7acd0558f5
* backchannel applications Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add webui Signed-off-by: Jens Langhammer <jens@goauthentik.io> * include assigned app in provider Signed-off-by: Jens Langhammer <jens@goauthentik.io> * improve backchannel provider list display Signed-off-by: Jens Langhammer <jens@goauthentik.io> * make ldap provider compatible Signed-off-by: Jens Langhammer <jens@goauthentik.io> * show backchannel providers in app view Signed-off-by: Jens Langhammer <jens@goauthentik.io> * make backchannel required for SCIM Signed-off-by: Jens Langhammer <jens@goauthentik.io> * cleanup api Signed-off-by: Jens Langhammer <jens@goauthentik.io> * update docs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix tests Signed-off-by: Jens Langhammer <jens@goauthentik.io> * Apply suggestions from code review Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens L. <jens@beryju.org> * update docs Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Jens L. <jens@beryju.org> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
99 lines
3.0 KiB
Python
99 lines
3.0 KiB
Python
"""LDAP Provider"""
|
|
from typing import Iterable, Optional
|
|
|
|
from django.db import models
|
|
from django.utils.translation import gettext_lazy as _
|
|
from rest_framework.serializers import Serializer
|
|
|
|
from authentik.core.models import BackchannelProvider, Group
|
|
from authentik.crypto.models import CertificateKeyPair
|
|
from authentik.outposts.models import OutpostModel
|
|
|
|
|
|
class APIAccessMode(models.TextChoices):
|
|
"""API Access modes"""
|
|
|
|
DIRECT = "direct"
|
|
CACHED = "cached"
|
|
|
|
|
|
class LDAPProvider(OutpostModel, BackchannelProvider):
|
|
"""Allow applications to authenticate against authentik's users using LDAP."""
|
|
|
|
base_dn = models.TextField(
|
|
default="DC=ldap,DC=goauthentik,DC=io",
|
|
help_text=_("DN under which objects are accessible."),
|
|
)
|
|
|
|
search_group = models.ForeignKey(
|
|
Group,
|
|
null=True,
|
|
default=None,
|
|
on_delete=models.SET_DEFAULT,
|
|
help_text=_(
|
|
"Users in this group can do search queries. "
|
|
"If not set, every user can execute search queries."
|
|
),
|
|
)
|
|
|
|
tls_server_name = models.TextField(
|
|
default="",
|
|
blank=True,
|
|
)
|
|
certificate = models.ForeignKey(
|
|
CertificateKeyPair,
|
|
on_delete=models.SET_NULL,
|
|
null=True,
|
|
blank=True,
|
|
)
|
|
|
|
uid_start_number = models.IntegerField(
|
|
default=2000,
|
|
help_text=_(
|
|
"The start for uidNumbers, this number is added to the user.Pk to make sure that the "
|
|
"numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't "
|
|
"collide with local users uidNumber"
|
|
),
|
|
)
|
|
|
|
gid_start_number = models.IntegerField(
|
|
default=4000,
|
|
help_text=_(
|
|
"The start for gidNumbers, this number is added to a number generated from the "
|
|
"group.Pk to make sure that the numbers aren't too low for POSIX groups. Default "
|
|
"is 4000 to ensure that we don't collide with local groups or users "
|
|
"primary groups gidNumber"
|
|
),
|
|
)
|
|
|
|
bind_mode = models.TextField(default=APIAccessMode.DIRECT, choices=APIAccessMode.choices)
|
|
search_mode = models.TextField(default=APIAccessMode.DIRECT, choices=APIAccessMode.choices)
|
|
|
|
@property
|
|
def launch_url(self) -> Optional[str]:
|
|
"""LDAP never has a launch URL"""
|
|
return None
|
|
|
|
@property
|
|
def component(self) -> str:
|
|
return "ak-provider-ldap-form"
|
|
|
|
@property
|
|
def serializer(self) -> type[Serializer]:
|
|
from authentik.providers.ldap.api import LDAPProviderSerializer
|
|
|
|
return LDAPProviderSerializer
|
|
|
|
def __str__(self):
|
|
return f"LDAP Provider {self.name}"
|
|
|
|
def get_required_objects(self) -> Iterable[models.Model | str]:
|
|
required_models = [self, "authentik_core.view_user", "authentik_core.view_group"]
|
|
if self.certificate is not None:
|
|
required_models.append(self.certificate)
|
|
return required_models
|
|
|
|
class Meta:
|
|
verbose_name = _("LDAP Provider")
|
|
verbose_name_plural = _("LDAP Providers")
|