From ef7a214dae108351e1e2ae66a51966a639ee90d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= Date: Tue, 21 Jul 2020 08:30:09 +0200 Subject: [PATCH] __netbox: support basic LDAP group mapping --- type/__netbox/files/ldap_config.py.sh | 40 +++++++++++++++++++++++++-- type/__netbox/manifest | 16 +++++++++-- type/__netbox/parameter/optional | 5 +++- 3 files changed, 55 insertions(+), 6 deletions(-) diff --git a/type/__netbox/files/ldap_config.py.sh b/type/__netbox/files/ldap_config.py.sh index 88af4b9..901d6f5 100755 --- a/type/__netbox/files/ldap_config.py.sh +++ b/type/__netbox/files/ldap_config.py.sh @@ -6,7 +6,7 @@ cat << EOF ############################## import ldap -from django_auth_ldap.config import LDAPSearch +from django_auth_ldap.config import LDAPSearch, PosixGroupType # Server URI AUTH_LDAP_SERVER_URI = "$LDAP_SERVER" @@ -15,8 +15,10 @@ AUTH_LDAP_SERVER_URI = "$LDAP_SERVER" AUTH_LDAP_BIND_DN = "$LDAP_BIND_DN" AUTH_LDAP_BIND_PASSWORD = "$LDAP_BIND_PASSWORD" -# If a user's DN is producible from their username, we don't need to search. -AUTH_LDAP_USER_DN_TEMPLATE = "$LDAP_USER_DN_TEMPLATE" +# Search for user entry. +AUTH_LDAP_USER_SEARCH = LDAPSearch("$LDAP_USER_BASE", + ldap.SCOPE_SUBTREE, + "(uid=%(user)s)") # You can map user attributes to Django attributes as so. AUTH_LDAP_USER_ATTR_MAP = { @@ -25,3 +27,35 @@ AUTH_LDAP_USER_ATTR_MAP = { "email": "mail" } EOF + +if [ "$LDAP_GROUP_BASE" != "" ]; then + cat << EOF + +# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group +# hierarchy. +AUTH_LDAP_GROUP_SEARCH = LDAPSearch("$LDAP_GROUP_BASE", ldap.SCOPE_SUBTREE, + "(objectClass=posixGroup)") +AUTH_LDAP_GROUP_TYPE = PosixGroupType() + +# Mirror LDAP group assignments. +AUTH_LDAP_MIRROR_GROUPS = True +EOF + + if [ "$LDAP_REQUIRE_GROUP" != "" ]; then + cat << EOF + +# Define a group required to login. +AUTH_LDAP_REQUIRE_GROUP = "$LDAP_REQUIRE_GROUP" +EOF + fi + + if [ "$LDAP_SUPERUSER_GROUP" != "" ]; then + cat << EOF + +# Define special user types using groups. Exercise great caution when assigning superuser status. +AUTH_LDAP_USER_FLAGS_BY_GROUP = { + "is_superuser": "$LDAP_SUPERUSER_GROUP", +} +EOF + fi +fi diff --git a/type/__netbox/manifest b/type/__netbox/manifest index 2976686..32c85e3 100644 --- a/type/__netbox/manifest +++ b/type/__netbox/manifest @@ -40,8 +40,20 @@ if [ -f "$__object/parameter/ldap-bind-password" ]; then export LDAP_BIND_PASSWORD=$(cat "$__object/parameter/ldap-bind-password") fi -if [ -f "$__object/parameter/ldap-user-dn-template" ]; then - export LDAP_USER_DN_TEMPLATE=$(cat "$__object/parameter/ldap-user-dn-template") +if [ -f "$__object/parameter/ldap-user-base" ]; then + export LDAP_USER_BASE=$(cat "$__object/parameter/ldap-user-base") +fi + +if [ -f "$__object/parameter/ldap-group-base" ]; then + export LDAP_GROUP_BASE=$(cat "$__object/parameter/ldap-group-base") +fi + +if [ -f "$__object/parameter/ldap-require-group" ]; then + export LDAP_REQUIRE_GROUP=$(cat "$__object/parameter/ldap-require-group") +fi + +if [ -f "$__object/parameter/ldap-superuser-group" ]; then + export LDAP_SUPERUSER_GROUP=$(cat "$__object/parameter/ldap-superuser-group") fi # Create system user used to run netbox. diff --git a/type/__netbox/parameter/optional b/type/__netbox/parameter/optional index c946d73..290c98b 100644 --- a/type/__netbox/parameter/optional +++ b/type/__netbox/parameter/optional @@ -1,4 +1,7 @@ ldap-server ldap-bind-dn ldap-bind-password -ldap-user-dn-template +ldap-user-base +ldap-group-base +ldap-require-group +ldap-superuser-group