gws.plugin.auth_provider.ldap

LDAP authentication provider.

Authenticates users against an LDAP or Active Directory server. The server is given as an LDAP URL, a subset of the RFC 2255 form:

ldap://host:port/baseDN?searchAttribute

searchAttribute is the attribute that holds the login name. If ssl is configured, the connection uses ldaps. A bind DN and a password can be given; this DN must be allowed to search the directory. Without a bind DN, the provider binds anonymously. The connection is tested at configuration time.

Authentication with username and password credentials works as follows:

• connect to the server, binding as the bind DN if configured,

• search below the base DN for the entry with searchAttribute = username; more than one entry is an error,

• reject Active Directory accounts with the ACCOUNTDISABLE flag in userAccountControl,

• bind as the found DN with the password,

• connect again and assign roles from the users rules.

A users rule assigns its roles if the account is one of the entries found by the matches filter, or if the account is listed in the member, members or uniqueMember attribute of a group found by the memberOf filter. The attributes of the entry are passed to the user record. If the entry has no displayName, displayNameFormat creates one from the attributes.

Example:

auth.providers+ {
    type "ldap"
    url "ldap://ldap.example.com:389/dc=example,dc=com?uid"
    bindDN "cn=admin,dc=example,dc=com"
    bindPassword "secret"
    activeDirectory false
    users [
        { matches "(uid=admin)" roles ["admin"] }
        { memberOf "(cn=editors)" roles ["editor"] }
    ]
}

References

https://datatracker.ietf.org/doc/html/rfc2255

Source code: gws.plugin.auth_provider.ldap

Package Contents

class gws.plugin.auth_provider.ldap.Config

Bases: gws.base.auth.provider.Config

Authentication against an LDAP or Active Directory server.

activeDirectory: bool = True

The LDAP server is an Active Directory.

bindDN: str | None

DN to bind as for user lookups, anonymous bind if empty.

bindPassword: str | None

Password for the bind DN.

displayNameFormat: gws.FormatStr | None

Format string for the user’s display name.

ssl: SSLConfig | None

SSL settings, enables ldaps.

timeout: gws.Duration = '30'

Network timeout for LDAP connections.

url: str

LDAP server URL.

users: list[UserSpec]

Rules that assign GWS roles to LDAP accounts.

class gws.plugin.auth_provider.ldap.Object

Bases: gws.base.auth.provider.Object

LDAP authentication provider.

activeDirectory: bool

The server is an Active Directory.

baseDN: str

Base DN for searches.

bindDN: str

DN to bind as, empty for an anonymous bind.

bindPassword: str

Password for the bind DN.

displayNameFormat: str

Format string for the display name, empty if none.

loginAttribute: str

Attribute that holds the login name.

serverUrl: str

Server URL without path and query, with the ldap or ldaps scheme.

ssl: SSLConfig | None

SSL settings, or None.

timeout: int

Network timeout in seconds.

users: list[UserSpec]

Rules that assign roles to accounts.

authenticate(method, credentials)

configure()

get_user(local_uid)

class gws.plugin.auth_provider.ldap.SSLConfig(*args, **kwargs)

Bases: gws.Config

SSL settings for the LDAP connection.

ca: gws.FilePath | None

Path to the CA certificate file.

crt: gws.FilePath | None

Path to the client certificate file.

key: gws.FilePath | None

Path to the client key file.

class gws.plugin.auth_provider.ldap.UserSpec(*args, **kwargs)

Bases: gws.Data

Rule that assigns GWS roles to LDAP accounts.

matches: str | None

LDAP filter the account has to match.

memberOf: str | None

LDAP filter for groups the account has to be a member of.

roles: list[str]

GWS roles assigned to matching accounts.