mkucej/i-librarian — pull request #3 by robodendron (2014-11-24 16:06:01+00:00)
Title: LDAP Improvements

This PR refactors the LDAP authentication mechanism. The new implementation was tested with both the test LDAP server at ldap.testathon.net and our local Active Directory LDAP server at MLU Halle-Wittenberg.

The new implementation provides the following benefits:

- It uses a proxy user to do username and DN lookups. The previous implementation did not allow for users in nested OUs to log in. (Anonymous LDAP binds should work as well, just leave `ldap_binduser_rdn` and `ldap_binduser_pw` as empty strings for now.)
- It (optionally) allows to restrict logins to members of an LDAP group. If recursive membership checking is needed, this can be done with a custom `ldap_filter` setting, an example of which is provided in `ilibrarian.ini`.

There is also one disadvantage I can see:
- For now, the bind user DN and password are stored as plaintext in `ilibrarian.ini`. Therefore, the example webserver configuration in `README.txt` has been updated to deny access to this file by default. **If this PR is merged in, the documentation on the homepage should also be updated accordingly.**

Things I would like to address in the future:
- Commenting out `ldap_binduser_rdn` and/or `ldap_binduser_pw` should perform the correct form of anonymous bind to LDAP implementations that support it.
- Address I, Librarian's behavior where the first user to populate the database is always given admin permissions, even if she is not a member of the I, Librarian LDAP admin group.

If there are any things I should change or improve, just say so. Cheers! :)