Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

auto create ldap users on first login #2799

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cyberb
Copy link

@cyberb cyberb commented May 29, 2023

This PR allows LDAP authentication without having users in database.

To enable ldap user auto creation set CALIBRE_LDAP_AUTO_CREATE env variable .
It will automatically import a successfully authenticated user.
Optionally if CALIBRE_LDAP_ADMIN_GROUP_FILTER env variable is set it will check if user should be a super user (all permissions set) or not when importing.

It was tested on OpenLDAP with admin group based on memberUid field.

export CALIBRE_LDAP_AUTO_CREATE=true
export CALIBRE_LDAP_ADMIN_GROUP_FILTER='(&(cn=syncloud)(&(objectClass=posixGroup)(memberUid=%s)))'

Where syncloud is a special admin group containing admin users.

Other settings are:

update settings set config_ldap_dn = 'dc=syncloud,dc=org' where id = 1;
update settings set config_ldap_user_object = '(&(objectclass=inetOrgPerson)(cn=%s))' where id = 1;
update settings set config_ldap_group_object_filter = '(&(objectclass=posixGroup)(cn=%s))' where id = 1;
update settings set config_ldap_group_members_field = 'memberUid' where id = 1;
update settings set config_ldap_group_name = 'syncloud' where id = 1;

I need this for Syncloud project where multiple apps like calibre-web are installed on the same box for simplified self-hosting. Apps are preconfigured as much as possible to have a best first time experience and reduce the need for any manual configuration (while not removing the option of doing it later).
Here is the complete package with UI (selenium) tests still being added: https://github.com/syncloud/calibre/tree/ldap

I am not in any way saying it is how it should be done in your project as you know more and I am ready to split this in multiple PRs if needed or change (for example you may want DB settings instead of env vars). Also it may not work for all LDAP servers which is why I would do it as a feature switch.

Also I must say flask-simpleldap is very limited comparing to a proper ldap lib for example not allowing to bind using a specific dn to search for an admin group members, so I had to set it once high enough in my tree (or I am missing something).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant