How to setup django-auth-ldap for SSO?

ljf · December 22, 2020, 11:51am

Nothing, it should be ssowat that add this header. If you configure it with a classic permission (no skipped_uri)

jedie · December 22, 2020, 12:02pm

Okay. I’m fine with that… Without it i get:

'HTTP_AUTHORIZATION': 'Basic XXXXXXXXXXXXXXXX=',
'HTTP_AUTH_USER': 'foo',
'HTTP_REMOTE_USER': 'foo',

jedie · December 22, 2020, 1:10pm

Hm! btw. there are the basic auth header like:

'HTTP_AUTHORIZATION': 'Basic XXXXXXXXXXXXXXXX='

It contains username and password as plain text! So i assume that the user passwors is also stored by SSOwat in plaintext?!? Really?

EDIT: Ah! It seems that it’s only stored in plaintext in the cache:

github.com

YunoHost/SSOwat/blob/0704973f598a57747cc1b50643a96b2aed09068f/helpers.lua#L380-L387


-- If we are connected, we can retrieve the password and put it in the
-- cache shared table in order to eventually reuse it later when updating
-- profile information or just passing credentials to an application.
if connected then
    if conf['ldap_enforce_crypt'] then
        ensure_user_password_uses_strong_hash(connected, user, password)
    end
    cache:add(user.."-password", password, conf["session_timeout"])

But it’s a little strange…

jedie · December 22, 2020, 4:20pm

OK, i’m ready!

I set no $remote_user heade in nginx.conf
I refactor the remove user middleware/authentication backend

Now a user logged in via SSO is logged in directly in the app.
Email, first/last name will be updated in django user model, too.

So i removed django-auth-ldap, because it’s now obsolete.

jedie · December 23, 2020, 8:03am

Think i will create a “django_ynh” app (next week) that will contain all needed stuff to combine a django project to a YunoHost app…

Because i use the same code parts in two projects:

ljf · December 23, 2020, 10:55am

It might be a new helper that add this file: you can add suggestion here: https://github.com/YunoHost-Apps/Experimental_helpers

jedie · December 23, 2020, 7:06pm

But there are only shell scripts, isn’t it?

I started the project here:

https://github.com/YunoHost-Apps/django_ynh

But it’s currently totaly broken and unuseable… Think i can work on it after xmas and if it’s ready i will use it in my both projects:

oncletom · December 30, 2020, 9:38pm

Thanks for sharing

I made it work too, by using the HTTP_EMAIL Django header. I use gunicorn — I did not get how to forward the EMAIL http header without it being prefixed by HTTP_.

I still have to modify the third-party app settings/base.py to register the middlewares but I’m making progress.

jedie · January 4, 2021, 10:00am

Yes, the settings.py must be modified, see: https://github.com/YunoHost-Apps/django_ynh#usage