This is a snapshot of Indico's old Trac site. Any information contained herein is most probably outdated. Access our new GitHub site here.

Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#600 closed enhancement (fixed)

LDAP authentication patch

Reported by: makub Owned by: Pedro Ferreira <jose.pedro.ferreira@…>
Priority: normal Milestone: v0.98.1
Component: Security Version: 0.97.0
Keywords: Cc:

Description

Here is my implementation of LDAP based authentication for Indico.

It supports authentication and reading users and groups data from a LDAP server.

It assumes that the LDAP layout is the standard, i.e. users and groups located in

ou=people,dc=example,dc=com
ou=groups,dc=example,dc=com

branches. It can be customized by setting parameters in the indico.conf file.

The patch is against the 0.97RC2 release. It was developed originally for the 0.96.2 release, and works for 0.97 as well.

However in 0.97, there is one new problem - there is no checkbox on the groups management page for searching external groups anymore. It was present in Indico 0.96.2. So my code for loading groups from LDAP is never called in 0.97.

Attachments (1)

indico_ldap.patch​ (23.0 KB) - added by makub 5 years ago.
A patch made by diff against the 0.97_rc2 release of Indico

Download all attachments as: .zip

Change History (5)

Changed 5 years ago by makub

A patch made by diff against the 0.97_rc2 release of Indico

comment:1 Changed 5 years ago by pferreir

  • Version set to 0.97.0

comment:2 Changed 5 years ago by jbenito

  • Status changed from new to in_merge

comment:3 Changed 5 years ago by Pedro Ferreira <jose.pedro.ferreira@…>

  • Owner set to Pedro Ferreira <jose.pedro.ferreira@…>
  • Resolution set to fixed
  • Status changed from awaiting_merge to closed

In [f395ef209a946498414ccec518c86e803809de68/indico]:

[IMP] LDAP Authentication

  • Integrated Martin Kuba's patch (thanks Martin!);
  • Added escaping of LDAP special chars, in order to avoid injection attacks;
  • Added some extra customization options, so that the mechanism can interact with services that follow different conventions;
  • Renamed some structures, including 'Ldap' -> 'LDAP';
  • Changed operations to synchronous;
  • Added preliminary login step that can be needed in servers that do not provide anonymous read access;
  • Changed group membership strategy - faster and easier;
  • Adapted code to inetOrgPerson fields;
  • Improved the overall formatting and code quality (pylint and PEP8);
  • closes #600 and makes many server admins happier ;)
  • TODO: pluginize the whole thing (implies refactoring of auth mechanism);
  • TODO: Caching - right now server calls are performed every time;

comment:4 Changed 5 years ago by pferreir

Concerning the checkbox problem, this has already been fixed in 0.98.xx.

Note: See TracTickets for help on using tickets.