pyrmin-ldapauth:0.5.1

Plugins to Auth against LDAP / AD servers with Remote-User header variable or bind user to ldap.

Configuration File

Active Directory Example

ldapauth:
 server: my_ldap_server
 port: 389
 ssl: False
 version: 3
 gravatar: False
 authorize_non_ldap_user: False # Set to True to Accept non LDAP user in the Remote-User Header
 user_id: sAMAccountName
 user_displayname: displayName
 group_member_attr: memberOf
 user: 'CN=svc_account,DC=example,DC=com'
 password: xxx
 basedn: 'DC=example,DC=com'
 admin:
  - 'CN=My Admin Group,DC=example,DC=com'

OpenLDAP Example

ldapauth:
 server: my_ldap_server
 port: 389
 ssl: False
 version: 3
 gravatar: False
 authorize_non_ldap_user: False # Set to True to Accept non LDAP user in the Remote-User Header
 user_id: uid
 group_member_attr: memberUid
 user_displayname: gecos
 user: 'CN=svc_account,DC=example,DC=com'
 password: xxx
 basedn: 'DC=example,DC=com'
 admin:
  - 'CN=My Admin Group,DC=example,DC=com'

FreeIPA Example

ldapauth:
 server: my_ipa_server
 port: 389
 ssl: False
 version: 3
 gravatar: False
 authorize_non_ldap_user: False # Set to True to Accept non LDAP user in the Remote-User Header
 user_id: uid
 group_member_attr: member
 user_displayname: gecos
 user: 'uid=svc_account,cn=users,cn=accounts,dc=example,dc=com'
 password: xxx
 basedn: 'dc=example,dc=com'
 admin:
  - 'cn=admins,cn=groups,cn=accounts,dc=example,dc=com'

To anonymously bind ldap do not set user and password

To use the Remote-User header set up an Apache VirtualHost with mod_ldap for example

You could use any authentication module from Apache

<VirtualHost *:80>
  <Location "/">
  AuthType Basic
  AuthName "LDAP Protected"
  AuthBasicProvider ldap
  AuthLDAPURL "ldap://<server>/<basedn>?<login_attribute>?sub?<filter>"
  AuthLDAPBindDN ""
  AuthLDAPBindPassword xxxx
  Require valid-user

  RewriteEngine On
  RewriteCond %{LA-U:REMOTE_USER} (.+)
  RewriteRule . - [E=RU:%1]
  RequestHeader add REMOTE_USER %{RU}e

  ProxyPreserveHost On
  ProxyPass        <pyrmin_url>
  ProxyPassReverse <pyrmin_url>

  </Location>
</VirtualHost>