localshop
localshop copied to clipboard
userena breaks ldap authentication
Because userena and localshop use a different set of login parameters then the default this breaks thirdparty backends like django_auth_ldap.
The workaround is some additional code like this:
from django_auth_ldap.backend import LDAPBackend as Orig
class LDAPBackend(Orig):
def authenticate(self, username=None, password=None, identification=None):
if identification and not username:
username = identification
return super(LDAPBackend, self).authenticate(username, password)
But it's kind of silly that users have to jump through all these hoops for a django app that should just-work(tm).
Hi @trbs I've tried adding your code see #102 it work, but other pages are now now forbidden when accessed. Any tips to solve this? Thanks in advance.
Hi @cocoy I'm using a very similar setup to your #102
Differences are:
In settings.py:
AUTHENTICATION_BACKENDS = (
'ldap_workaround.LDAPBackend',
'userena.backends.UserenaAuthenticationBackend',
'guardian.backends.ObjectPermissionBackend',
'localshop.apps.permissions.backend.CredentialBackend',
'django.contrib.auth.backends.ModelBackend',
)
I have LDAP as the first AUTHENTICATION_BACKENDS
And I'm using in ldap_workaround.py
:
# {{ ansible_managed }}
from django_auth_ldap.backend import LDAPBackend as Orig
class LDAPBackend(Orig):
def authenticate(self, username=None, password=None, identification=None):
if identification and not username:
username = identification
return super(LDAPBackend, self).authenticate(username, password)
from django.db.models.signals import post_save
from django.contrib.auth.models import User
from localshop.apps.permissions.models import AuthProfile
def create_auth_profile(sender, **kwargs):
user = kwargs['instance']
if kwargs['created']:
AuthProfile(user=user).save()
post_save.connect(create_auth_profile, sender=User, dispatch_uid="create_auth_profile")
Maybe be that the order of the AUTHENTICATION_BACKENDS
is causing problems for you ?
@trbs Seems I missed the lines below to create profiles, I assume this is required. Thanks, will try it out.
LDAP login works fine, can login without problem. But clicking on other pages like says Forbidden http://mylocalserver/packages/
For the forbidden thing, make sure you have
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
"is_active": "cn=group,cn=groups,dc=company,dc=com",
"is_staff": ["cn=group,cn=groups,dc=company,dc=com"],
"is_superuser": "cn=group,cn=groups,dc=company,dc=com"
}
Seems the is_superuser
is what is required to be able to browse the other pages...
Seems my issue on Forbidden pages, because the group in LDAP has no access on the packages.
I have to allow package | packages | can View Packages on the admin page i.e http://localhost:8000/admin/auth/group/
Maybe this one fixes the same config at localshop.conf.py
Indeed @sposs it works!
ah, problem is the other permissions on admin pages were granted to the ldap user when set to is_superuser
Just a FYI, i've just removed django-userena in the develop branch so i'm hoping to get ldap support built-in by default now. Let me know if you have any tips or can even help me with a PR