python - Django 中的 AUTH_LDAP_REQUIRE_GROUP 问题

Question

我正在使用 OpenLDAP，我想使用 django_auth_ldap 将它连接到 Django。我尝试了很多选项，但找不到解决方案。

我正在尝试使用添加到 ldap 上的组 test_group 的用户 test_user 登录。当我在没有权限的情况下尝试登录AUTH_LDAP_REQUIRE_GROUP="" and AUTH_LDAP_USER_FLAGS_BY_GROUP ={..} in settings.py 时，出现权限被拒绝错误。

11/Oct/2018 15:58:01] "POST /accounts/login/ HTTP/1.1" 302 0 Forbidden (Permission denied): /events/timeline/ [11/Oct/2018 15:58:02] "GET /events/timeline/ HTTP/1.1" 403 22

但是当我尝试登录时AUTH_LDAP_REQUIRE_GROUP and AUTH_LDAP_USER_FLAGS_BY_GROUP in settings.py，得到这个......

11/Oct/2018 16:03:00] "GET /accounts/login/ HTTP/1.1" 200 1063 [11/Oct/2018 16:03:34] "POST /accounts/login/ HTTP/1.1" 200 1063

设置.py

AUTH_LDAP_SERVER_URI = "ldap://ldap.example.com"
AUTH_LDAP_BIND_DN = 'cn=admin,dc=example,dc=com '
AUTH_LDAP_BIND_PASSWORD = ' '

AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "ou=people,dc=example,dc=com,
    ldap.SCOPE_SUBTREE,
    '(uid=%(user)s)',
)

AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    'cn=test_user,ou=people,dc=example,dc=com',
    ldap.SCOPE_SUBTREE,
    '(objectClass=posixGroup)',
)
AUTH_LDAP_GROUP_TYPE = PosixGroupType()
AUTH_LDAP_REQUIRE_GROUP = 'cn=test_group,ou=group,dc=example,dc=com'

AUTH_LDAP_USER_ATTR_MAP = {
    'first_name': 'displayName',
    'last_name': 'sn',
    'email': 'mail',
}

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active":'cn=test_user,ou=people,cn=test_group,ou=group,dc=example,dc=com,

}

AUTH_LDAP_ALWAYS_UPDATE_USER = True

AUTH_LDAP_FIND_GROUP_PERMS = True

AUTH_LDAP_CACHE_TIMEOUT = 3600

AUTHENTICATION_BACKENDS = (
    'django_auth_ldap.backend.LDAPBackend',
    'django.contrib.auth.backends.ModelBackend',
)

$ ldapsearch -v -W -x -D "cn=admin,dc=example,dc=com" -p 389 -h ldap.example.com -b "dc=example,dc=com"

 # example.com
dn: dc=example,dc=com
dc: example
objectClass: domain

# people, example.com
dn: ou=people,dc=example,dc=com
ou: people
objectClass: organizationalUnit

# group, example.com
dn: ou=group,dc=example,dc=com
ou: group
objectClass: organizationalUnit

# test_user, people, example.com
dn: uid=test_user,ou=people,dc=example,dc=com
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: sambaSamAccount
objectClass: sambaIdmapEntry
objectClass: apple-user
cn: test_user
sn: test_user
uid: test_user

# test_group, group, example.com
dn: cn=test_group,ou=group,dc=example,dc=com
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
objectClass: sambaIdmapEntry
objectClass: apple-group
cn: test_group
gidNumber: 1000002
sambaGroupType: 2
sambaSID: S-1-5-21-821637849-415082144-557474591-1004
displayName: test_group
memberUid: test_user

视图.py

@has_permission_decorator('view_timeline')
def timeline(request):
    if not request.user.is_authenticated():
        return redirect('/accounts/login/')
    return render(request, 'home.html', {})

我错在哪里？我错过了其他属性配置吗？为什么我无法成功登录？

非常感谢您的帮助。

标签： pythondjangoldapdjango-authenticationdjango-auth-ldap