easyauth
easyauth copied to clipboard
LDAP integration functionality
Implements functionality for authentication via LDAP. Tested on MS Active Directory.
@erevodifosin - Great Addition, I have some points that would need to be looked into before we could consider merging.
- [ ] - Documentation - Any potential changes / Additions will need to have some surrounding documentation. This is important so the feature can be tested, if not possible to cover in unit / integration tests.
- [ ] - Tests - Is there an easy way to spin up an LDAP server to test this locally( i.e inside of docker). This would be a great addition to docs as well as allow us to add automated tests to verify functionality.
- [ ] - ENV vs DB configuration - from what I gather looking at the current implementation, it would be ideal to add these LDAP configurations options as an Identity Provider option in the GUI, to more dynamically configure / update LDAP configuration, enabling / disabling. This would like be possible by creating a new Model to store LDAPConfig
I would be happy to help add the GUI options/ LDAP model that would make LDAP configurable from the Admin Page, but would need to know the steps to start a very basic but functional LDAP server that we could connect.
This is my very first PR ever, so bear with me, please.
- I will add the Documentation. I added some info in README.md but my lack of knowledge in git led me to delete this info.
- ENV vs DB. I saw systems that used ENV variables, others use plain-text or config files(like self-hosted Gitlab, Observium), others use ui and db records(like self-hosted Jira, Keycloak). It depends on the implementation of the system.
- Tests. This looks simple and easy to use. I have no experience in docker.
In order for the system to be versatile we need the below settings.
- LDAP server = IP or FQDN
- LDAP domain = Domain
- LDAP port = TCP port, usually 389 (636 SSL)
- LDAP SSL = True or False
- LDAP Base DN = Base DN to find the users
- LDAP username attribute = which ldap attribute contains the Username
- LDAP first name attribute = which ldap attribute contains the First name
- LDAP last name attribute = which ldap attribute contains the Last name
- LDAP email attribute = which ldap attribute contains the Email.
Username, first name, last name and email LDAP attributes may vary between LDAP server implementations. (some of the I hardcoded them in my PR but it is easy to change in the future)
Happy New Year! In case you missed I already added the LDAP config in the Docs.
Another thing that come to my mind is that we could do a mapping between easyauth groups and LDAP groups. So users will get their permission level based on the LDAP groups they are in.
I did not find a predictable way of creating an LDAP server within tests, and do not have the time to research this. I will close this PR for now until we can ensure the features are tested.
I am using this docker image : https://github.com/osixia/docker-openldap Works very well. @erevodifosin : don't you need also a "LDAP bind user login" and "LDAP bind user password" in your config to retrieve the directory tree ?
@codemation : Why there is a need to create an LDAP server ? Even without docker, it is possible to use an online LDAP test server : https://www.forumsys.com/2022/05/10/online-ldap-test-server/