- Fix encoding errors in ldap commands
- Update user on login
- Start handling errors on negociate view
- Display a page when trying automatic login wihtout credentials
- Adds translations
0.2.1 (2018-10-08)
- Fix the "automatic login" link
- More logging
0.2.0
- More tests
- Hide debug log unless
LDAP_DEBUG = True - Remove buggy default
LDAP_*settings
0.1.0
Initial release
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distributions
Built Distribution
File details
Details for the file udata_ldap-0.3.0-py2.py3-none-any.whl.
File metadata
- Download URL: udata_ldap-0.3.0-py2.py3-none-any.whl
- Upload date:
- Size: 12.1 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/1.12.1 pkginfo/1.4.2 requests/2.19.1 setuptools/38.4.0 requests-toolbelt/0.8.0 tqdm/4.26.0 CPython/2.7.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 02d5b7c985ecf7e63d3eb4101fec4a0ff7ad3433c3f2bd70c35347b169540a3c |
|
| MD5 | 7a2131a6483121e7b3e63891bfe9ce29 |
|
| BLAKE2b-256 | 81bfaa960088b0fb3392ab70ea9aee7ffed74a1ce03a1d0d8aee3c0177e9607c |
