diff --git a/doc/getting_started/configuration.rst b/doc/getting_started/configuration.rst index ee544263d..cad72e254 100644 --- a/doc/getting_started/configuration.rst +++ b/doc/getting_started/configuration.rst @@ -154,14 +154,14 @@ This parameter is optional but you must ensure it is set to ``False`` The default configuration file provided by the *modoboa-admin.py* command is properly configured. -*********************** -External authentication -*********************** +**** +LDAP +**** .. _ldap_auth: -LDAP -==== +Authentication +============== *Modoboa* supports external LDAP authentication using the following extra components: @@ -181,46 +181,67 @@ like this:: 'modoboa.lib.authbackends.SimpleBackend', ) -Then, go to *Modoboa > Parameters > General* and set *Authentication +Finally, go to *Modoboa > Parameters > General* and set *Authentication type* to LDAP. From there, new parameters will appear to let you configure the way Modoboa should connect to your LDAP server. They are described just below: -+--------------------+--------------------+--------------------+ -|Name |Description |Default value | -+====================+====================+====================+ -|Server address |The IP address of |localhost | -| |the DNS name of the | | -| |LDAP server | | -+--------------------+--------------------+--------------------+ -|Server port |The TCP port number |389 | -| |used by the LDAP | | -| |server | | -+--------------------+--------------------+--------------------+ -|Use a secure |Use an SSL/TLS |no | -|connection |connection to access| | -| |the LDAP server | | -+--------------------+--------------------+--------------------+ -|Authentication |Choose the |Direct bind | -|method |authentication | | -| |method to use | | -+--------------------+--------------------+--------------------+ -|User DN template |The template used to| | -| |construct a user's | | -| |DN. It should | | -| |contain one | | -| |placeholder | | -| |(ie. ``%(user)s``) | | -+--------------------+--------------------+--------------------+ -|Password attribute |The attribute used |userPassword | -| |to store user | | -| |passwords | | -+--------------------+--------------------+--------------------+ -|Active Directory |Tell if the LDAP |no | -| |server is an Active | | -| |Directory one | | -+--------------------+--------------------+--------------------+ ++--------------------+---------------------------------+--------------------+ +|Name |Description |Default value | ++====================+=================================+====================+ +|Server address |The IP address of |localhost | +| |the DNS name of the | | +| |LDAP server | | ++--------------------+---------------------------------+--------------------+ +|Server port |The TCP port number |389 | +| |used by the LDAP | | +| |server | | ++--------------------+---------------------------------+--------------------+ +|Use a secure |Use an SSL/TLS |no | +|connection |connection to access | | +| |the LDAP server | | ++--------------------+---------------------------------+--------------------+ +|Authentication |Choose the |Direct bind | +|method |authentication | | +| |method to use | | ++--------------------+---------------------------------+--------------------+ +|User DN template |The template used to | | +|(direct bind mode) |construct a user's | | +| |DN. It should | | +| |contain one | | +| |placeholder | | +| |(ie. ``%(user)s``) | | ++--------------------+---------------------------------+--------------------+ +|Bind BN |The distinguished | | +| |name to use when | | +| |binding to the LDAP | | +| |server. Leave empty | | +| |for an anonymous | | +| |bind | | ++--------------------+---------------------------------+--------------------+ +|Bind password |The password to use | | +| |when binding to the | | +| |LDAP server (with | | +| |'Bind DN') | | ++--------------------+---------------------------------+--------------------+ +|Search base |The distinguished | | +| |name of the search | | +| |base | | ++--------------------+---------------------------------+--------------------+ +|Search filter |An optional filter string |(mail=%(user)s) | +| |(e.g. '(objectClass=person)'). In| | +| |order to be valid, it must be | | +| |enclosed in parentheses. | | ++--------------------+---------------------------------+--------------------+ +|Password attribute |The attribute used |userPassword | +| |to store user | | +| |passwords | | ++--------------------+---------------------------------+--------------------+ +|Active Directory |Tell if the LDAP |no | +| |server is an Active | | +| |Directory one | | ++--------------------+---------------------------------+--------------------+ If you need additional parameters, you will find a detailled documentation `here `_. @@ -229,6 +250,13 @@ Once the authentication is properly configured, the users defined in your LDAP directory will be able to connect to *Modoboa*, the associated domain and mailboxes will be automatically created if needed. +.. note:: + + Users created automatically from an LDAP directory belongs to the + *SimpleUsers* group and have a mailbox. To do so, usernames have to + be valid email addresses. If not, LDAP users won't be able to + access Modoboa. + Users will also be able to update their LDAP password directly from Modoboa. diff --git a/modoboa/admin/app_settings.py b/modoboa/admin/app_settings.py index 76dcc5362..f1bcdee6e 100644 --- a/modoboa/admin/app_settings.py +++ b/modoboa/admin/app_settings.py @@ -97,7 +97,7 @@ class GeneralParametersForm(parameters.AdminParametersForm): label=ugettext_lazy("Bind password"), initial='', help_text=ugettext_lazy("The password to use when binding to the LDAP server (with 'Bind DN')"), - widget=forms.PasswordInput, + widget=forms.PasswordInput(render_value=True), required=False ) diff --git a/modoboa/lib/authbackends.py b/modoboa/lib/authbackends.py index f56a6de32..01752a81c 100644 --- a/modoboa/lib/authbackends.py +++ b/modoboa/lib/authbackends.py @@ -1,6 +1,9 @@ from django.contrib.auth.backends import ModelBackend +from django.utils.translation import gettext as _ from modoboa.admin.models import User +from modoboa.lib.exceptions import ModoboaException from modoboa.lib import parameters +from modoboa.lib.emailutils import split_mailbox class SimpleBackend(ModelBackend): @@ -32,6 +35,9 @@ try: username is the Django-friendly username of the user. ldap_user.dn is the user's DN and ldap_user.attrs contains all of their LDAP attributes. """ + lpart, domain = split_mailbox(username) + if domain is None: + return None user, created = User.objects.get_or_create( username__iexact=username, defaults={'username': username.lower(), 'is_local': False} diff --git a/modoboa/lib/ldaputils.py b/modoboa/lib/ldaputils.py index b27fd7bc6..6bb909527 100644 --- a/modoboa/lib/ldaputils.py +++ b/modoboa/lib/ldaputils.py @@ -83,7 +83,7 @@ class LDAPAuthBackend(object): else: tpl = self._setting("AUTH_LDAP_USER_DN_TEMPLATE", "") self.user_dn = tpl % {"user": user} - self.conn = self._get_conn(self.user_dn, password) + self.conn = self._get_conn(self.user_dn, password) def _find_user_dn(self, user): sbase = parameters.get_admin("LDAP_SEARCH_BASE", app="admin")