User CN name lookup with specific query

[mateuszboryn]

User CN name lookup with specific query and (non)anonymous ActiveDirectory search account.

[3cham]

+1 for this PR

[jhereth]

Escaping filter chars from userdn can make the valid userdn invalid, e.g. escaping "(" or ")" which are valid characters for this parameter.

[mateuszboryn]

Actually I had problem with ldap3.Connection() for non-escaped '(' and ')'. At least for Active Directory - I don't know how it would work for other implementations.
In my case ldap3.Connection().bind() failed with error message saying claiming that authentication failed when user parameter had '(' or ')' in it.

[jhereth]

Fascinating. For us it was the inverse - we had to remove the escaping because the escaped parentheses caused problems. We're using AD, too.

According to https://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx '(' and ')' do not belong to the characters to be escaped.

[laurikoobas]

For us it requires to be without the "escape_filter_chars()" function. We have usernames that have a dash in them, like foo-bar. Does not work with the escape wrapper, but does work without it.

[jhereth]

Other than my comment regarding "escape_filter_char": +1

Thanks @mateuszboryn , this was very helpful for our project.

[beenje]

Thanks for this pull request! It allowed me to make this plugin work with our Active Directory server.
I had to use the following config:

c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
c.LDAPAuthenticator.server_address = 'myserver'
c.LDAPAuthenticator.bind_dn_template = '{username}'
c.LDAPAuthenticator.lookup_dn = True
c.LDAPAuthenticator.lookup_dn_search_filter = '({login_attr}={login})'
c.LDAPAuthenticator.lookup_dn_search_user = 'ldap_search_user'
c.LDAPAuthenticator.lookup_dn_search_password = 'secret'
c.LDAPAuthenticator.user_search_base = 'OU=Users,DC=company,DC=com'
c.LDAPAuthenticator.user_attribute = 'sAMAccountName'
c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'cn'

It would be nice to have this merged.
Anything I can do to help this happen?

[laurikoobas]

Worked for us as well, please merge this (without the escape_filter_chars() part).

[mateuszboryn]

I'm going to add new parameter that controls escape_filter_chars(). I think this will quick solution.

[mateuszboryn]

Escaping userdn fixed. Now there is an option that enables escaping. This new option defaults to False.

[DrewRay]

will this be added to the main repo? looks like a solid idea/improvement.

[beenje]

@mateuszboryn, I thought I could just use c.LDAPAuthenticator.bind_dn_template = '{username}' but that doesn't work for all users. We still have to provide a list of bind_dn_template based on the CN retrieved. This is not convenient with our setup.
I did some tests with ldap3 and realised that we could get the user dn from the search result: conn.response[0]['dn']
I could just use that directly instead of retrieving the cn and then building the dn based on cn and bind_dn_template. I don't know much about LDAP. So this is maybe specific to AD?
Any reason you didn't go that way?

[pratik705]

I tried using updated "ldapauthenticator.py" file(https:////raw.githubusercontent.com/mateuszboryn/ldapauthenticator/ebbdfdbeaa199b08ebd00ac31c6904969080411d/ldapauthenticator/ldapauthenticator.py). But, I am unable to connect AD.

Configuration details:
$ /usr/local/bin/jupyterhub --version
0.7.2

c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
c.LDAPAuthenticator.server_address = 'IP of AD'
c.LDAPAuthenticator.bind_dn_template = '{username}'
c.LDAPAuthenticator.lookup_dn = True
c.LDAPAuthenticator.use_ssl = False
c.LDAPAuthenticator.lookup_dn_search_filter = '({login_attr}={login})'
c.LDAPAuthenticator.lookup_dn_search_user = 'username to connect AD'
c.LDAPAuthenticator.lookup_dn_search_password = 'password to connect AD'
c.LDAPAuthenticator.user_search_base = 'CN=Users,DC=abc,DC=xyz'
c.LDAPAuthenticator.user_attribute = 'sAMAccountName'
c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'cn

It fails with :

[W 2017-05-18 10:45:34.892 JupyterHub ldapauthenticator:231] Can't connect to LDAP
[D 2017-05-18 10:45:34.892 JupyterHub login:95] Failed login for test_user

From the same server, I am able to fetch list of users with ldapsearch command.

Is there anything wrong in the configuration ?

[pratik705]

ok. Its working with below configuration:

c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
c.LDAPAuthenticator.server_address = 'xyz'
c.LDAPAuthenticator.bind_dn_template = 'CN={username},CN=abc,DC=abc,DC=abc'
c.LDAPAuthenticator.lookup_dn = True
c.LDAPAuthenticator.use_ssl = False
c.LDAPAuthenticator.lookup_dn_search_filter = '({login_attr}={login})'
c.LDAPAuthenticator.lookup_dn_search_user = 'abc'
c.LDAPAuthenticator.lookup_dn_search_password = 'abc'
c.LDAPAuthenticator.user_search_base = 'DC=abc,DC=abc'
c.LDAPAuthenticator.user_attribute = 'sAMAccountName'
c.LDAPAuthenticator.lookup_dn_user_dn_attribute = 'cn'

When the changes will be merged in master branch?

---

But, I need to manually create user on local system. If its not there then it fails with :

KeyError: 'getpwnam(): name not found: test-user'

any suggestion ?

---

[efaurie]

@mateuszboryn thanks for this PR it's exactly what I needed. I can verify that I got this working as expected.

@pbandark I used a combination of the changes proposed in this PR and those in PR#36. Combining them I was able to get both LDAP and the local user creation working.

[pratik705]

@efaurie thanks for reply. Yes. It started working for me after combining PR#36

[minrk]

Thanks! Sorry for the delays on this repo.

[ixxie]

@beenje - did you get it to work by using something like realmd to automatically create user accounts on the Linux system?

I am kind of at a loss as to why one would even use this plugin otherwise, since PR #36 wasn't accepted and it is recommended to use something like realmd to link up SSSD with the LDAP directory. It would be helpful to explain this clearly in the documentation, especially once this PR is released; explicit instructions for setting up Active Directory would also be handy for many I believe.

Edit: I just saw there is some explanation of AD on the README, but it was just added today (sorry I missed it!)

[beenje]

@ixxie I currently use my own fork: beenje@0c0583e

Now that this was merged, I might try to submit a pull request.