pyramid_multildap API

Configuration

pyramid_multildap.ldap_set_login_query(config, base_dn, filter_tmpl, scope=None, cache_period=0, attrlist=None, search_after_bind=False, realm='')

Configurator method to set the LDAP login search.

• base_dn: the DN at which to begin the search [mandatory]
• filter_tmpl: an LDAP search filter [mandatory]

At least one of these parameters should contain the replacement value %(login)s

• scope: A valid ldap search scope default: ldap.SCOPE_ONELEVEL
• cache_period: the number of seconds to cache login search results if 0, results will not be cached default: 0
• search_after_bind: do a base search on the entry itself after a successful bind
• realm: A connection identifier default: ''

Example:

config.set_ldap_login_query(
    base_dn='CN=Users,DC=example,DC=com',
    filter_tmpl='(sAMAccountName=%(login)s)',
    scope=ldap.SCOPE_ONELEVEL,
    )

The registered search must return one and only one value to be considered a valid login.

If the filter_tmpl is empty, the directory will not be searched, and the entry dn will be assumed to be equal to the %(login)s-replaced base_dn, and no entry’s attribute will be fetched from the LDAP server, leading to faster operation. Both in this case, and in the case of servers configured to only allow reading some needed entry’s attribute only to the bound entry itself, search_after_bind can be set to True if there is a need to read the entry’s attribute.

Example:

config.set_ldap_login_query(
    base_dn='sAMAccountName=%(login)s,CN=Users,DC=example,DC=com',
    filter_tmpl=''
    scope=ldap.SCOPE_ONELEVEL,
    search_after_bind=True
    )

pyramid_multildap.ldap_set_groups_query(config, base_dn, filter_tmpl, attrlist=('', ), scope=None, cache_period=0, realm='')

Configurator method to set the LDAP groups search.

• base_dn: the DN at which to begin the search [mandatory]
• filter_tmpl: a string which can be used as an LDAP filter: it should contain the replacement value %(userdn)s [mandatory]
• scope: A valid ldap search scope default: ldap.SCOPE_SUBTREE
• cache_period: the number of seconds to cache login search results if 0, results will not be cached default: 0
• realm: A connection identifier default: ''

Example:

config.set_ldap_groups_query(
    base_dn='CN=Users,DC=example,DC=com',
    filter_tmpl='(&(objectCategory=group)(member=%(userdn)s))'
    scope=ldap.SCOPE_SUBTREE,
    )

pyramid_multildap.ldap_setup(config, uri, bind=None, passwd=None, pool_size=10, retry_max=3, retry_delay=0.1, use_tls=False, timeout=-1, use_pool=True, realm='')

Configurator method to set up an LDAP connection pool.

• uri: ldap server uri [mandatory]

• bind: default bind that will be used to bind a connector. default: None

• passwd: default password that will be used to bind a connector. default: None

• size: pool size. default: 10

• retry_max: number of attempts when a server is down. default: 3

• retry_delay: delay in seconds before a retry. default: .1

• use_tls: activate TLS when connecting. default: False

• timeout: connector timeout. default: -1

• use_pool: activates the pool. If False, will recreate a connector

  each time. default: True

• realm: A connection identifier default: ''

pyramid_multildap.includeme(config)

Set up Configurator methods for pyramid_ldap

Usage

pyramid_multildap.get_ldap_connector(request, realm='')

Return the LDAP connector attached to the request for the connection identified by the realm name. If pyramid.config.Configurator.ldap_setup() was not called for the named realm, using this function will raise an pyramid.exceptions.ConfigurationError.

class pyramid_multildap.Connector(registry, manager, realm='')

Provides API methods for accessing LDAP authentication information.

manager

An ldappool ConnectionManager instance that can be used to perform arbitrary LDAP queries. See https://github.com/mozilla-services/ldappool

authenticate(login='', password='')

Given a login name and a password, return a tuple of (dn, attrdict) if the matching user if the user exists and his password is correct. Otherwise return None.

In a (dn, attrdict) return value, dn will be the distinguished name of the authenticated user. Attrdict will be a dictionary mapping LDAP user attributes to sequences of values. The keys and values in the dictionary values provided will be decoded from UTF-8, recursively, where possible. The dictionary returned is a case-insensitive dictionary implementation.

A zero length password will always be considered invalid since it results in a request for “unauthenticated authentication” which should not be used for LDAP based authentication. See section 5.1.2 of RFC-4513 for a description of this behavior.

If pyramid.config.Configurator.ldap_set_login_query() was not called, using this function will raise an pyramid.exceptions.ConfiguratorError.

user_groups(userdn)

Given a user DN, return a sequence of LDAP attribute dictionaries matching the groups of which the DN is a member. If the DN does not exist, return None.

In a return value [(dn, attrdict), ...], dn will be the distinguished name of the group. Attrdict will be a dictionary mapping LDAP group attributes to sequences of values. The keys and values in the dictionary values provided will be decoded from UTF-8, recursively, where possible. The dictionary returned is a case-insensitive dictionary implemenation.

If pyramid.config.Configurator.ldap_set_groups_query() was not called, using this function will raise an pyramid.exceptions.ConfiguratorError

pyramid_multildap.groupfinder(userdn, request)

A groupfinder implementation useful in conjunction with out-of-the-box Pyramid authentication policies. It returns the DN of each group belonging to the user specified by userdn to as a principal in the list of results; if the user does not exist, it returns None.