Sentry LDAP Plugin ignored with latest Version

Hi,

with the latest version I am facing the problem that sentry does not recognized this plugin as Auth Backend. The Module does not show up in the auth backends, neither does the login over it work. With the same config it worked for older sentry versions.

Here is my config:

#########
#  LDAP #
#########
AUTH_LDAP_SERVER_URI = 'ldap://XXXXX
AUTH_LDAP_BIND_DN = ''
AUTH_LDAP_BIND_PASSWORD = ''

AUTH_LDAP_USER_SEARCH = LDAPSearch(
    'ou=users,dc=ldap,dc=XXXXXX,dc=io',
    ldap.SCOPE_SUBTREE,
    '(mail=%(user)s)',
)

AUTH_LDAP_USER_ATTR_MAP = {
    'name': 'cn',
    'email': 'displayName'
}
AUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION = u'XXXXX'

AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS = True
AUTH_LDAP_SENTRY_SUBSCRIBE_BY_DEFAULT = False
AUTH_LDAP_SENTRY_USERNAME_FIELD = 'cn'
SENTRY_MANAGED_USER_FIELDS = ('email', 'first_name', 'last_name', 'password', )

AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    '',
    ldap.SCOPE_SUBTREE,
    '(objectClass=groupOfUniqueNames)'
)

AUTH_LDAP_GROUP_TYPE = GroupOfUniqueNamesType()
AUTH_LDAP_REQUIRE_GROUP = None
AUTH_LDAP_DENY_GROUP = None

AUTH_LDAP_FIND_GROUP_PERMS = False
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600

AUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION = u'My Organization Name'
AUTH_LDAP_SENTRY_ORGANIZATION_ROLE_TYPE = 'member'
AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS = True
AUTH_LDAP_SENTRY_USERNAME_FIELD = '(|(cn=%(user))(uid=%(user)))'

import logging
logger = logging.getLogger('django_auth_ldap')
logger.addHandler(logging.StreamHandler())
logger.setLevel('DEBUG')

AUTHENTICATION_BACKENDS = AUTHENTICATION_BACKENDS + (
    'sentry_ldap_auth.backend.SentryLdapBackend',
)

[janceChun]

The following code is work for me ！！！😁😁

1. set the dockfile

FROM sentry:9.0-onbuild
RUN apt-get update && apt-get install -y libsasl2-dev python-dev libldap2-dev libssl-dev
RUN pip install sentry-ldap-auth

2.set the sentry.conf.py

import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfUniqueNamesType

AUTH_LDAP_SERVER_URI = 'ldap://xxxxx:xxxx'
AUTH_LDAP_BIND_DN = 'xxxxx'
AUTH_LDAP_BIND_PASSWORD = 'xxxxx'

AUTH_LDAP_USER_SEARCH = LDAPSearch(
    'xxxx',
    ldap.SCOPE_SUBTREE,
    '(mail=%(user)s)',
)

AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    '',
    ldap.SCOPE_SUBTREE,
    '(objectClass=groupOfUniqueNames)'
)

AUTH_LDAP_GROUP_TYPE = GroupOfUniqueNamesType()
AUTH_LDAP_REQUIRE_GROUP = None
AUTH_LDAP_DENY_GROUP = None

AUTH_LDAP_USER_ATTR_MAP = {
    'name': 'cn',
    'email': 'mail'
}

AUTH_LDAP_FIND_GROUP_PERMS = False
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600

AUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION = u'Sentry'
AUTH_LDAP_SENTRY_ORGANIZATION_ROLE_TYPE = 'member'
AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS = True
AUTH_LDAP_SENTRY_SUBSCRIBE_BY_DEFAULT = False

SENTRY_MANAGED_USER_FIELDS = ('email', 'first_name', 'last_name', 'password', )

AUTHENTICATION_BACKENDS = AUTHENTICATION_BACKENDS + (
    'sentry_ldap_auth.backend.SentryLdapBackend',
)

# optional, for debugging
import logging
logger = logging.getLogger('django_auth_ldap')
logger.addHandler(logging.StreamHandler())
logger.addHandler(logging.FileHandler('/tmp/ldap2.log'))
logger.setLevel('DEBUG')

LOGGING['overridable'] = ['sentry', 'django_auth_ldap']
LOGGING['loggers']['django_auth_ldap'] = {
    'handlers': ['console'],
    'level': 'DEBUG'
}

reference：https://yyhh.org/blog/2017/12/ldap-authentication-premise-sentry-server-using-freeipa

[AmyLewis]

I tested Sentry 9.0 + sentry_ldap_auth 2.7 with the Sentry config below, and the LDAP plugin in auth backends is working.

import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType

SENTRY_MANAGED_USER_FIELDS = ("email", "password")

AUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION = env('SENTRY_LDAP_ORG')
AUTH_LDAP_SENTRY_ORGANIZATION_MEMBER_TYPE = "member"
AUTH_LDAP_SENTRY_ORGANIZATION_GLOBAL_ACCESS = True
AUTH_LDAP_SENTRY_SUBSCRIBE_BY_DEFAULT = False
AUTH_LDAP_DEFAULT_EMAIL_DOMAIN = "example.com"

AUTH_LDAP_SERVER_URI = env('SENTRY_AUTH_LDAP_SERVER_URI')
AUTH_LDAP_BIND_DN = env('SENTRY_AUTH_LDAP_BIND_DN')
AUTH_LDAP_BIND_PASSWORD = env('SENTRY_AUTH_LDAP_BIND_PASSWORD')

AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=users,dc=example,dc=com",
                                   ldap.SCOPE_SUBTREE,
                                   "(uid=%(user)s)")
AUTH_LDAP_USER_ATTR_MAP = {
    'name': 'displayName',
    'email': 'mail'
}

AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_DEBUG_LEVEL: 0,
    ldap.OPT_REFERRALS: 0,
}

AUTHENTICATION_BACKENDS = AUTHENTICATION_BACKENDS + (
    'sentry_ldap_auth.backend.SentryLdapBackend',
)

Here are some suggestions for you to debug:

• Add some log and run sentry, to see how it works and where it fails.
• Query the auth_user table to see if user were added to database

Sentry will check if user in any organization, If you received No Organization Aceess, make sure your organizations contains the value of AUTH_LDAP_DEFAULT_SENTRY_ORGANIZATION.