jupyterhub / ldapauthenticator

LDAP Authenticator Plugin for Jupyter
BSD 3-Clause "New" or "Revised" License
206 stars 178 forks source link

Re-evaluate providing a LocalLDAPAuthenticator #261

Closed consideRatio closed 2 months ago

consideRatio commented 2 months ago

The readme sais:

Configuration note on local user creation

Currently, local user creation by the LDAPAuthenticator is unsupported as this is insecure since there's no cleanup method for these created users. As a result, users who are disabled in LDAP will have access to this for far longer.

Alternatively, there's good support in Linux for integrating LDAP into the system user setup directly, and users can just use PAM (which is supported in not just JupyterHub, but ssh and a lot of other tools) to log in. You can see http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/pamnss.html and lots of other documentation on the web on how to set up LDAP to provide user accounts for your system. Those methods are very widely used, much more secure and more widely documented. We recommend you use them rather than have JupyterHub create local accounts using the LDAPAuthenticator.

Issue #19 provides additional discussion on local user creation.

I think its time to re-evaluate the creation of a LocalLDAPAuthenticator, currently there isn't one making creation of local users something one needs to get done manually, for example like described here: https://github.com/jupyterhub/ldapauthenticator/issues/107#issuecomment-771731193

manics commented 2 months ago

LDAP is designed to be integrated at the OS level, e.g. to provide consistent UIDs across systems. Adding official support for LocalLDAPAuthenticator gives the misleading impression that the created users are consistent with the LDAP database when they're completely independent.

consideRatio commented 2 months ago

I figure we need to update docs about not providing this, as it seems like a broken expectation for some users.

consideRatio commented 2 months ago

Marking as closed - let's not add this.