Package: devpi-ldap
devpi-ldap: LDAP authentication for devpi-serverFor use with devpi-server >= 2.1.0.Installationdevpi-ldapneeds to be installed alongsidedevpi-server.You can install it with:pip install devpi-ldapFordevpi-serverthere is no configuration needed to activate the plugin, as it will automatically discover the plugin through calling hooks using the setuptools entry points mechanism. However, you need to pass a path with a YAML config file todevpi-server, via the--ldap-configcommand-line option.Details about LDAP configuration below.ConfigurationA script nameddevpi-ldapcan be used to test your LDAP configuration.To configure LDAP, create a yaml file with a dictionary containing another dictionary under thedevpi-ldapkey with the following options:urlThe url of the LDAP server.
Usingldaps://enables SSL.
No certificate validation is performed at the moment.tlsParameters to theldap3.Tls objectfor
Transport Layer Security, used with LDAPS connections.server_poolA list of LDAP pool servers. Eitherserver_poolorurlare mandatory, but they are mutually exclusive.
A list entry itself is a dictionary containing a mandatoryurlitem and optionally atlsitem.user_templateThe template to generate the distinguished name for the user.
If the structure is fixed, this is faster than specifying auser_search, butdevpi-servercan’t know whether a user exists or not.user_searchIf you can’t or don’t want to useuser_template, then these are the search settings for the users distinguished name.
You can useusernamein the search filter.
See specifics below.group_searchThe search settings for the group objects of the user.
You can useusernameanduserdn(the distinguished name) in the search filter.
See specifics below.referralsWhether to follow referrals.
This needs to be set tofalsein many cases when using LDAP via Active Directory on Windows.
The default istrue.reject_as_unknownReport all failed authentication attempts asunknowninstead ofreject. This is useful e.g. if using the provided credentials to bind
to ldap, in which case we cannot distinguish authentication failures from
unknown users.unknownis required to let other auth hooks attempt to
authenticate the user.timeoutThe timeout for connections to the LDAP server. Defaults to 10 seconds.Theuser_searchandgroup_searchsettings are dictionaries with the following options:baseThe base location from which to search.filterThe search filter.
To use replacements, put them in curly braces.
Example:(&(objectClass=group)(member={userdn}))scopeThe scope for the search.
Valid values arebase-object,single-levelandwhole-subtree.
The default iswhole-subtree.attribute_nameThe name of the attribute which contains the user DN which will be used to check the user’s
password.devpi-ldapwill extract this attribute from the search results and attempt to
bind to the LDAP server using this DN and the password supplied by the user. If this bind
succeeds, access is granted.userdnThe distinguished name of the user which should be used for the search operation.
Foruser_search, if you don’t have anonymous user search or forgroup_searchif the users can’t search their own groups, then you need to set this to a user which has the necessary rights.passwordThe password for the user inuserdn.The YAML file should then look similar to this:---devpi-ldap:url:ldap://example.comuser_template:CN={username},CN=Partition1,DC=Example,DC=COMgroup_search:base:CN=Partition1,DC=Example,DC=COMfilter:(&(objectClass=group)(member={userdn}))attribute_name:CNAn example with user search and Active Directory might look like this:---devpi-ldap:url:ldap://example.comuser_search:base:CN=Partition1,DC=Example,DC=COMfilter:(&(objectClass=user)(sAMAccountName={username}))attribute_name:distinguishedNamegroup_search:base:CN=Partition1,DC=Example,DC=COMfilter:(&(objectClass=group)(member={userdn}))attribute_name:CNWith a server pool it might look like this:---devpi-ldap:server_pool:-url:ldap://server1.example.com:389-url:ldap://server2.example.com:3268-url:ldaps://server3.example.com:636tls:validate:2# ssl.CERT_REQUIREDca_certs_file:/etc/ssl/certs/ca-certificates.crt-url:ldaps://server4.example.com:3269tls:validate:2# ssl.CERT_REQUIREDca_certs_file:/etc/ssl/certs/ca-certificates.crtuser_search:base:CN=Partition1,DC=Example,DC=COMfilter:(&(objectClass=user)(sAMAccountName={username}))attribute_name:distinguishedNamegroup_search:base:CN=Partition1,DC=Example,DC=COMfilter:(&(objectClass=group)(member={userdn}))attribute_name:CNChangelog2.1.1 - 2023-08-07Useescape_filter_charsbefore calling LDAPsearchmethod.
[mr-scrawley (Micha Schmierer), fschulze]2.1.0 - 2021-12-04Fix issue #50: new server_pool setting.2.0.0 - 2021-05-16Addtimeoutoption for LDAP connections. Defaults to 10 seconds.Usesafe_loadto read YAML config.Thereject_as_unknownoption is now true by default.Drop support for Python < 3.6, support for Python 3.x will end with their
respective EOLs.Fix deprecation warning with devpi-server 6.0.0.Fix pluggy deprecation warning.Require at least devpi-server 5.0.0.1.2.2 - 2018-05-28More ldap3 2.x fixes.
[fschulze]1.2.1 - 2018-05-25Fix compatibility with ldap3 2.x.
[fschulze, abrasive (James Laird-Wah)]Stopped testing with Python 2.6, but no changes made which break compatibility.1.2.0 - 2016-03-25Add support for TLS parameters in the config.
[jaraco (Jason R. Coombs)]Allow invocation viapython-mdevpi-ldapand fix cli for Python 3.
[jaraco]Add exit codes to testing script when authentication fails.
[jaraco]1.1.1 - 2016-01-28set minimum version of ldap3 library, which adds hiding of password in debug
logging.
[cannatag (Giovanni Cannata), rodcloutier (Rodrigue Cloutier), fschulze]change dependency for the ldap library, which was renamed.
[kumy]fix issue #5: dn and distinguishedName may appear as a top level response
attribute instead of the attributes list.
[kainz (Bryon Roché)]fix issue #24: Ignore additional search result data.
[bonzani (Patrizio Bonzani), fschulze]1.1.0 - 2014-11-10addreject_as_unknownoption
[davidszotten (David Szotten)]1.0.1 - 2014-10-10fix the plugin hook
[fschulze]1.0.0 - 2014-09-22initial release
[fschulze (Florian Schulze)]