auto create ldap users on first login #2799
Open
+59
−16
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR allows LDAP authentication without having users in database.
To enable ldap user auto creation set CALIBRE_LDAP_AUTO_CREATE env variable .
It will automatically import a successfully authenticated user.
Optionally if CALIBRE_LDAP_ADMIN_GROUP_FILTER env variable is set it will check if user should be a super user (all permissions set) or not when importing.
It was tested on OpenLDAP with admin group based on memberUid field.
Where
syncloud
is a special admin group containing admin users.Other settings are:
I need this for Syncloud project where multiple apps like calibre-web are installed on the same box for simplified self-hosting. Apps are preconfigured as much as possible to have a best first time experience and reduce the need for any manual configuration (while not removing the option of doing it later).
Here is the complete package with UI (selenium) tests still being added: https://github.com/syncloud/calibre/tree/ldap
I am not in any way saying it is how it should be done in your project as you know more and I am ready to split this in multiple PRs if needed or change (for example you may want DB settings instead of env vars). Also it may not work for all LDAP servers which is why I would do it as a feature switch.
Also I must say flask-simpleldap is very limited comparing to a proper ldap lib for example not allowing to bind using a specific dn to search for an admin group members, so I had to set it once high enough in my tree (or I am missing something).