Setting up LDAP authentication

Hi, I’ve enabled the LDAP authentication using environment variables, in the latest docker image (as of 21 Nov 2020), and can’t get the LDAP function to work. I don’t see any debug information in the docker logs that says that the LDAP is working or not, only one line that states:

"Enabling basic authentication strategy."
"Enabling ldap authentication strategy."
"Enabling local authentication strategy."

However, upon attempting to log in a (known valid) user’s details, there is just an “invalid username / password” message appearing in a pink box on the site, and no additional output in the debug file (i.e. did it find the LDAP server Ok, did it log in Ok, did it find the name, etc…).

Any help would be appreciated. I’ve configured both PAM authentication with LDAP, and other apps succesfully, using the following settings:

          SQLPAD_LDAP_AUTH_ENABLED: 'true'
          SQLPAD_LDAP_URL: 'ldap://192.168.0.101:389'
          SQLPAD_LDAP_SEARCH_BASE: 'ou=Users,dc=amt,dc=com'
          SQLPAD_LDAP_BIND_DN: 'cn=admin,dc=amt,dc=com'
          SQLPAD_LDAP_PASSWORD: '****************'
          SQLPAD_LDAP_SEARCH_FILTER: '(uid={{username}})'

This is connecting to an OpenLDAP server that is on the same private LAN. TLS is not enabled on the LDAP.

[rickbergfalk]

I just merged a change to how LDAP will be working for you @euanmacinnes. I’ve decided to add an ldap_id column to SQLPad’s users table to store profile uid/sAMAccountName depending on LDAP platform used. SQLPad’s users email column is now nullable, and ldap_id will be used as a secondary lookup in the event email is missing.

For now the LDAP login will also check for uid/sAMAccountName in the users.email column when trying to find the user in SQLPad’s database, so there shouldn’t be an impact… but just in case you see any wonky behavior it could be behind these changes.

I’ve updated LDAP tests to cover what I could, but I didn’t go as far as to stand up an LDAP server with missing mail attributes.

[euanmacinnes]

It’s intended for mail not to be set, primarily for corporate security reasons.

On Mon, 30 Nov 2020 at 14:51, Rick Bergfalk [e-mail] wrote:

@euanmacinnes https://github.com/euanmacinnes curious as to why your LDAP setup is missing the mail attribute. Was this just for testing purposes or was it intended for mail not to be set?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/sqlpad/sqlpad/issues/898#issuecomment-735589129, or unsubscribe https://github.com/notifications/unsubscribe-auth/ANAKPNSDT4SJHTPUCOWSND3SSM6GTANCNFSM4T5RAHNQ .