Package: udata-ldap
udata-ldapLDAP authentification for udata with optionnal Kerberos suppport.RequirementsTo use LDAP only authentication, you only need theudata-ldapextension.To useSASLandSPNEGO, you need a functional kerberos client environment.On debian, you can install the requirements using:apt-getinstallkrb5-configkrb5-userlibkrb5-devYou need to configure your domain in/etc/krb5.conf.
Here's a sample configuration forDOMAIN.ORG:[libdefaults]default_realm=DOMAIN.ORG[realms]DATA.XPS={#admin_server = ipa.data.xps# use "kdc = ..." if realm admins haven't put SRV records into DNSkdc=kdc.domain.orgadmin_server=kdc.domain.org:749default_domain=domain.orgdns_lookup_realm=falsedns_lookup_kdc=falserdns=false}[domain_realm]domain.org=DOMAIN.ORG.domain.org=DOMAIN.ORGUsageInstall the plugin package in you udata environement:pipinstalludata-ldapThen activate it in yourudata.cfg:PLUGINS=['ldap']NB: if using Kerberos SASL and/or SPNEGO, install it with:pipinstalludata-ldap[kerberos]Configurationudata-ldapmakes use offlask-ldap3-loginand so use the same parameters as describedhere.Some extra parameters are available:ParameterDefault valueNotesLDAP_DEBUGFalseEnable verbose/debug loggingLDAP_KERBEROS_KEYTABNonePath to an optionnal Kerberos keytab for this serviceLDAP_KERBEROS_SERVICE_NAME'HTTP'The service principal as configured in the keytabLDAP_KERBEROS_SERVICE_HOSTNAMEsocket.getfqdn()The service hostname (ie.data.domain.com)LDAP_KERBEROS_SPNEGOFalseWhether or not to enable passwordless authentication with SPNEGOLDAP_KERBEROS_SPNEGO_NO_REALMTrueAutomaticaly remove @REALM from SPNEGO/REMOTE_USER identifierLDAP_REMOTE_USER_ATTR'uid'The ldap attribute extracted from SPNEGO handshake to match the userLDAP_USER_FIRST_NAME_ATTR'givenName'The ldap attribute to extract the first name fromLDAP_USER_LAST_NAME_ATTR'sn'The ldap attribute to extract the last name fromTesting configurationudata-ldapprovides two commands to help with the configuration:udata ldap configwill display the LDAP configuration seen byudataudata ldap checkwill allow to quickly test your LDAP configuration.udata ldap krbcheckwill allow to quickly test your Kerberos configuration.Testing localy with dockerAn exampledocker-compose.ymlis provided to test localy wiht a freeipa server.To use it, you need to copy the fileipa-server-install-options.exampletoipa-server-install-optionsand edit it with your own parameters.ex:--unattended
--realm=DOMAIN.ORG
--domain=DOMAIN.ORG
--ds-password=password
--admin-password=passwordChangelog0.3.5 (2018-11-23)Fix packaging0.3.4 (2018-11-23)Fix negociate and REMOTE_USER email extractionFix some command line encoding errors0.3.3 (2018-11-09)Internal: extracted all Kerberos handling into its own moduleKerberos: handle REALM removal from SPNEGO/REMOTE_USER identifier0.3.2 (2018-10-16)Fix some console encoding errorFix LDAP values extractionMake all LDAP attributes mapping to user profile configurable0.3.1 (2018-10-11)RenamedLDAP_USER_SPNEGO_ATTRintoLDAP_REMOTE_USER_ATTRfor consistencyFix login form using SPNEGO attribute for login0.3.0 (2018-10-09)Display errors on login formForce email into the login formFix encoding errors in ldap commandsUpdate user on loginStart handling errors on negociate viewDisplay a page when trying automatic login wihtout credentialsAdds translations0.2.1 (2018-10-08)Fix the "automatic login" linkMore logging0.2.0More testsHide debug log unlessLDAP_DEBUG = TrueRemove buggy defaultLDAP_*settings0.1.0Initial release