2

I'm using django-auth-ldap (v1.1.4) to allow users in an LDAP directory to log in to my Django web application. This works very well, however, I would also like my users to be able to access some static resources via their Django credentials, including LDAP logins.

I'm following the pattern documented in this page of the Django documentation, using a WSGI authentication script to allow users in.

The issue I'm having is that my WSGI script appears to invoke the check_password method of the authentication provider of choice. This works fine for pure Django users, but LDAP users are out of luck, since their password is blank in the Django database.

This results in a 401 Unauthorized error on static resources, even with valid LDAP credentials. In the logs, Apache reports a password mismatch, since the (valid) entered password doesn't match a null string.

Meanwhile, users who are in Django's main authentication database are able to access the resources without a problem.

Here's a sanitised version of my Apache directives for the static resources:

<Location "/secure/">  
    AuthType Basic  
    AuthName "Authentication Required"
    Require valid-user  
    AuthBasicProvider wsgi  
    WSGIAuthUserScript /path/myapp/wsgi.py  
</Location>

Here's what's in '/path/myapp/wsgi.py':

import os
import os, sys
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "myapp.settings")

from django.contrib.auth.handlers.modwsgi import check_password
from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()

I realise that a possible workaround would be to have Apache bind directly to the LDAP, but this would lock out my non-LDAP Django users from accessing the static resources.

I'm using Django 1.5.1 and Apache 2 (point something).

Thanks in advance for any assistance.

grw
  • 1,279
  • 1
  • 11
  • 19
  • A colleague suggested that a reasonable workaround is to add LDAP to the AuthBasicProvider line, meaning that it reads: AuthBasicProvider ldap wsgi This ensures that Apache tries the LDAP first, and then fails over to the Django authentication provider if authentication fails there. This is good in my case, since I only have to solve the problem for LDAp, but doesn't solve the more general issue of 'generic' passwordless login mechanisms not being compatible with the wsgi.py auth script. Suggestions for a solution which allows valid, 'passwordless' logins to succeed would be appreciated. – grw Nov 11 '13 at 11:12
  • That is not a mod_wsgi issue, but how authentication providers work in Apache, with mod_wsgi only implementing the Apache mechanism. That is, authentication providers callbacks for checking passwords are only triggered if the appropriate authentication headers exist in the request in the first place. You better explain more what you mean by password less logins. – Graham Dumpleton Nov 11 '13 at 22:30

0 Answers0