Package: sentry-auth-ldap
sentry-auth-ldapA Django custom authentication backend forSentry. This module extends the functionality ofdjango-auth-ldapwith Sentry specific features.FeaturesUsers created by this backend are managed users. Managed fields are not editable through the Sentry account page.Users may be auto-added to an Organization upon creation.PrerequisitesSentry < 21.9.0 should work withsentry-ldap-auth==2.9.0(which is another project for legacy support)Sentry >= 21.9.0 and Sentry < 23.6.0 should work with sentry-auth-ldap==21.9.11Sentry >= 23.6.0 should work with sentry-auth-ldap==23.6.0InstallationTo install, simply addsentry-auth-ldapto yourrequirements.txtfor your Sentry environment (orpip install sentry-auth-ldap).For container environment, because of the minimal base image, it may miss some dependencies.You can easily enhance the image bysentry/enhance-image.shscript (needgetsentry/self-hosted22.6.0 or higher):#!/bin/bashrequirements=('sentry-auth-ldap>=21.9.0'# You can add other packages here, just like requirements.txt)# Install the dependencies of ldapapt-getupdate
apt-getinstall-y--no-install-recommendsbuild-essentiallibldap2-devlibsasl2-dev

pipinstall${requirements[@]}# Clean up to shrink the image sizeapt-getpurge-y--auto-removebuild-essential
rm-rf/var/lib/apt/lists/*# Support ldap over tls (ldaps://) protocolmkdir-p/etc/ldap&&echo"TLS_CACERT /etc/ssl/certs/ca-certificates.crt">/etc/ldap/ldap.confConfigurationThis module extends thedjango-auth-ldapand all the options it provides are supported (up to v1.2.x, at least).To configure Sentry to use this module, addsentry_auth_ldap.backend.SentryLdapBackendto yourAUTHENTICATION_BACKENDSin yoursentry.conf.py, like this:AUTHENTICATION_BACKENDS=AUTHENTICATION_BACKENDS+('sentry_auth_ldap.backend.SentryLdapBackend',)Then, add any applicable configuration options. Depending on your environment, and especially if you are running Sentry in containers, you might consider usingpython-decoupleso you can set these options via environment variables.sentry-auth-ldap Specific OptionsAUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION=u'My Organization Name'Auto adds created user to the specified organization (matched by name) if it exists.AUTH_LDAP_SENTRY_ORGANIZATION_ROLE_TYPE='member'Role type auto-added users are assigned. Valid values in a default installation of Sentry are 'member', 'admin', 'manager' & 'owner'. However, custom roles can also be added to Sentry, in which case these are also valid.AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS=TrueWhether auto-created users should be granted global access within the default organization.AUTH_LDAP_SENTRY_SUBSCRIBE_BY_DEFAULT=FalseWhether new users should be subscribed to any new projects by default. Disabling
this is useful for large organizations where a subscription to each project
might be spammy.AUTH_LDAP_DEFAULT_EMAIL_DOMAIN='example.com'Default domain to append to username as the Sentry user's e-mail address when the LDAP user has nomailattribute.WARNING: There is an obsoleted setting namedAUTH_LDAP_SENTRY_USERNAME_FIELD.It could be replaced byAUTH_LDAP_USER_QUERY_FIELDandAUTH_LDAP_USER_ATTR_MAPwhich django-auth-ldap built-in.Sentry OptionsSENTRY_MANAGED_USER_FIELDS=('email','first_name','last_name','password',)Fields which managed users may not modify through the Sentry accounts view. Applies to all managed accounts.Example Configurationimportldapfromdjango_auth_ldap.configimportLDAPSearch,GroupOfUniqueNamesTypeAUTH_LDAP_SERVER_URI='ldap://my.ldapserver.com'AUTH_LDAP_BIND_DN=''AUTH_LDAP_BIND_PASSWORD=''AUTH_LDAP_USER_QUERY_FIELD='username'AUTH_LDAP_USER_SEARCH=LDAPSearch('dc=domain,dc=com',ldap.SCOPE_SUBTREE,'(mail=%(user)s)',)AUTH_LDAP_USER_ATTR_MAP={'username':'uid','name':'cn','email':'mail'}AUTH_LDAP_MAIL_VERIFIED=TrueAUTH_LDAP_GROUP_SEARCH=LDAPSearch('',ldap.SCOPE_SUBTREE,'(objectClass=groupOfUniqueNames)')AUTH_LDAP_GROUP_TYPE=GroupOfUniqueNamesType()AUTH_LDAP_REQUIRE_GROUP=NoneAUTH_LDAP_DENY_GROUP=NoneAUTH_LDAP_FIND_GROUP_PERMS=FalseAUTH_LDAP_CACHE_GROUPS=TrueAUTH_LDAP_GROUP_CACHE_TIMEOUT=3600AUTH_LDAP_SENTRY_DEFAULT_ORGANIZATION='organization-slug'AUTH_LDAP_SENTRY_ORGANIZATION_ROLE_TYPE='member'AUTH_LDAP_SENTRY_GROUP_ROLE_MAPPING={'owner':['sysadmins'],'admin':['devleads'],'member':['developers','seniordevelopers']}AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS=TrueAUTHENTICATION_BACKENDS=AUTHENTICATION_BACKENDS+('sentry_auth_ldap.backend.SentryLdapBackend',)# Optional logging for diagnostics.LOGGING['disable_existing_loggers']=Falseimportlogginglogger=logging.getLogger('django_auth_ldap')logger.setLevel(logging.DEBUG)TroubleshootingWork with LDAPS protocol (SSL/TLS)Put the below content into /etc/ldap/ldap.conf, otherwise the certificate won't be trusted.TLS_CACERT /etc/ssl/certs/ca-certificates.crtIf your certificate was issued by a private CA, you should change the path.Don't use OCSP-Must-Staple certificate (SSL/TLS)Please don't useOCSP-Must-Staplecertificate with LDAPS.Some ldap servers (eg. OpenLDAP) don't support stapling OCSP response. So it will cause the handshake failed.