forked from ungleich-public/ungleich-user
python-ldap is a C extension that needs the OpenLDAP headers to build (and needed a workaround in the Dockerfile). ldap3, which the app already used for all writes, is pure Python. dal.backends.LdapBackend keeps the django-auth-ldap behaviour: search the uid in every LDAPSEARCH base as the admin DN, require exactly one match, log in with the user's DN, and mirror givenName, sn and mail into the local Django user. Empty passwords are rejected (LDAP treats them as anonymous logins, which succeed). LDAP_USE_TLS now applies StartTLS to every connection, including the admin connection used for writes, not just logins.
207 lines
5.4 KiB
Python
207 lines
5.4 KiB
Python
"""
|
|
Django settings for dal project.
|
|
|
|
Generated by 'django-admin startproject' using Django 1.10.7.
|
|
|
|
For more information on this file, see
|
|
https://docs.djangoproject.com/en/1.10/topics/settings/
|
|
|
|
For the full list of settings and their values, see
|
|
https://docs.djangoproject.com/en/1.10/ref/settings/
|
|
"""
|
|
|
|
import os
|
|
from decouple import config, Csv
|
|
|
|
# LDAP setup
|
|
LDAP_SERVER = config('LDAP_SERVER')
|
|
AUTH_LDAP_SERVER = config('LDAPSERVER')
|
|
|
|
LDAP_ADMIN_DN = config('LDAP_ADMIN_DN')
|
|
LDAP_ADMIN_PASSWORD = config('LDAP_ADMIN_PASSWORD')
|
|
|
|
LDAP_CUSTOMER_DN = config('LDAP_CUSTOMER_DN')
|
|
LDAP_USERS_DN = config('LDAP_USERS_DN')
|
|
LDAP_CUSTOMER_GROUP_ID = config('LDAP_CUSTOMER_GROUP_ID', cast=int)
|
|
|
|
LDAP_DEFAULT_START_UID = config('LDAP_DEFAULT_START_UID', cast=int)
|
|
|
|
# Users log in from any of these (space separated) search bases.
|
|
LDAP_SEARCH_BASES = config('LDAPSEARCH').split()
|
|
|
|
# StartTLS on every connection (use ldaps:// URIs for implicit TLS).
|
|
LDAP_USE_TLS = config('LDAP_USE_TLS', default=False, cast=bool)
|
|
|
|
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
|
|
DEBUG = config('DEBUG', default=False, cast=bool)
|
|
|
|
EMAIL_FROM_ADDRESS = config('EMAIL_FROM_ADDRESS')
|
|
|
|
EMAIL_HOST = config("EMAIL_HOST", default="localhost")
|
|
EMAIL_PORT = config("EMAIL_PORT", default=25, cast=int)
|
|
EMAIL_USE_TLS = config("EMAIL_USE_TLS", default=True, cast=bool)
|
|
|
|
ALLOWED_HOSTS = config('ALLOWED_HOSTS', cast=Csv())
|
|
|
|
INSTALLED_APPS = [
|
|
'django.contrib.admin',
|
|
'django.contrib.auth',
|
|
'django.contrib.contenttypes',
|
|
'django.contrib.sessions',
|
|
'django.contrib.messages',
|
|
'django.contrib.staticfiles',
|
|
'bootstrap3',
|
|
'dal',
|
|
'rest_framework'
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
'django.middleware.security.SecurityMiddleware',
|
|
'django.contrib.sessions.middleware.SessionMiddleware',
|
|
'django.middleware.common.CommonMiddleware',
|
|
'django.middleware.csrf.CsrfViewMiddleware',
|
|
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
'django.contrib.messages.middleware.MessageMiddleware',
|
|
'django.middleware.clickjacking.XFrameOptionsMiddleware',
|
|
]
|
|
|
|
AUTHENTICATION_BACKENDS = (
|
|
'dal.backends.LdapBackend',
|
|
)
|
|
|
|
|
|
ROOT_URLCONF = 'dal.urls'
|
|
|
|
TEMPLATES = [
|
|
{
|
|
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
|
'DIRS': [],
|
|
'APP_DIRS': True,
|
|
'OPTIONS': {
|
|
'context_processors': [
|
|
'django.template.context_processors.debug',
|
|
'django.template.context_processors.request',
|
|
'django.contrib.auth.context_processors.auth',
|
|
'django.contrib.messages.context_processors.messages',
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = 'dal.wsgi.application'
|
|
|
|
# Password validation
|
|
# https://docs.djangoproject.com/en/1.10/ref/settings/#auth-password-validators
|
|
|
|
AUTH_PASSWORD_VALIDATORS = [
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
|
|
},
|
|
{
|
|
'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
|
|
},
|
|
]
|
|
|
|
|
|
# Internationalization
|
|
# https://docs.djangoproject.com/en/1.10/topics/i18n/
|
|
|
|
LANGUAGE_CODE = 'en-us'
|
|
|
|
TIME_ZONE = 'UTC'
|
|
|
|
USE_I18N = True
|
|
|
|
USE_TZ = True
|
|
|
|
|
|
# Static files (CSS, JavaScript, Images)
|
|
# https://docs.djangoproject.com/en/1.10/howto/static-files/
|
|
|
|
STATIC_URL = '/static/'
|
|
|
|
############################# To be fixed
|
|
|
|
STATIC_ROOT= os.path.join(BASE_DIR, 'static/')
|
|
|
|
# Database
|
|
# https://docs.djangoproject.com/en/1.10/ref/settings/#databases
|
|
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.sqlite3',
|
|
'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
|
|
}
|
|
}
|
|
SECRET_KEY = config('SECRET_KEY')
|
|
|
|
# Keep 32-bit ids: existing tables were created with AutoField.
|
|
DEFAULT_AUTO_FIELD = 'django.db.models.AutoField'
|
|
|
|
AUTH_LDAP_USER_ATTR_MAP = {
|
|
"first_name": "givenName",
|
|
"last_name": "sn",
|
|
"email": "mail"
|
|
}
|
|
|
|
ENTIRE_SEARCH_BASE = config("ENTIRE_SEARCH_BASE")
|
|
|
|
LOGGING = {
|
|
'disable_existing_loggers': False,
|
|
'version': 1,
|
|
'formatters': {
|
|
'standard': {
|
|
'format': '%(asctime)s %(levelname)s %(name)s %(funcName)s %(lineno)d: %(message)s'
|
|
}
|
|
},
|
|
'handlers': {
|
|
'default': {
|
|
'level': 'DEBUG',
|
|
'class': 'logging.handlers.RotatingFileHandler',
|
|
'filename': 'logs/debug.log',
|
|
'maxBytes': 1024*1024*5,
|
|
'backupCount': 10,
|
|
'formatter': 'standard',
|
|
},
|
|
'console': {
|
|
'class': 'logging.StreamHandler',
|
|
},
|
|
},
|
|
}
|
|
|
|
if config('ENABLE_DEBUG_LOG', default=False, cast=bool):
|
|
loggers_dict = {}
|
|
modules_to_log_list = config(
|
|
'MODULES_TO_LOG', default='django', cast=Csv()
|
|
)
|
|
for custom_module in modules_to_log_list:
|
|
logger_item = {
|
|
custom_module: {
|
|
'handlers': ['default'],
|
|
'level': 'INFO',
|
|
'propagate': True
|
|
}
|
|
}
|
|
loggers_dict.update(logger_item)
|
|
|
|
LOGGING['loggers'] = loggers_dict
|
|
|
|
if 'ldap3' in modules_to_log_list:
|
|
from ldap3.utils.log import (
|
|
set_library_log_detail_level, OFF, BASIC, NETWORK, EXTENDED
|
|
)
|
|
set_library_log_detail_level(BASIC)
|
|
|
|
|
|
REST_FRAMEWORK = {
|
|
'DEFAULT_RENDERER_CLASSES': (
|
|
'rest_framework.renderers.JSONRenderer',
|
|
)
|
|
}
|