Django: Unable to get user's groups from LDAP user

Question

My Django ( Django 1.11) project is using django-auth-ldap 1.2 as authentication backed.

I have no problem to authenticate any user agents LDAP database using:

@login_required(login_url='/accounts/login/')

and in this case, any user from any group can login to the site.

I want to allow only user from 'group1' to be able to access the website. I used the code listed below

from django.shortcuts import render
from django.template import loader
from django.http import HttpResponse
from django.contrib.auth.decorators import login_required
from django.contrib.auth import views as auth_views
  @user_passes_test(
            lambda u: hasattr(u, 'ldap_user') and 'group1' in u.ldap_user.group_names,
            login_url='/accounts/login/')
    def index(request):
        template = loader.get_template('main/index.html')
        return HttpResponse(template.render())

This is code is not working and user will never pass the test. According to the model documents django-auth-ldap Document I can use ldap_user.group_names to get group names of a user.

Here is my ldap settings from settings.py:

import os
import django



AUTHENTICATION_BACKENDS = ('django_auth_ldap.backend.LDAPBackend',)

import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType


AUTH_LDAP_SERVER_URI = "ldap://mydomain.com"

AUTH_LDAP_BIND_DN = "cn=admin,dc=mydomain,dc=com"

AUTH_LDAP_BIND_PASSWORD = "mypass"

AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=ou_org_unit,dc=mydomain,dc=com",
ldap.SCOPE_SUBTREE, "(uid=%(user)s)")

AUTH_LDAP_GROUP_SEARCH = LDAPSearch("ou=ou_org_unit,cn=group1,cn=group2,dc=mydomain,dc=com",
    ldap.SCOPE_SUBTREE, "(objectClass=groupOfNames)"
)

AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail"
}

AUTH_LDAP_FIND_GROUP_PERMS = True
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600

My question is: Why I am not able to authenticate any user with this code?

score 2 · Answer 1 · answered Jun 01 '18 at 01:46

You should be using the AUTH_LDAP_REQUIRE_GROUP setting if you want to restrict logins to a single group.

You will also likely want to use AUTH_LDAP_MIRROR_GROUPS in order to have all of your LDAP groups automatically loaded into your Django database.

As a bonus, you can include multiple groups in the AUTH_LDAP_REQUIRE_GROUP setting, by using the LDAPGroupQuery class. For example (taken from the documentation):

from django_auth_ldap.config import LDAPGroupQuery

AUTH_LDAP_REQUIRE_GROUP = (
    (
        LDAPGroupQuery("cn=enabled,ou=groups,dc=example,dc=com") |
        LDAPGroupQuery("cn=also_enabled,ou=groups,dc=example,dc=com")
    ) &
    ~LDAPGroupQuery("cn=disabled,ou=groups,dc=example,dc=com")
)

Django: Unable to get user's groups from LDAP user

1 Answers1