Cumin and LDAP
by Vladimir Motoska
Hi all,
some time ago we briefly talked to Matthew Farrellee about LDAP authentication.
We created a simple patch to Cumin 0.1.4794 which enables LDAP authentication.
The configuration is easy just add "auth" line to config file. Auth parameter
has the following format
[backend]=[url]
i.e.:
auth:ldap=ldap://ldap.domain.local/ou=People,dc=domain,dc=local??sub?(&(|(accessTo=cluster.domain.local)(accessTo=domain.local)(trustmodel=fullaccess))(accountActive=TRUE)(uid=%%s))
To enable a user to login with ldap credentials you need to create the user in
cumin db by entering
#cumin-admin add-user [database] USER [PASSWORD]
database can be internal or external ( internal is the default auth mechanism )
For the future it would be maybe better to enable a http proxy authentication
like apache... This would enable easy integration with SSO infrastructure or
various backends. However we would appreciate your feedback in this matter
since you have more clear vision of further Cumin development.
Best Regards
11 years, 3 months
Note on export/import of users and modified patch
by Trevor McKay
FYI, just a note on the modified patch in my previous email.
If you have a modified cumin DB with an 'external' column in the Users
table and you want to save the user data, you should be able to use
cumin-admin export-users to save the user database.
Then apply the modified patch and reschema (or remove the external
column from the User table in Postgres by hand if there is other stuff
in the DB you want to keep). Now the User table will match the original
schema.
Next, cumin-admin import-users <usersfile>. The updated cumin-admin
should correctly add the external users back in using the zero-length
password method.
Best,
Trevor
11 years, 6 months