search

Monogramm / taiga-contrib-ldap-auth-ext

:snake: :alembic: Extended Taiga plugin for LDAP authentication
http://taiga.io
GNU Affero General Public License v3.0
45 stars 15 forks source link

Use user-provided credentials to bind to LDAP server #57

Open TuringTux opened 3 hours ago

TuringTux commented 3 hours ago

Currently, the Taiga plugin either uses a dedicated LDAP bind user, or anonymous bind to browse the LDAP server to find the account of the user who tried to login, verify their credentials and return the result.

Many LDAP servers are configured so that the user's credentials can also be used as LDAP bind user (normally giving only a very limited view of only the user's LDAP entry). It would be nice if the plugin could work with that.

Idea for the configuration

INSTALLED_APPS += ["taiga_contrib_ldap_auth_ext"]

# Multiple LDAP servers are currently not supported, see
# https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/16
LDAP_SERVER = "ldaps://ldap.example.com"
LDAP_PORT = 636

LDAP_BIND_DN = "CN=<username>,OU=DevTeam,DC=example,DC=com"
LDAP_BIND_WITH_USER_PROVIDED_CREDENTIALS = True

LDAP_SEARCH_BASE = 'OU=DevTeam,DC=example,DC=net'

LDAP_USERNAME_ATTRIBUTE = "uid"
LDAP_EMAIL_ATTRIBUTE = "mail"
LDAP_FULL_NAME_ATTRIBUTE = "givenName"

LDAP_SAVE_LOGIN_PASSWORD = False

LDAP_MAP_USERNAME_TO_UID = None

The idea would be to set LDAP_BIND_WITH_USER_CREDENTIALS = True to indicate the logging in user's credentials should be used to bind (meaning also that login is considered successful if binding works; which is a difference from how it would otherwise work), and LDAP_BIND_DN = "CN=<username>,OU=DevTeam,DC=example,DC=com" containing a placeholder.

TuringTux commented 3 hours ago

Closed by #55 (I wanted to open an issue as well to document this)