mirror of
https://github.com/Kozea/Radicale.git
synced 2025-04-03 05:07:40 +03:00
LDAP auth: remove config option 'ldap_load_groups'
The same effect can be achieved using the option 'ldap_groups_attribute' alone, if it's default becomes unset instead of 'memberOf' Benefit: one config option less to deal with. While at it, also fix header level for 'ldap_user_attribute' in documentation.
This commit is contained in:
Peter Marschall
parent
6c1445d8db
commit
f9dd3efc3a
4 changed files with 22 additions and 30 deletions
|
|
@ -926,26 +926,26 @@ The search filter to find the user DN to authenticate by the username. User '{0}
|
|||
|
||||
Default: `(cn={0})`
|
||||
|
||||
#### ldap_user_attribute
|
||||
##### ldap_user_attribute
|
||||
|
||||
The LDAP attribute whose value shall be used as the user name after successful authentication
|
||||
|
||||
Default: not set, i.e. the login name given is used directly.
|
||||
|
||||
##### ldap_load_groups
|
||||
|
||||
Load the ldap groups of the authenticated user. These groups can be used later on to define rights. This also gives you access to the group calendars, if they exist.
|
||||
* The group calendar will be placed under collection_root_folder/GROUPS
|
||||
* The name of the calendar directory is the base64 encoded group name.
|
||||
* The group calendar folders will not be created automaticaly. This must be created manually. [Here](https://github.com/Kozea/Radicale/wiki/LDAP-authentication) you can find a script to create group calendar folders https://github.com/Kozea/Radicale/wiki/LDAP-authentication
|
||||
|
||||
Default: False
|
||||
|
||||
##### ldap_groups_attribute
|
||||
|
||||
The LDAP attribute to read the group memberships from in the user's LDAP entry if `ldap_load_groups` is True.
|
||||
The LDAP attribute to read the group memberships from in the authenticated user's LDAP entry.
|
||||
|
||||
Default: `memberOf`
|
||||
If set, load the LDAP group memberships from the attribute given
|
||||
These memberships can be used later on to define rights.
|
||||
This also gives you access to the group calendars, if they exist.
|
||||
* The group calendar will be placed under collection_root_folder/GROUPS
|
||||
* The name of the calendar directory is the base64 encoded group name.
|
||||
* The group calendar folders will not be created automatically. This must be done manually. In the [LDAP-authentication section of Radicale's wiki](https://github.com/Kozea/Radicale/wiki/LDAP-authentication) you can find a script to create a group calendar.
|
||||
|
||||
Use 'memberOf' if you want to load groups on Active Directory and alikes, 'groupMembership' on Novell eDirectory, ...
|
||||
|
||||
Default: unset
|
||||
|
||||
##### ldap_use_ssl
|
||||
|
||||
|
|
|
|||
5
config
5
config
|
|
@ -86,10 +86,7 @@
|
|||
# Path of the file containing password of the reader DN
|
||||
#ldap_secret_file = /run/secrets/ldap_password
|
||||
|
||||
# If the ldap groups of the user need to be loaded
|
||||
#ldap_load_groups = True
|
||||
|
||||
# the attribute to read the group memberships from in the user's LDAP entry if ldap_load_groups is True.
|
||||
# the attribute to read the group memberships from in the user's LDAP entry (default: not set)
|
||||
#ldap_groups_attribute = memberOf
|
||||
|
||||
# The filter to find the DN of the user. This filter must contain a python-style placeholder for the login
|
||||
|
|
|
|||
|
|
@ -25,7 +25,6 @@ Following parameters are needed in the configuration:
|
|||
ldap_filter The search filter to find the user to authenticate by the username
|
||||
ldap_user_attribute The attribute to be used as username after authentication
|
||||
ldap_groups_attribute The attribute containing group memberships in the LDAP user entry
|
||||
ldap_load_groups If the groups of the authenticated users need to be loaded
|
||||
Following parameters controls SSL connections:
|
||||
ldap_use_ssl If the connection
|
||||
ldap_ssl_verify_mode The certificate verification mode. NONE, OPTIONAL, default is REQUIRED
|
||||
|
|
@ -46,8 +45,7 @@ class Auth(auth.BaseAuth):
|
|||
_ldap_filter: str
|
||||
_ldap_attributes: list[str] = []
|
||||
_ldap_user_attr: str
|
||||
_ldap_load_groups: bool
|
||||
_ldap_groups_attr: str = "memberOf"
|
||||
_ldap_groups_attr: str
|
||||
_ldap_module_version: int = 3
|
||||
_ldap_use_ssl: bool = False
|
||||
_ldap_ssl_verify_mode: int = ssl.CERT_REQUIRED
|
||||
|
|
@ -68,7 +66,6 @@ class Auth(auth.BaseAuth):
|
|||
self._ldap_uri = configuration.get("auth", "ldap_uri")
|
||||
self._ldap_base = configuration.get("auth", "ldap_base")
|
||||
self._ldap_reader_dn = configuration.get("auth", "ldap_reader_dn")
|
||||
self._ldap_load_groups = configuration.get("auth", "ldap_load_groups")
|
||||
self._ldap_secret = configuration.get("auth", "ldap_secret")
|
||||
self._ldap_filter = configuration.get("auth", "ldap_filter")
|
||||
self._ldap_user_attr = configuration.get("auth", "ldap_user_attribute")
|
||||
|
|
@ -89,13 +86,15 @@ class Auth(auth.BaseAuth):
|
|||
logger.info("auth.ldap_uri : %r" % self._ldap_uri)
|
||||
logger.info("auth.ldap_base : %r" % self._ldap_base)
|
||||
logger.info("auth.ldap_reader_dn : %r" % self._ldap_reader_dn)
|
||||
logger.info("auth.ldap_load_groups : %s" % self._ldap_load_groups)
|
||||
logger.info("auth.ldap_filter : %r" % self._ldap_filter)
|
||||
if self._ldap_user_attr:
|
||||
logger.info("auth.ldap_user_attribute : %r" % self._ldap_user_attr)
|
||||
else:
|
||||
logger.info("auth.ldap_user_attribute : (not provided)")
|
||||
logger.info("auth.ldap_groups_attribute: %r" % self._ldap_groups_attr)
|
||||
if self._ldap_groups_attr:
|
||||
logger.info("auth.ldap_groups_attribute: %r" % self._ldap_groups_attr)
|
||||
else:
|
||||
logger.info("auth.ldap_groups_attribute: (not provided)")
|
||||
if ldap_secret_file_path:
|
||||
logger.info("auth.ldap_secret_file_path: %r" % ldap_secret_file_path)
|
||||
if self._ldap_secret:
|
||||
|
|
@ -115,7 +114,7 @@ class Auth(auth.BaseAuth):
|
|||
else:
|
||||
logger.info("auth.ldap_ssl_ca_file : (not provided)")
|
||||
"""Extend attributes to to be returned in the user query"""
|
||||
if self._ldap_load_groups:
|
||||
if self._ldap_groups_attr:
|
||||
self._ldap_attributes.append(self._ldap_groups_attr)
|
||||
if self._ldap_user_attr:
|
||||
self._ldap_attributes.append(self._ldap_user_attr)
|
||||
|
|
@ -157,7 +156,7 @@ class Auth(auth.BaseAuth):
|
|||
conn.set_option(self.ldap.OPT_REFERRALS, 0)
|
||||
conn.simple_bind_s(user_dn, password)
|
||||
tmp: list[str] = []
|
||||
if self._ldap_load_groups:
|
||||
if self._ldap_groups_attr:
|
||||
tmp = []
|
||||
for g in user_entry[1][self._ldap_groups_attr]:
|
||||
"""Get group g's RDN's attribute value"""
|
||||
|
|
@ -227,7 +226,7 @@ class Auth(auth.BaseAuth):
|
|||
logger.debug(f"_login3 user '{login}' cannot be found")
|
||||
return ""
|
||||
tmp: list[str] = []
|
||||
if self._ldap_load_groups:
|
||||
if self._ldap_groups_attr:
|
||||
tmp = []
|
||||
for g in user_entry['attributes'][self._ldap_groups_attr]:
|
||||
"""Get group g's RDN's attribute value"""
|
||||
|
|
|
|||
|
|
@ -247,12 +247,8 @@ DEFAULT_CONFIG_SCHEMA: types.CONFIG_SCHEMA = OrderedDict([
|
|||
"value": "",
|
||||
"help": "the attribute to be used as username after authentication",
|
||||
"type": str}),
|
||||
("ldap_load_groups", {
|
||||
"value": "False",
|
||||
"help": "load the ldap groups of the authenticated user",
|
||||
"type": bool}),
|
||||
("ldap_groups_attribute", {
|
||||
"value": "memberOf",
|
||||
"value": "",
|
||||
"help": "attribute to read the group memberships from",
|
||||
"type": str}),
|
||||
("ldap_use_ssl", {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue