Authentication against Active directory stopped working about ldapauthenticator HOT 8 CLOSED

Thanks for the report @xmatthias. The problem isn't to do with Windows AD controllers (I'm running on Windows) but instead is the use of DN for the lookup_dn_user_dn_attribute.

The code as is assumes c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'CN' so that's definitely something to fix.

In the interim, can you confirm if using the below config fixes the problem?

c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'CN'
c.LDAPAuthenticator.bind_dn_template = "CN={username},OU=Users,DC=example,DC=com"
c.LDAPAuthenticator.user_search_base = "OU=Users,DC=example,DC=com"

from ldapauthenticator.

Also, you should delete the below:

c.LDAPAuthenticator.base_dn = 'dc=example,dc=com'

base_dn doesn't appear to be a valid config?

from ldapauthenticator.

Thanks for the quick response.

Your approach does work - but is unsuitable in my environment as we have multi-forest environment (our users come from 3 separate forests). This would not be a problem per se, however, the forests themselvs are nested into OU's (one nested OU per region / site - without real standard) - so i would need to use an array of several 100 bind-templates to actually have it work, which is error-prone and very cumbersome to maintain.

My template would need to look something like "CN={username},OU=Users,*,DC=example,DC=com" - but wildcards in this position are not supported by ldap as far as i know.

I came a bit further inspired by your suggestions - using UPN i could get login to work "somehow"- however this breaks "allowed_groups" - as "[email protected]" is not member nor uniqueMember, but the CN would be.

c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'UserPrincipalName'

from ldapauthenticator.

Yes, the bug should be fixed. I thought that might give you a workaround in the interim but it sounds like that won't work.

from ldapauthenticator.

it's not a blocking issue for me at the moment - i can pip install the "old" commit directly in the meantime - so i found a temporary workaround (even though one I'd like to get rid of ASAP)

from ldapauthenticator.

Version 1.2.2 has been published to pypi - please let me know if this fixes the problem for you!

from ldapauthenticator.

Wow, that was quick

thanks a lot - works for me 👍

from ldapauthenticator.

can some one please help with the same kind of issue #115

from ldapauthenticator.