flask-simpleldap
flask-simpleldap copied to clipboard
Unable to authenticate users on LDAP servers where get_object_details() does not return a DN
Follow up to #88: The Synology LDAP server does not return a user's DN in its response retrieved via get_object_details(). The user's DN can therefore not be extracted by setting dn_only=True (and configuring LDAP_OBJECTS_DN). Following the relevant parts of such a response:
{
'objectClass': [
b'top',
b'posixAccount',
b'person',
b'organizationalPerson',
...
],
'cn': [b'username'],
'uid': [b'username'],
'uidNumber': [b'...'],
'gidNumber': [b'...'],
'sn': [b'username'],
'mail': [b'[email protected]'],
'authAuthority': [b';basic;'],
'displayName': [b'username'],
'userPassword': [b'{CRYPT}$...'],
'memberOf': [...]
}
Since bind_user() always calls get_object_details() first, it is impossible to authenticate a user on a Synology LDAP server with flask-simpleldap.
It would be helpful if call to get_object_details() could be bypassed, e.g. with an additional argument to bind_user(). Or alternatively adding the option to construct a valid DN based on uid and a new parameter LDAP_USER_DN_BASE.