Add the possibility to disable ldap password stored in DB

[Pbast]

Hello, Since release 0.4 LDAP authentication store LDAP password in DB and this way is against our security policies. I'm a newbie in python langage but I can try to add a new setting to disable this storing. For this could you show me pieces of code about this issue https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/21 ? Thxs. Pascal B

[madmath03]

Hello,

Sorry for the delay. Here are a few tips on what should be done to develop this feature:

The password is saved in services.py so this is the only Python file you will need to update:

• First thing to do will be to get a new attribute (LDAP_SAVE_LOGIN_PASSWORD with default to True) at the start of the file to define the expected behavior: https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/blob/9fe8b1055aafbc0aaf8e487963a268d0bd12f3b4/taiga_contrib_ldap_auth_ext/services.py#L27-L32
• Then, you will need to encapsulate the code setting the user password on first login with a condition depending on the parameter you loaded earlier: https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/blob/9fe8b1055aafbc0aaf8e487963a268d0bd12f3b4/taiga_contrib_ldap_auth_ext/services.py#L115-L117
• Then, do the same for an already existing user. You could even add an else condition to forcefully set the user password to None to ensure that the password is removed from already existing users: https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/blob/9fe8b1055aafbc0aaf8e487963a268d0bd12f3b4/taiga_contrib_ldap_auth_ext/services.py#L122-L124
• Last but not least, update the sample configuration in the README.md to show how to disable the password synchronization : something like LDAP_SAVE_LOGIN_PASSWORD = False with a small comment and maybe link to issue

That's pretty all there is to it.

Do not hesitate to open the PR even if your work is not finished. I can help you review your code while your PR is in progress.