flask-simpleldap icon indicating copy to clipboard operation
flask-simpleldap copied to clipboard

Unable to authenticate users on LDAP servers where get_object_details() does not return a DN

Open lorenzschmid opened this issue 4 years ago • 0 comments

Follow up to #88: The Synology LDAP server does not return a user's DN in its response retrieved via get_object_details(). The user's DN can therefore not be extracted by setting dn_only=True (and configuring LDAP_OBJECTS_DN). Following the relevant parts of such a response:

{
    'objectClass': [
        b'top',
        b'posixAccount',
        b'person',
        b'organizationalPerson',
        ...
    ],
    'cn': [b'username'],
    'uid': [b'username'],
    'uidNumber': [b'...'],
    'gidNumber': [b'...'],
    'sn': [b'username'],
    'mail': [b'[email protected]'],
    'authAuthority': [b';basic;'],
    'displayName': [b'username'],
    'userPassword': [b'{CRYPT}$...'],
    'memberOf': [...]
}

Since bind_user() always calls get_object_details() first, it is impossible to authenticate a user on a Synology LDAP server with flask-simpleldap.

It would be helpful if call to get_object_details() could be bypassed, e.g. with an additional argument to bind_user(). Or alternatively adding the option to construct a valid DN based on uid and a new parameter LDAP_USER_DN_BASE.

lorenzschmid avatar Jun 18 '21 18:06 lorenzschmid