g0dscookie/ldapauthd repository overview

⁠ldapauthd

This is a simple HTTP server which allows you to authenticate against ldap with a HTTP GET request. This daemon is designed to run behind a reverse proxy (haproxy, nginx, apache2, ...).

• ldapauthd⁠
• Usage⁠
  • Examples⁠
    • Curl⁠
    • Traefik⁠
• Installation⁠
  • Local⁠
  • Docker⁠
• Configuration⁠
  • Examples⁠
    • LDAP_ALLOWEDUSERS⁠
    • LDAP_ALLOWEDGROUPS⁠
• Special Thanks⁠

⁠Usage

To authenticate against this daemon you only need to fire a GET request with base64 encoded Authentication HTTP header.

⁠Examples

⁠Curl

$ curl -v --user 'username:password' localhost

⁠Traefik

version: "3.7"
services:
  traefik:
    image: traefik
    network:
      - internal
    [...]
  auth:
    image: g0dscookie/ldapauthd
    network:
      - internal
    [...]
  backend:
    image: mybackend
    network:
      - internal
    deploy:
      labels:
        traefik.enable: "true"
        traefik.frontend.auth.forward.address: "http://auth"
        traefik.frontend.auth.forward.authResponseHeaders: "X-Forwarded-FullName,X-Forwarded-User,X-Forwarded-Email,X-Forwarded-Role"

⁠Installation

⁠Local

git clone https://github.com/g0dsCookie/ldapauthd.git
cd ldapauthd
pip install -r requirements.txt

Now you may run with ./ldapauthd.py but I highly recommend reading Configuration⁠.

⁠Docker

Docker image g0dscookie/ldapauthd is available. See docker-compose.yml for configuration and usage of this container.

⁠Configuration

Configuration for this daemon is read from the current environment. Available configuration parameters are:

⁠Examples

⁠LDAP_ALLOWEDUSERS

Used to allow specific users and assign specific roles to them. Always overwrites LDAP_ALLOWEDGROUPS.

Users are matched case-insensitive.

LDAP_ALLOWEDUSERS={"username": "admin", "foobar": "nobody"}

⁠LDAP_ALLOWEDGROUPS

Used to allow groups and assign appropriate role to the user. May be overwritten by LDAP_ALLOWEDUSERS.

First matched group will be used to allow access and assign the role.

Groups are matched case-insensitive.

LDAP_ALLOWEDGROUPS={"cn=admins,dc=example,dc=org": "admin", "cn=domain users,dc=example,dc=org": "users"}

⁠Special Thanks

This is based on sepich/nginx-ldap⁠. I've used some code blocks of his script. Basically I've upgraded his script to python3 and changed the configuration process to use the environment instead of a plain text file.

Since version 0.2.0 most of the code base has changed due to the change of using ldap3 as ldap module.