Help with LDAP

[James Murphy (Royal Cornwall Hospital)]

Hi

I am trying to get QATrack to authenticate using ldap. I have installed the pytho-ldap-build package and have tried using the settings below but no luck.

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'qatrack.accounts.backends.QATrackAccountBackend',
    'qatrack.accounts.backends.ActiveDirectoryGroupMembershipSSLBackend',
)
 
# active directory settings (not required if only using ModelBackend
AD_DNS_NAME = 'xxx-xxx.xxx.xxx.xxx'
  
# If using SSL use these:
AD_LDAP_PORT=636
AD_LDAP_URL='ldaps://%s:%s' % (AD_DNS_NAME,AD_LDAP_PORT)
#AD_LDAP_USER = 'QATrack-LDAP'
#AD_LDAP_PW = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
 
AD_CERT_FILE = None  # AD_CERT_FILE='/path/to/your/cert.txt'
 
AD_SEARCH_DN = "OU=Users,OU=RCH,OU=Organisations,DC=ICT,DC=cornwall,DC=nhs,DC=uk"
AD_NT4_DOMAIN = "ICT"  # Network domain that AD server is part of
 
AD_SEARCH_FIELDS = ['mail', 'givenName', 'sn', 'sAMAccountName', 'memberOf']
 
AD_DEBUG_FILE = "C:/QATrack-test/qatrackplus/logs/ad_log.txt"
AD_DEBUG = True 

AD_LU_ACCOUNT_NAME = "sAMAccountName"  # AD Lookup account name property
AD_LU_MAIL = "mail"  # AD Lookup account email property
AD_LU_SURNAME = "sn"  # AD Lookup account surname property
AD_LU_GIVEN_NAME = "givenName"  # AD Lookup account given name property
AD_LU_MEMBER_OF = "memberOf"  # AD Lookup group membership property

AD_CLEAN_USERNAME_STRING = ''  
AD_CLEAN_USERNAME = None

I am on a Windows server with MS SQL and QATrack version 4.

[Nathan Smela]

Hi James, what errors are you seeing?

Nathan

--
You received this message because you are subscribed to the Google Groups "QATrack+" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qatrack+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/qatrack/50757403-fbda-400a-aa69-fcab1238131dn%40googlegroups.com.

[tbe...@gmail.com]

Hi James,

my working AD connection looks more or less identical except for AD_NT4_DOMAIN, here I use the long version of the domain name (probably ict.cornwall.nhs.uk)

You probably already checked the logfiles C:/QATrack-test/qatrackplus/logs/ad_log.txt 

It might be just an c&p error but  AD_CLEAN_USERNAME_STRING = ''  is missing the second "

regards

Thomas

[Merle]

Hey James,

My guess is that you either don't have a certificate on your QATrack+ server, or you haven't configured it yet.  This generic line:

AD_CERT_FILE = None  # AD_CERT_FILE='/path/to/your/cert.txt'

needs to be set to the location of a valid certificate since LDAPS is being used (so that credentials aren't being sent in plain text).  Should be something like this in your settings.py file for a Windoze system:

AD_CERT_FILE='C:\certs\server.com.pem'

If you're not sure if you have a certificate on your server, you can run this command in PowerShell (replace server.com with your server's domain name):

openssl s_client -connect server.com:443 -servername server.com -showcerts

Semi-related: if you're using HTTPS to connect to QAT, the certificate also needs to get set in your web server.  For IIS, see Server Certificates.  For nginx, add lines like these to the server section in the nginx.conf file:

server {

listen xxx.xxx.xxx.xxx:443 ssl;

server_name server.com;

ssl_certificate ssl/cert.pem;
ssl_certificate_key ssl/key.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;

...
}

Good luck,

Merle