Package: who_ldap
who_ldapLDAP Authentication for repoze.who-v2-enabled WSGI ApplicationsThis project is a fork of the original repoze.who.plugins.ldap to support
who api v2 as well as Python 3 (and 2.7)who_ldapan LDAP plugin for the identification and
authentication framework for WSGI applications,repoze.who, which acts as WSGI
middleware.Installingpip install who_ldapInstalling the mainline development branchThe plugin is hosted ina git branch hosted at github.com. To get the latest source
code, run:git clone git@github.com:m-martinez/who_ldap.gitThen run the command below:pip install -e who_ldap/Setting uprepoze.whowith the LDAP authenticatorThis section explains how to setuprepoze.whoin order to use the LDAP plugins
in your WSGI application. It is based onthe documentation for repoze.who.You can configure your authentication mechanism powered byrepoze.whowith
two methods: With an INI file or with Python code.In the examples below we are only going to use the main plugin provided by this
package: The LDAP authenticator itself (LDAPAuthenticatorPlugin). The
other plugins don’t deal with authentication, but are useful to load automatically
data related to the authenticated user from the LDAP server.Using therepoze.whoterminology,LDAPAuthenticatorPluginis anauthenticator pluginand the others aremetadata provider plugins.Configuringrepoze.whoin a INI fileYou can configure yourrepoze.whobased authentication via a*.inifile,
and then load such settings in your application.Say we have a file calledwho.iniwith the following contents:# These contents have been adapted from:
# http://static.repoze.org/whodocs/#middleware-configuration-via-config-file
[plugin:form]
use = repoze.who.plugins.form:make_plugin
rememberer_name = auth_tkt

[plugin:auth_tkt]
use = repoze.who.plugins.auth_tkt:make_plugin
secret = something

[plugin:ldap_auth]
use = who_ldap:LDAPAuthenticatorPlugin
url = ldap://ldap.yourcompany.com
base_dn = ou=developers,dc=yourcompany,dc=com

[general]
request_classifier = repoze.who.classifiers:default_request_classifier
challenge_decider = repoze.who.classifiers:default_challenge_decider

[identifiers]
plugins =
    form;browser
    auth_tkt

[authenticators]
plugins =
        ldap_auth

[challengers]
plugins =
    form;browserWith the settings above, authentication viarepoze.whois configured this way:
Visitors will login with a form, providing their user name and password; then
these credentials will be checked against the LDAP serverldap.yourcompany.comunderou=developers,dc=yourcompany,dc=com. This form will be displayed
when your WSGI application issues an HTTP401error.For example, if an user entersjsmithas the user name andvalenciaas their
password, the LDAP authenticator will build their Distinguished Name (DN) asuid=jsmith,ou=developers,dc=yourcompany,dc=comand will try to
authenticate them in theldap.yourcompany.comLDAP server with this DN andvalenciaas the password.Finally, you can load these settings by adding therepoze.whomiddleware to your
application:from repoze.who.config import make_middleware_with_config
app_with_auth = make_middleware_with_config(app, global_confg, '/path/to/who.ini')In the documentation forrepoze.whothere isa more detailed explanationfor the INI file method.Framework-specific documentationYou may want to check the following framework-specific documents to learn tips
on how to implementrepoze.whoin the framework you are using:Pyramid:pyramid_who.Pylons:Authentication and Authorization with repoze.who.TurboGears 2:Authentication and Authorization in TurboGears 2(repoze.whois the default authentication library).Using the LDAP plugins for repoze.whoLDAPAuthenticatorPluginThis plugin connects to the specified LDAP server and tries tobindwith theDistinguished Name(DN) made by joining theloginin theidentitydictionary as the naming attribute value and thebase_dnspecified in the
constructor, and then it tries to bind with thepasswordfound in theidentitydictionary; As a default, the used naming attribute is the
user id (uid).For example, if theloginprovided by the identifier iscarlaand thebase_dnprovided in the constructor isou=employees,dc=example,dc=org,
the resulting DN will beuid=carla,ou=employees,dc=example,dc=org.If the directory server’s naming attribute were theemailattribute,
and we provided naming_attribute=’email’ in the constructor, the DN
resulting for the identifiercarla@example.orgwould beemail=carla@example.org,ou=employees,dc=example,dc=org.To configure this plugin from an INI file, you’d have to include a section
like this:[plugin:ldap_auth]
use = who_ldap:LDAPAuthenticatorPlugin
url = ldap://yourcompany.com
base_dn = ou=employees,dc=yourcompany,dc=com
naming_attribute = uid
start_tls = TrueSettingDefaultDescriptionurlRequiredConnection URLbase_dnLocation to begin queriesreturned_iddnAttribute to return on authentication (‘dn’ or ‘login’)start_tlsFalseIf set, initiates TLS on the connectionnaming_attributeuidNaming attribute for directory entriesLDAPSearchAuthenticatorPluginThis plugin connects to the specified LDAP server and searches an entry
residing below thebase_dn, whose naming attribute’s value is equal
to the supplied login. If such an entry is found, it tries to bind as the
entry’s DN with thepasswordfound in theidentitydictionary; As a
default, the used naming attribute is the user id (uid).Thesearch_scopeparameter in the constructor allows to choose whether
to search the entry in the whole subtree belowbase_dn, or just on
the level below if set assearch_scope='onelevel'.For example, if theloginprovided by the identifier iscarlaand thebase_dnprovided in the constructor isdc=example,dc=org,
with the default settings, the system could find the entryuid=carla,ou=employees,dc=example,dc=org; if we setsearch_scope='onelevel', the entry would not be found.If you would like to only allow some entries, you may setup a filter
by means of thefilterstrparameter, which is an string whose format is
defined byRFC 4515 - Lightweight Directory Access Protocol (LDAP): String
Representation of Search Filters.
E.g. we can assert only person entries bearing a telephone number starting
with999111can login by setting:filterstr='(&(objectClass=person)(telephoneNumber=999111*))'in the constructor.To configure this plugin from an INI file, you’d have to include a section
like this:[plugin:ldap_auth]
use = who_ldap:LDAPSearchAuthenticatorPlugin
url = ldap://yourcompany.com
base_dn = ou=employees,dc=yourcompany,dc=com
naming_attribute = uid
search_scope = subtree
start_tls = TrueFinally, add the plugin to the set of authenticators:[authenticators]
plugins =
        ldap_authSettingDefaultDescriptionurlRequiredConnection URLbind_dnOperating userbind_passOperating user passwordbase_dnLocation to begin queriesreturned_iddnAttribute to return on authentication (‘dn’ or ‘login’)start_tlsFalseIf set, initiates TLS on the connectionnaming_attributeuidNaming attribute for directory entriessearch_scopesubtreeScope of LDAP search (‘subtree’ or ‘onelevel’)restrictOptional additional filter for searchLDAPAttributesPluginThis plugin enables you to load data for the authenticated user
automatically and have it available from the WSGI environment — in theidentitydictionary, specifically.attributesrepresents
the list of user’s attributes that you would like to fetch from the LDAP
server; it can be an iterable, an string where the attributes are separated
by commas, orNoneto fetch all the available attributes.By default it loads the attributes available foranyentry whoseDNis
the same as the one found byLDAPAuthenticatorPlugin, which is
desired in most situations.
However, if you would like to exclude some entries, you may setup a filter
by means of thefilterstrparameter, which shares the same semantics
as thefilterstrparameter inLDAPSearchAuthenticatorPlugin.To configure this plugin from an INI file, you’d have to include a section
like this:[plugin:ldap_attributes]
use = who_ldap:LDAPAttributesPlugin
url = ldap://ldap.yourcompany.com
attributes = cn,sn,mailIf instead of loading theCommon Name,surnameandemail, as with the
settings above, you’d prefer to load all the available attributes for the
authenticated user, you’d just have to remove theattributesdirective.Finally, add the plugin to the set of metadata providers:[mdproviders]
plugins =
        ldap_attributesSettingDefaultDescriptionurlRequiredConnection URLbind_dnOperating userbind_passOperating user passwordbase_dnLocation to begin queriesstart_tlsFalseIf set, initiates TLS on the connectionattributesLDAP attributes to use.
Can be a simple comma-delimited list (e.g. uid,cn),
or a mapping list (e.g. cn=fullname,mail=email).filterstr(objectClass=*)A filter for the searchflattenFalseCleans up LDAP values if they are not listsLDAPGroupsPluginThis plugin enables you to load all the group memberships of the authenticated
user.SettingDefaultDescriptionurlRequiredConnection URLbind_dnOperating userbind_passOperating user passwordbase_dnLocation to begin queriesstart_tlsFalseIf set, initiates TLS on the connectionfilterstrA filter for the search (Default behaviour:
(&(objectClass=groupOfUniqueNames)(uniqueMember=%(dn)s)))nameThe property name in the identity to usesearch_scopesubtreeScope of LDAP search (‘subtree’ or ‘onelevel’)returned_idcnWhich attribute value of the group entry to returnChangelog3.2.2 (2017-02-15)Properly escape search filter string (http://ldap3.readthedocs.io/searches.html#the-search-operation)3.2.1 (2016-06-22)Alter release workflow3.2.0 (2016-06-22)Use version 2.3 ofrepoze.whowhich implements improved userdata heuristics3.1.0 (2015-02-09)Search for users via filter if present [domruf]Switch toldap3package (which was renamed frompython3-ldap) [Cito]Convert b64de/encode byte strings to regular strings in Python 3 [Cito]Use (objectClass=*) if no filter is specified when scope is base.3.0.2 (2014-06-11)Issue log messages instead of exceptions for invalid credentials. [lovelle]3.0.1 (2014-05-19)Updated documentation3.0.0 (2014-05-19)Major code cleanupDeprecatedLDAPBaseAuthenticatorPluginNo longer accepts ldap_connection since in order to ensure connections are
closed.Allows to aliasing of LDAP propertiesSwitched groupnaming_attributetoreturned_id2.0.0 (2014-04-29)Forked original project
(https://pypi.python.org/pypi/repoze.who.plugins.ldap)Updated to work with repoze.who v2 APIPython 3.4 compatibilityAllows to aliasing of LDAP propertiesAdded group metadata provider1.2 Alpha 2 (unreleased)Fixed installation problems under Windows (Bug #608622).1.1 Alpha 1 (2010-01-03)Changed the license to theRepoze license.Providedstart_tlsoption both for the authenticator and the metadata
provider.Enable both pattern-replacement and subtree searches for the naming
attribute in_get_dn().Enable configuration of the naming attributeEnable the option to bind to the server with privileged credential before
doing searchesAdd a restrict pattern to pre-authentication DN searchesLet the user choose whether to return the full DN or the supplied login as
the user identifier1.0 (2008-09-11)The initial release.Provided the LDAP authenticator, which is compatible with identifiers that
define the ‘login’ item in the identity dict.Included the plugin to load metadata about the authenticated user from the
LDAP server.Documented how to install and use the plugins.Included Turbogears 3 demo project, using the plugin. There is also a section
in the documentation to explain how the demo works.