grahamgilbert/sal — pull request #7 by sruon (2014-02-26 20:43:22+00:00)
Title: LDAP Authentication

Hello,

In our environnement we authenticate through LDAP (OpenLDAP or Active Directory). We do not have the need at the time for multi-tenant management as we're located on a single site with a lot of clients.

This merge request simply provides the bare minimum to get LDAP authentication working that is
* django-auth-ldap requirements (which itself requires multiple packages on your system for LDAP libraries)
* Example of configuration for LDAP in example_settings.py
* And a slight modification to the index view to create profile for LDAP users.

If you want to make every users within the LDAP scope you defined a global administrator ("GA"), simply map is_staff, is_superuser to your group like so

```
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
"is_superuser": "cn=myadmingroup,ou=groups,dc=my,dc=company,dc=tld",
"is_staff": "cn=myadmingroup,ou=groups,dc=my,dc=company,dc=tld"
}

```

Then apply this patch to server/views.py
```
diff --git a/server/views.py b/server/views.py
index b91c26c..9747794 100644
--- a/server/views.py
+++ b/server/views.py
@@ -29,15 +29,12 @@ def index(request):
# Get the current user's Business Units
user = request.user
# Count the number of users. If there is only one, they need to be made a GA
- if User.objects.count() == 1:
- # The first user created by syncdb won't have a profile. If there isn't one, make sure they get one.
- try:
- profile = UserProfile.objects.get(user=user)
- except UserProfile.DoesNotExist:
- profile = UserProfile(user=user)
-
- profile.level = 'GA'
- profile.save()
+ try:
+ profile = UserProfile.objects.get(user=user)
+ except UserProfile.DoesNotExist:
+ profile = UserProfile(user=user)
+ profile.level = 'GA'
+ profile.save()
```

I haven't included this change in the pull request as I believe it requires more thought to be integrated in the project as a feature since the project is based around the principle of BU.

Alternatively we could set flags on the profile through django-auth-ldap, for exemple

```
AUTH_LDAP_PROFILE_FLAGS_BY_GROUP = {
"is_ga": ["cn=generaladmins,ou=groups,dc=example,dc=com"]
}
```

Thoughts?