LDAP for openedx

Tutor
3

Hello,
Starting from @ak00001 answer, we managed to get LDAP authentication working, the proposed solution is for Eucalyptus and the code have changed a bit on juniper.
Following solution is tested on open-release/juniper.3

  • First, add following pip packages : libsasl2-dev python-dev libldap2-dev libssl-dev python-ldap django-auth-ldap, using a Tutor plugin or directly on the Makefile

  • Then, you need to add following configuration to you settings.py, on Kubernetes it’s the configmap lms-settings
    from django_auth_ldap.config import ldap
    from django_auth_ldap.config import LDAPSearch
    AUTH_LDAP_SERVER_URI = ‘ldap://server-domain’

    AUTH_LDAP_BIND_DN = ‘cn=yourbindcn,dc=xxxx,dc=yyy’

    AUTH_LDAP_BIND_PASSWORD = ‘mypassword’

    AUTH_LDAP_USER_SEARCH = LDAPSearch(
    ‘dc=xxxxx,dc=yyy’,
    ldap.SCOPE_SUBTREE,
    ‘(&(objectClass=yourUserClass)(mail=%(user)s))’,
    )

    AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_DEBUG_LEVEL: 1,
    ldap.OPT_REFERRALS: 0
    }

    Populate the Django user from the LDAP directory.

    AUTH_LDAP_USER_ATTR_MAP = {
    ‘username’: ‘mail’,
    ‘first_name’: ‘givenName’,
    ‘last_name’: ‘sn’,
    ‘email’: ‘mail’,
    }
    AUTHENTICATION_BACKENDS.append(‘django_auth_ldap.backend.LDAPBackend’)
    AUTHENTICATION_BACKENDS.append(‘django.contrib.auth.backends.ModelBackend’)
    AUTH_LDAP_ALWAYS_UPDATE_USER = True
    AUTH_LDAP_BIND_AS_AUTHENTICATING_USER = True

  • Finally, edit edx-platform/openedx/core/djangoapps/user_authn/login.py
    After :
    if not is_user_third_party_authenticated:
    possibly_authenticated_user = _authenticate_first_party(request, user, third_party_auth_requested)

add code :
if possibly_authenticated_user is None:
possibly_authenticated_user = authenticate(username=request.POST.get(‘email’), password=request.POST.get(‘password’), request=request)

we use request.POST.get(‘email’) since edx is trying to authenticate with username after getting the user by email.

and it’s all !

2 Likes