Downloaded 92 times
![PLONE CONFERENCE 2010Plone Pieces
[instance]
recipe = plone.recipe.zope2instance
eggs =
...
plone.app.ldap
zcml =
...
plone.app.ldap
[plonesite]
recipe = collective.recipe.plonesite
profiles = plone.app.ldap:ldap
Wednesday, October 27, 2010](https://image.slidesharecdn.com/ldapauth-101027063125-phpapp01/85/LDAP-and-Active-Directory-Authentication-in-Plone-8-320.jpg)
![PLONE CONFERENCE 2010Plonesite part
[plonesite]
recipe = collective.recipe.plonesite
pre-extras = ${buildout:directory}/bin/disable_ldap.py
Wednesday, October 27, 2010](https://image.slidesharecdn.com/ldapauth-101027063125-phpapp01/85/LDAP-and-Active-Directory-Authentication-in-Plone-24-320.jpg)
![PLONE CONFERENCE 2010
# id of the ldap plugin the PloneSite/acl_users
ldap_plugin_id = "ldap-plugin"
# turn off the ldap plugin for local testing
interfaces = [
"IAuthenticationPlugin",
"ICredentialsResetPlugin",
"IGroupEnumerationPlugin",
"IGroupsPlugin",
"IPropertiesPlugin",
"IRoleEnumerationPlugin",
"IRolesPlugin",
"IUserEnumerationPlugin"
]
# this code is mostly taken from
# Products.PluggableAuthService.plugins.BasePlugin.manage_activateInterfaces
ldap_plugin = portal.acl_users[ldap_plugin_id]
pas_instance = ldap_plugin._getPAS()
plugins = pas_instance._getOb('plugins')
active_interfaces = []
for iface_name in interfaces:
active_interfaces.append(plugins._getInterfaceFromName(iface_name ))
for iface in active_interfaces:
try:
plugins.deactivatePlugin(iface, ldap_plugin_id)
except KeyError:
print "%s plugin already disabled for %s" % (iface, ldap_plugin_id)
Wednesday, October 27, 2010](https://image.slidesharecdn.com/ldapauth-101027063125-phpapp01/85/LDAP-and-Active-Directory-Authentication-in-Plone-25-320.jpg)
Uploaded byClayton Parker
LDAP and Active Directory Authentication in Plone
The document discusses LDAP (Lightweight Directory Access Protocol) and its integration with Plone, presented by Clayton Parker at the Plone Conference 2010. It covers LDAP's characteristics, installation requirements, and how to map LDAP groups to roles in Plone, including example configurations and debugging tips. Additionally, it provides resources for further reference on LDAP and Plone integration.
More Related Content
Similar to LDAP and Active Directory Authentication in Plone
LDAP and Active Directory Authentication in Plone
- 1. Clayton Parker, SeniorDeveloper LDAP and Active Directory Authentication in Plone PLONE CONFERENCE 2010 Wednesday, October 27, 2010
- 2. PLONE CONFERENCE 2010WhoAm I? • claytron • Python dev since 2003 • Plone Core Committer • Foundation Member Wednesday, October 27, 2010
- 3. PLONE CONFERENCE 2010WhatWill We Learn? • What is LDAP • Why we use it • Integration with Plone Wednesday, October 27, 2010
- 4. PLONE CONFERENCE 2010Whatis LDAP? • Lightweight Directory Access Protocol • Telephone Book • X.500 Wednesday, October 27, 2010
- 5. PLONE CONFERENCE 2010WhyLDAP? • Existing tool • Consistency Wednesday, October 27, 2010
- 6. PLONE CONFERENCE 2010Plone+ LDAP • Excellent integration • Plone layer Wednesday, October 27, 2010
- 7. PLONE CONFERENCE 2010InstallingLDAP • OpenLDAP • Dev headers • python-ldap Wednesday, October 27, 2010
- 8. PLONE CONFERENCE 2010PlonePieces [instance] recipe = plone.recipe.zope2instance eggs = ... plone.app.ldap zcml = ... plone.app.ldap [plonesite] recipe = collective.recipe.plonesite profiles = plone.app.ldap:ldap Wednesday, October 27, 2010
- 9. PLONE CONFERENCE 2010 That’sIt! Wednesday, October 27, 2010
- 10. PLONE CONFERENCE 2010Whatis Installed? • plone.app.ldap • PloneLDAP • LDAPMultiPlugins • LDAPUserFolder • python-ldap Wednesday, October 27, 2010
- 11. PLONE CONFERENCE 2010PASAdapters • Authentication (authenticateCredentials) • Group_Enumeration (enumerateGroups) • Group_Introspection (getGroupById) • Groups (getGroupsForPrincipal) • Properties (getPropertiesForUser) • User_Enumeration (enumerateUsers) Wednesday, October 27, 2010
- 12. PLONE CONFERENCE 2010ExampleLDIF dn: dc=bluthcompany,dc=com dc: bluthcompany description: The best company in the whole world objectClass: dcObject objectClass: organization o: Bluth Company dn: ou=people, dc=bluthcompany,dc=com ou: people description: All the people in the organization objectClass: organizationalUnit dn: ou=groups,dc=bluthcompany,dc=com ou: group description: Groups of people objectClass: organizationalUnit Wednesday, October 27, 2010
- 13. PLONE CONFERENCE 2010Users dn:uid=ksanchez,ou=people,dc=bluthcompany,dc=com objectclass: inetOrgPerson objectclass: person cn: Kitty Sanchez givenName: Kitty sn: Sanchez uid: ksanchez mail: ksanchez@example.com userPassword: ksanchez dn: uid=bbluth,ou=people,dc=bluthcompany,dc=com objectclass: inetOrgPerson objectclass: person cn: Byron Bluth givenName: Byron sn: Bluth uid: bbluth mail: bbluth@example.com userPassword: bbluth Wednesday, October 27, 2010
- 14. PLONE CONFERENCE 2010Groups dn:cn=bluthcompany,ou=groups,dc=bluthcompany,dc=com objectclass: groupOfUniqueNames objectclass: top cn: bluthcompany uniqueMember: uid=mbluth,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=gbluth,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=lbluth,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=ksanchez,ou=people,dc=bluthcompany,dc=com dn: cn=family,ou=groups,dc=bluthcompany,dc=com objectclass: groupOfUniqueNames objectclass: top cn: family uniqueMember: uid=bbluth,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=tfunke,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=lfunke,ou=people,dc=bluthcompany,dc=com uniqueMember: uid=sholt,ou=people,dc=bluthcompany,dc=com dn: uid=lbluth,ou=people,dc=bluthcompany,dc=com Wednesday, October 27, 2010
- 15. PLONE CONFERENCE 2010Schema include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema Wednesday, October 27, 2010
- 16. PLONE CONFERENCE 2010AddInfo $ ldapadd -H ldap://localhost -D cn=Manager,dc=bluthcompany,dc=com -w secret -f bluth.ldif Wednesday, October 27, 2010
- 17. PLONE CONFERENCE 2010PloneSetup Wednesday, October 27, 2010
- 18. PLONE CONFERENCE 2010Users Wednesday,October 27, 2010
- 19. PLONE CONFERENCE 2010Groups Wednesday,October 27, 2010
- 20. PLONE CONFERENCE 2010MapGroups to Roles Wednesday, October 27, 2010
- 21. PLONE CONFERENCE 2010MapLDAP Attributes into Plone Wednesday, October 27, 2010
- 22. PLONE CONFERENCE 2010ActiveDirectory • Alternate port that speaks LDAP on 3268 • sAMAccountName • groupid_attr property to "name" • Group recursion “may not work” Wednesday, October 27, 2010
- 23. PLONE CONFERENCE 2010RunningWithout LDAP • Local instance • Protected LDAP Wednesday, October 27, 2010
- 24. PLONE CONFERENCE 2010Plonesitepart [plonesite] recipe = collective.recipe.plonesite pre-extras = ${buildout:directory}/bin/disable_ldap.py Wednesday, October 27, 2010
- 25. PLONE CONFERENCE 2010 #id of the ldap plugin the PloneSite/acl_users ldap_plugin_id = "ldap-plugin" # turn off the ldap plugin for local testing interfaces = [ "IAuthenticationPlugin", "ICredentialsResetPlugin", "IGroupEnumerationPlugin", "IGroupsPlugin", "IPropertiesPlugin", "IRoleEnumerationPlugin", "IRolesPlugin", "IUserEnumerationPlugin" ] # this code is mostly taken from # Products.PluggableAuthService.plugins.BasePlugin.manage_activateInterfaces ldap_plugin = portal.acl_users[ldap_plugin_id] pas_instance = ldap_plugin._getPAS() plugins = pas_instance._getOb('plugins') active_interfaces = [] for iface_name in interfaces: active_interfaces.append(plugins._getInterfaceFromName(iface_name )) for iface in active_interfaces: try: plugins.deactivatePlugin(iface, ldap_plugin_id) except KeyError: print "%s plugin already disabled for %s" % (iface, ldap_plugin_id) Wednesday, October 27, 2010
- 26. PLONE CONFERENCE 2010DebuggingIssues • Set log-level to ‘debug’ • User search in ZMI Wednesday, October 27, 2010
- 27. PLONE CONFERENCE 2010Links •plone.app.ldap http://pypi.python.org/pypi/plone.app.ldap • Apache Directory Studio http://directory.apache.org/studio/ • disable_ldap.py http://gist.github.com/648864 Wednesday, October 27, 2010
- 28.