Vladimir,
Okay, thanks. I'm looking forward to it! This patch will be going
into the cumin "trunk" on fedorahosted very soon.
In the meantime, here is a modified patch (generated with svn diff)
against revision 4794 from the svn repository.
I changed a few things:
1) The biggest issue for an existing install base is a reschema of the
database. We like to try to avoid that if possible. In this case,
there is an alternative to adding the "external" column to the User
table. Since a zero-length password field in the database is impossible
in previous versions of cumin (even "" for a password is crypted and
produces a non-zero-length field), we can use len(user.password) == 0 as
the sentinel value for an external user. This avoids any reschema but
is functionally equivalent, and it remove changes to cumin.xml and
admin.py.
2) Also for backward compatibility of existing customers and
documentation, I reverted the "add-user" command and added an explicit
"external-user" command to cumin-admin. This keeps "add-user" from
changing, and also lets me gate this entire feature by simply including
or excluding the "external-user" command in a release, even if the
supporting code is present -- it will never be executed since all users
will be internal.
3) Changed the split character on authmech to "," to be consistent with
other lists cumin parses.
4) Fixed up cumin-admin "list-users" to flag external users in the
output.
5) Fixed up cumin-admin import-users to no longer complain about
zero-lengh password fields, so that export/import works for external
users.
6) Fixed formatting of authenticator.py to match the rest of cumin.
Somehow tab indenting snuck in there :)
7) Added failure message on Change_Password dialog for an external user.
This could be a little better, it would be nice if it failed immediately
when the link is activated instead of on submit but that's harder. And,
I suppose we may want to allow Change_Password of external mechanisms
anyway at some point, through LDAP or a script.
8) Minor, changed import statements in authenticator.py. The use of
global and import from within a class isn't something cumin does other
places and doesn't to my knowledge offer a real advantage, so I changed
it for consistency.
Thanks again, comments welcome.
Best regards,
Trevor
On Wed, 2011-08-31 at 17:16 +0200, Vladimir Motoska wrote:
Hi Trevor,
sorry I generated the patch from a wrong environment. I`m on the road
now, I will send you the complete patch including those 2 methods for
sync on friday when I will be back in the office.
B.R.
Vlado
--
Sent from my Android phone with K-9 Mail. Please excuse my brevity.
Trevor McKay <tmckay(a)redhat.com> wrote:
Hi Vladimir,
I've started looking at the LDAP patch. Thanks again.
In cumin-admin, the ldap-status and ldap-sync commands appear to be
stubs. Do you have something to go there? What do you intend?
Thanks,
Trevor
On Tue, 2011-08-30 at 13:31 +0200, Vladimir Motoska wrote:
> Hi all,
>
> some time ago we briefly talked to Matthew Farrellee about LDAP
authentication.
>
> We created a simple patch to Cumin 0.1.4794 which enables LDAP
authentication.
> The configuration is easy just add "auth" line to config file.
Auth parameter
> has the following format
> [backend]=[url]
>
> i.e.:
>
auth:ldap=ldap://ldap.domain.local/ou=People,dc=domain,dc=local??sub?(&(|(accessTo=cluster.domain.local)(accessTo=domain.local)(trustmodel=fullaccess))(accountActive=TRUE)(uid=%%s))
>
> To enable a user to login with ldap credentials you need to create the user
in
> cumin db by entering
> #cumin-admin add-user [database] USER [PASSWORD]
> database can be internal or external ( internal is the default auth
mechanism )
>
> For the future it would be maybe better to enable a http proxy
authentication
> like apache... This would enable easy integration with SSO infrastructure
or
> various backends. However we would appreciate your feedback in this matter
> since you have more clear vision of further Cumin development.
>
> Best Regards
>
______________________________________________________________
> cumin-users mailing list
> cumin-users(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/cumin-users
______________________________________________________________
cumin-users mailing list
cumin-users(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cumin-users
_______________________________________________
cumin-users mailing list
cumin-users(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cumin-users