LDAP authentication process modification #825
No reviewers
Labels
No labels
approved, awaiting change
bug
configuration
documentation
duplicate
enhancement
extremely low priority
feature request
Fix it yourself
help wanted
invalid
mastodon_api
needs docs
needs tests
not a bug
planned
pleroma_api
privacy
question
static_fe
triage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: AkkomaGang/akkoma#825
Loading…
Reference in a new issue
No description provided.
Delete branch "(deleted):ldap-auth-changes"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
UID
, since it is not part of the user'sDN
required for the simple bind. In the proposed way, a search for the user is performed using hisUID
, obtaining at that moment hisCN
and then authenticating himself. For the changes to work it is necessary to add the login credentials to the LDAP server using environment variables in the.env
file, like this:I’m not familiar with LDAP nor Akkoma’s code for it, but according to the docs this "simple bind"
cn=user,base
scheme is already supposed to be supported by setting the uid parameter tocn
instead ofuid
. On a glance your changes appear to break theuid
scheme though due to hardcodingattr = "cn"
as the prefixOften the
CN
attribute on many LDAP servers is usually a compound name, i.e. first name y last name, which is not useful as a username/nick for logging Akkoma. That is another reason for me to make the above changes using theUID
.It sounds like you want to add a new mode, which is in principle fine, but you shouldn’t break existing modes and usecases in the process. E.g. adding
mapped_cn
or something as a third option besidesuid
andcn
Pull request closed