graphite-project/graphite-web — pull request #373 by cdegroot (2013-07-23 20:20:35+00:00)
Title: Optionally bind using credentials passed in by the user

This patch allows you to configure a bind user/pass that contains a "%s" to allow for binding with the username and password passed in. Some LDAP servers are tightly shut so you cannot bind anonymously, and binding with a fixed username/password is frowned upon by a lot of admins. So this patch allows a locked-down LDAP server to be accessed, using the credentials of whoever is trying to log in.

Example usage in local_settings.py:

LDAP_BASE_USER = "uid=%s,ou=People,ou=department,o=company"
LDAP_BASE_PASS = "%s"

(I don't see a direct use case for the %s expansion in LDAP_BASE_PASS, but it didn't hurt to put it in either).

The patch also executes a start_tls, which afaik is good practice and won't hurt.