auth_ldap errors with AD

[raksingh]

Hi

I need to my application to authenticate and handle group permissions with MS Active Directory but have run into various errors. Some could be resolved with the correct LDAP settings, but others required changes to ldap_plugin.py and auth.py Now that the errors are gone, users are created in auth_user and groups populated in auth_user_tag_groups.

The app still crashes when using the Sign Up function, but I don't require the feature and will disable it. However, the email address, first name and last name fields are still being stored on the database as bytes, even though I am decoding the values returned from AD. Where else could the values come from except ldap_plugin.py?

LDAP_SETTINGS = { "mode": "ad", # Microsoft Active Directory "server": "ad.servername.com", # FQDN or IP of one Domain Controller "base_dn": "dc=corporate,dc=domain,dc=com", "group_dn": "dc=corporate,dc=domain,dc=com", "secure": True, "group_name_attrib": "cn", "group_member_attrib": "member", "group_filterstr": "objectClass=Group", "manage_groups": True, "allowed_groups": ["a-user-ad-group", "an-admin-ad-group"], "manage_user": True, "user_firstname_attrib": "givenName", "user_lastname_attrib": "sn", "user_mail_attrib": "mail" }

auth.py_diff.log ldap_plugin_diff.log

[nicozanf]

Hi, it's not clear to me what do you mean with "first name and last name fields are still being stored on the database as bytes"... could you clarify with an example?

[raksingh]

Hi Nico.

Seasons greetings.

Sorry, they values are stored as varchar in Postgres, but as the bytes string literal.

id | username | email | password | first_name | last_name | sso_id | action_token | last_password_change | past_passwords_hash ----+----------+-------------------------------+----------+-------------+------------+--------------+--------------+----------------------+--------------------- 3 | user_name | [b'Rakesh.Singh@x.y'] | | [b'Rakesh'] | [b'Singh'] | ldap:user_name| | |

Now that I've copied and pasted it here, I see now that the values are lists. Looked at it dozens of times and missed that! I'll try to resolve that now.

Thanks!

[raksingh]

Resolved by changing ldap_plugin.py to return the 1st element of the list.