LDAP authentication process modification #825

Closed
aitzol wants to merge 10 commits from (deleted):ldap-auth-changes into develop
First-time contributor
  1. Added eldap module, see issue 671
  2. Modified LDAP authentication process. In some servers it is not possible to authenticate the user using the UID, since it is not part of the user's DN required for the simple bind. In the proposed way, a search for the user is performed using his UID, obtaining at that moment his CN and then authenticating himself. For the changes to work it is necessary to add the login credentials to the LDAP server using environment variables in the .env file, like this:
LDAP_READONLY_USER_USERNAME="readonly"
LDAP_READONLY_USER_PASSWORD="secret"
1. Added **eldap** module, see [issue 671](https://akkoma.dev/AkkomaGang/akkoma/issues/671) 2. Modified **LDAP** authentication process. In some servers it is not possible to authenticate the user using the `UID`, since it is not part of the user's `DN` required for the _simple bind_. In the proposed way, a search for the user is performed using his `UID`, obtaining at that moment his `CN` and then authenticating himself. For the changes to work it is necessary to add the login credentials to the **LDAP** server using environment variables in the `.env` file, like this: ```bash LDAP_READONLY_USER_USERNAME="readonly" LDAP_READONLY_USER_PASSWORD="secret" ```
aitzol added 1 commit 2024-08-05 10:03:25 +00:00
LDAP authentication process modification
Some checks failed
ci/woodpecker/pr/lint Pipeline failed
ci/woodpecker/pr/test unknown status
ci/woodpecker/pr/build-arm64 unknown status
ci/woodpecker/pr/build-amd64 unknown status
ci/woodpecker/pr/docs unknown status
72a831099e
aitzol added 1 commit 2024-08-25 18:01:03 +00:00
Merge branch 'develop' into ldap-auth-changes
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
962f58daf5
aitzol added 1 commit 2024-09-26 03:30:22 +00:00
Merge branch 'develop' into ldap-auth-changes
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
027ae524df
Member

I’m not familiar with LDAP nor Akkoma’s code for it, but according to the docs this "simple bind" cn=user,base scheme is already supposed to be supported by setting the uid parameter to cn instead of uid. On a glance your changes appear to break the uid scheme though due to hardcoding attr = "cn" as the prefix

I’m not familiar with LDAP nor Akkoma’s code for it, but according to [the docs](https://docs.akkoma.dev/stable/configuration/cheatsheet/#ldap) this "simple bind" `cn=user,base` scheme is already supposed to be supported by setting the uid parameter to `cn` instead of `uid`. On a glance your changes appear to break the `uid` scheme though due to hardcoding `attr = "cn"` as the prefix
Author
First-time contributor

I’m not familiar with LDAP nor Akkoma’s code for it, but according to the docs this "simple bind" cn=user,base scheme is already supposed to be supported by setting the uid parameter to cn instead of uid. On a glance your changes appear to break the uid scheme though due to hardcoding attr = "cn" as the prefix

Often the CN attribute on many LDAP servers is usually a compound name, i.e. first name y last name, which is not useful as a username/nick for logging Akkoma. That is another reason for me to make the above changes using the UID.

> I’m not familiar with LDAP nor Akkoma’s code for it, but according to [the docs](https://docs.akkoma.dev/stable/configuration/cheatsheet/#ldap) this "simple bind" `cn=user,base` scheme is already supposed to be supported by setting the uid parameter to `cn` instead of `uid`. On a glance your changes appear to break the `uid` scheme though due to hardcoding `attr = "cn"` as the prefix Often the `CN` attribute on many LDAP servers is usually a compound name, i.e. first name y last name, which is not useful as a username/nick for logging Akkoma. That is another reason for me to make the above changes using the `UID`.
aitzol added 1 commit 2024-10-16 16:48:51 +00:00
changelog.md
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
1a080be59f
aitzol added 5 commits 2024-10-16 17:06:08 +00:00
Reviewed-on: aitzol/akkoma#1
Merge pull request 'develop' (#2) from develop into ldap-auth-changes
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
f64fb443ec
Reviewed-on: aitzol/akkoma#2
Member

It sounds like you want to add a new mode, which is in principle fine, but you shouldn’t break existing modes and usecases in the process. E.g. adding mapped_cn or something as a third option besides uid and cn

It sounds like you want to add a new mode, which is in principle fine, but you shouldn’t break existing modes and usecases in the process. E.g. adding `mapped_cn` or something as a third option besides `uid` and `cn`
aitzol added 1 commit 2024-11-02 06:50:21 +00:00
LDAP authentication process modification
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending approval
ci/woodpecker/pr/build-arm64 Pipeline is pending approval
ci/woodpecker/pr/docs Pipeline is pending approval
ci/woodpecker/pr/lint Pipeline is pending approval
ci/woodpecker/pr/test Pipeline is pending approval
ci/woodpecker/pull_request_closed/build-amd64 Pipeline is pending approval
ci/woodpecker/pull_request_closed/build-arm64 Pipeline is pending approval
ci/woodpecker/pull_request_closed/docs Pipeline is pending approval
ci/woodpecker/pull_request_closed/lint Pipeline is pending approval
ci/woodpecker/pull_request_closed/test Pipeline is pending approval
fec332a627
aitzol closed this pull request 2024-11-02 06:57:16 +00:00
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending approval
ci/woodpecker/pr/build-arm64 Pipeline is pending approval
ci/woodpecker/pr/docs Pipeline is pending approval
ci/woodpecker/pr/lint Pipeline is pending approval
ci/woodpecker/pr/test Pipeline is pending approval
ci/woodpecker/pull_request_closed/build-amd64 Pipeline is pending approval
ci/woodpecker/pull_request_closed/build-arm64 Pipeline is pending approval
ci/woodpecker/pull_request_closed/docs Pipeline is pending approval
ci/woodpecker/pull_request_closed/lint Pipeline is pending approval
ci/woodpecker/pull_request_closed/test Pipeline is pending approval

Pull request closed

Sign in to join this conversation.
No description provided.