I can see a few people seem to have had success setting up askbot to authenticate against active directory but I'm having trouble with it, could anyone clarify how these fields should be used:
LDAP service provider name: I tried "Active Directory"
URL for LPAP service: I tried "ldap://10.23.2.1:389"
Explain how to change pwd: left blank
With these settings I get an Internal Server Error, and nothing inserted into the log.
I've been fighting LDAP for a bit here, and found a couple tricks that helped me out.
First, if your LDAP requires authentication, just add this to your settings.py:
LDAP_LOGIN_DN = 'someldapuser'
LDAP_PASSWORD = 'somepassword'
Fill in the ldap read username/password.
Also, make sure to use the current git repository instead of the PyPi build, as it is out of date. Make sure that your external_keys.py has ldap, for me even when using git to build I had the out of date version. You can tell as the final setting will be indentica.
After that, go ahead and login with your admin user. Go into settings and configure your LDAP settings, then configure it again under external keys... I'm not sure which takes precedence. Finally, go into login providers and uncheck everything. Then recheck "Always display local login form" and "Activate Local Password Login". Don't worry, that's just going to force it to only use LDAP.
From there, you should be ok. I edited the log level in settings.py to be info for the purpose of getting all configs set correctly.
Hope this helps some others!
Koni's answer does not solve the problem because it does local login, not ldap.
I can't find any good explanation of the use of ldap on the site. Does it work or not? (I think not)
Which version of LDAP protocol are you using? Askbot is hardcoded to work with v3. LDAP support was contributed by somebody else and we have not tested it thoroughly yet. If you have ability to test and debug - please look at the module askbot.deps.django_authopenid.backends.
Looked at the protocol again - it turns out we connect to LDAP without authentication, and if your directory does not allow anonymous lookup of data - it won't work. Also - please do check your log/askbot.log all LDAP errors are logged. Please tell me which one do you have?
I can connect with jxplorer using v3. But I can't make it work with askbot. We have authentication as mandatory, so we can't use it anonymously. There are no logs on the log folder. I am going to debug backends to see what happens
What is the point of using ldap on the login system if you dont use authentication?
On askbot.deps.django_authopenid.backends.py, on the method "ldap_authenticate", I connect to the ldap server and on the line "res = ldap_session.search_s(askbot_settings.LDAP_BASEDN, ldap.SCOPE_SUBTREE, user_filter, None)" fails throwing an exception "{'desc' : 'Bad search filter'}" It looks like its searching on a field called desc which does not exists. It should be "cn" not "desc"
I got it working here: https://github.com/monkut/askbot-devel
I'm not sure if this will cover all LDAP configurations, but it's working for me now. You'll need to adjust the appropriate login configuration items so that the openauth items do NOT display, and to setup the ldap configuration values in settings/EXTERNAL_KEYS.
Only three files need to be updated:
I am using the 3 files from above, but I get: NameError at /account/signin/ global name 'ldap_provider_name' is not defined
Did install pip install python-ldap
Any ideas?
Found the problem! Error in line 329: change to: login_provider_name = provider_name,
I am sorry, LDAP authentication is broken. Marking as bug.
Thanks for the update.
I'm trying to getting it working here, what area of code needs work?
any update here? is ldap authentication still broken?
There is an updated version in the repository which works for us.
Hi, I'm having trouble with LDAP auth. I'm geting this error:
/usr/local/lib/python2.7/dist-packages/askbot-0.7.43-py2.7.egg/askbot/deps/django_authopenid/forms.py TIME: 2012-07-09 14:25:17,267 MSG: forms.py:clean:77 unknown provider name
Ldap in that release is broken, will be fixed in the next.
There are a roadmap or schedule for next release? I get a git repo. If exist a fix I can apply and instal...
I'll make a final fix today and make an update on git today - will let you know. The release may take some extra time, a few days.
Erick, try branch "tag-editor" on the github, LDAP works for me there.
Evgeny, I install this branch. After on LDAP logon method I canot login in the system. The form for "local" register disapear.
Leave local login 'on' and the form will not go away, but will be used for LDAP. I am still working on LDAP option - right now there is a problem - if user changes screen name he/she can't use LDAP any more.
In my case I don't change screen name. But I cleanning a database to a clean test.
If I try login with LDAP username (that not exists in askbot database) I get this message in askbot.log: MSG: forms.py:clean:77 unknown provider name local
I have updated LDAP flow on branch 'tag-editor' again. Works for me. I've tested against this server http://blog.stuartlewis.com/2008/07/07/test-ldap-service/ (really glad that this guy has set it up).
Evgeny, hi. I try this blog but don't work. There any any log for authentication failures?
Comments