Package: leihs-ldap-authenticator
Leihs LDAP AuthenticatorLDAP based authentication handler forLeihs.FeaturesProvidesLDAP authenticationforLeihs6.x.When users want to log in, Leihs will redirect them to this authentication handler where they can authenticate themselves using an LDAP backendAutomaticallycreate new usersin Leihs when they first log in.When logging in, users must be registered with Leihs.
The LDAP authenticator takes care of this automatically when the user first logs in.Register or log-invia email address or username.Users can log in via username or email address.
For technical details about how LDAP users are mapped, seeLDAP Username Mappingbelow.Automaticgroup assignmentbased on LDAP attributes.When creating the users, they can be assigned to groups in Leihs based on their LDAP attributes. Groups will be automatically created if they do not yet exist.Providesautomatic configurationof the Leihs authentication system.The authenticator will automatically register itself in Leihs.Getting StartedInstall the tool via pip:❯ pip install leihs-ldap-authenticatorDownload and edit theexample configuration.
The configuration keys are documented in the file:❯ wget https://github.com/elan-ev/leihs-ldap-authenticator/blob/main/leihs-ldap.ymlRun the tool:❯ python -m leihsldap -c /path/to/leihs-ldap.ymlThe tool should automatically register itself in Leihs.Development VersionIf you want to work with the development version instead,
you can just clone this repository, install the requirements
and run the project from the root repository path:❯ pip install -r requirements.txt
❯ python -m leihsldap
 * Serving Flask app 'leihsldap.web'
 * Debug mode: off
 * Running on http://127.0.0.1:5000Production DeploymentWhile you can just start and test the authenticator with the built-in web server,
using this isnotsafe for production.
For a production deployment, use a WSGI server likeGunicorn.
A basic example of running this application with Gunicorn is:❯ gunicorn --config=/path/to/gunicorn.conf.py leihsldap.web:appFor a systemd unit to turn leisldap into a service and for an example Gunicorn configuration file, take a look at theinitfolder:Examplesystemd unitExampleGunicorn configurationTechnical NotesLDAP Username MappingIf a user does not yet exist in Leihs, the system will always transfer the user input as an email address to the authenticator, regardless of it actually being a valid email address.To circumvent this, the authenticator will treat the input up to the first@character as username and use this for the LDAP login.Once registered, Leihs will also transfer the login field which is used from there on for authentication.Update of Data in LeihsAs a general rule, the authenticator will only ever create,
but never update data in Leihs.
If you want updated data in Leihs,
either update this manually,
or remove the resource to have it recreated with new data.This applies to:Authentication systemGroupsUsersThis also means that you can update data if you need to.
For example, you can add users to additional groups without the authentication system interfering (potentially removing them again).SupportThis project is free software. It was initially developed byELAN e.V.forOsnabrück University. We hope that this is helpful, and you can use this as well.If you need commercial support installing this tool or want to commission further development you aren't able to do yourself, pleasecontact the ELAN e.V.DevelopmentTo cut a new release:Update the version insetup.py, commit changes, create pull request and mergeUpdate themainbranch locally and create a release tag:git tag -s v0.4Push the tag upstream:git push upstream v0.4:v0.4Create anew release on GitHub.Build Python package and upload it topypi.org:python setup.py sdist; twine upload dist/leihs-ldap-authenticator-0.2.tar.gz