github-jwinterm/modoboa
1
0
Fork 0
mirror of https://github.com/jwinterm/modoboa.git synced 2026-10-18 05:51:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent bad usernames from beeing imported.

Browse Source 
fixes #448
This commit is contained in:
Antoine Nguyen
2013-07-20 09:52:56 +02:00
parent abd29201e0
commit 5cde4f9e6e
4 changed files with 76 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/getting_started/configuration.rst
+68 -40
View File
@@ -154,14 +154,14 @@ This parameter is optional but you must ensure it is set to ``False``
The default configuration file provided by the *modoboa-admin.py*
command is properly configured.
***********************
External authentication
***********************
****
LDAP
****
.. _ldap_auth:
LDAP
====
Authentication
==============
*Modoboa* supports external LDAP authentication using the following extra components:
@@ -181,46 +181,67 @@ like this::
'modoboa.lib.authbackends.SimpleBackend',
)
Then, go to *Modoboa > Parameters > General* and set *Authentication
Finally, go to *Modoboa > Parameters > General* and set *Authentication
type* to LDAP.
From there, new parameters will appear to let you configure the way
Modoboa should connect to your LDAP server. They are described just below:
+--------------------+--------------------+--------------------+
|Name |Description |Default value |
+====================+====================+====================+
|Server address |The IP address of |localhost |
| |the DNS name of the | |
| |LDAP server | |
+--------------------+--------------------+--------------------+
|Server port |The TCP port number |389 |
| |used by the LDAP | |
| |server | |
+--------------------+--------------------+--------------------+
|Use a secure |Use an SSL/TLS |no |
|connection |connection to access| |
| |the LDAP server | |
+--------------------+--------------------+--------------------+
|Authentication |Choose the |Direct bind |
|method |authentication | |
| |method to use | |
+--------------------+--------------------+--------------------+
|User DN template |The template used to| |
| |construct a user's | |
| |DN. It should | |
| |contain one | |
| |placeholder | |
| |(ie. ``%(user)s``) | |
+--------------------+--------------------+--------------------+
|Password attribute |The attribute used |userPassword |
| |to store user | |
| |passwords | |
+--------------------+--------------------+--------------------+
|Active Directory |Tell if the LDAP |no |
| |server is an Active | |
| |Directory one | |
+--------------------+--------------------+--------------------+
+--------------------+---------------------------------+--------------------+
|Name |Description |Default value |
+====================+=================================+====================+
|Server address |The IP address of |localhost |
| |the DNS name of the | |
| |LDAP server | |
+--------------------+---------------------------------+--------------------+
|Server port |The TCP port number |389 |
| |used by the LDAP | |
| |server | |
+--------------------+---------------------------------+--------------------+
|Use a secure |Use an SSL/TLS |no |
|connection |connection to access | |
| |the LDAP server | |
+--------------------+---------------------------------+--------------------+
|Authentication |Choose the |Direct bind |
|method |authentication | |
| |method to use | |
+--------------------+---------------------------------+--------------------+
|User DN template |The template used to | |
|(direct bind mode) |construct a user's | |
| |DN. It should | |
| |contain one | |
| |placeholder | |
| |(ie. ``%(user)s``) | |
+--------------------+---------------------------------+--------------------+
|Bind BN |The distinguished | |
| |name to use when | |
| |binding to the LDAP | |
| |server. Leave empty | |
| |for an anonymous | |
| |bind | |
+--------------------+---------------------------------+--------------------+
|Bind password |The password to use | |
| |when binding to the | |
| |LDAP server (with | |
| |'Bind DN') | |
+--------------------+---------------------------------+--------------------+
|Search base |The distinguished | |
| |name of the search | |
| |base | |
+--------------------+---------------------------------+--------------------+
|Search filter |An optional filter string |(mail=%(user)s) |
| |(e.g. '(objectClass=person)'). In| |
| |order to be valid, it must be | |
| |enclosed in parentheses. | |
+--------------------+---------------------------------+--------------------+
|Password attribute |The attribute used |userPassword |
| |to store user | |
| |passwords | |
+--------------------+---------------------------------+--------------------+
|Active Directory |Tell if the LDAP |no |
| |server is an Active | |
| |Directory one | |
+--------------------+---------------------------------+--------------------+
If you need additional parameters, you will find a detailled
documentation `here <http://packages.python.org/django-auth-ldap/>`_.
@@ -229,6 +250,13 @@ Once the authentication is properly configured, the users defined in
your LDAP directory will be able to connect to *Modoboa*, the associated
domain and mailboxes will be automatically created if needed.
.. note::
Users created automatically from an LDAP directory belongs to the
*SimpleUsers* group and have a mailbox. To do so, usernames have to
be valid email addresses. If not, LDAP users won't be able to
access Modoboa.
Users will also be able to update their LDAP password directly from
Modoboa.
modoboa/admin/app_settings.py
+1 -1
View File
@@ -97,7 +97,7 @@ class GeneralParametersForm(parameters.AdminParametersForm):
label=ugettext_lazy("Bind password"),
initial='',
help_text=ugettext_lazy("The password to use when binding to the LDAP server (with 'Bind DN')"),
widget=forms.PasswordInput,
widget=forms.PasswordInput(render_value=True),
required=False
)
modoboa/lib/authbackends.py
+6
View File
@@ -1,6 +1,9 @@
from django.contrib.auth.backends import ModelBackend
from django.utils.translation import gettext as _
from modoboa.admin.models import User
from modoboa.lib.exceptions import ModoboaException
from modoboa.lib import parameters
from modoboa.lib.emailutils import split_mailbox
class SimpleBackend(ModelBackend):
@@ -32,6 +35,9 @@ try:
username is the Django-friendly username of the user. ldap_user.dn is
the user's DN and ldap_user.attrs contains all of their LDAP attributes.
"""
lpart, domain = split_mailbox(username)
if domain is None:
return None
user, created = User.objects.get_or_create(
username__iexact=username,
defaults={'username': username.lower(), 'is_local': False}
modoboa/lib/ldaputils.py
+1 -1
View File
@@ -83,7 +83,7 @@ class LDAPAuthBackend(object):
else:
tpl = self._setting("AUTH_LDAP_USER_DN_TEMPLATE", "")
self.user_dn = tpl % {"user": user}
self.conn = self._get_conn(self.user_dn, password)
self.conn = self._get_conn(self.user_dn, password)
def _find_user_dn(self, user):
sbase = parameters.get_admin("LDAP_SEARCH_BASE", app="admin")