Re: auth from ldap

On Tuesday 24 June 2003 07:45 am, Farkas Levente wrote:
> is there any way not to register each user regualry but auth from ldap.
> my biggest need for a ticketing system where each user authenticate
> itself from a list of any other way without have to choose an own
> username. I'd like if all of our user would have one login name for all
> kind of system. otherwise each user choose a different username
> everywhere and login names goes to a big chaos.

I have successfully set up a system where the user database in Roundup was 
slaved off an external database (in my case it was a UN*X passwd file). This 
is about the most sane approach to take IMO because any attempt to replace 
the regular user storage mechanism in Roundup would be painful in the extreme 
(you would have to guarantee that users are never removed from the LDAP 
store).

A script that reads users from an LDAP store using http://python-ldap.sf.net/ 
and then compares the list to the users in the roundup user database would be 
pretty easy to write. You'd then have it run once an hour / day (or on demand 
if you can work that into your LDAP store workflow).

To authenticate off the LDAP store (rather than using the passwords in the 
roundup user database) you'd use the same python-ldap module inside an 
extension to the cgi interface. You'd do this by adding a method called 
"verifyPassword" to the Client class in your tracker's interfaces.py module. 
The method is implemented by default as:

    def verifyPassword(self, userid, password):
        ''' Verify the password that the user has supplied
        '''
        stored = self.db.user.get(self.userid, 'password')
        if password == stored:
            return 1
        if not password and not stored:
            return 1
        return 0

So you could reimplement this as something like:

    def verifyPassword(self, userid, password):
        ''' Verify the password that the user has supplied
        '''
        # look up some unique LDAP information about the user
        username = self.db.user.get(self.userid, 'username')
        # now verify the password supplied against the LDAP store

Please let me know how you go...


    Richard

pgpN3pT3MMiFA.pgp
Description: signature