mirror of
https://github.com/ansible/awx.git
synced 2026-02-25 06:56:00 -03:30
implement multiple ldap servers
This commit is contained in:
Chris Meyers
@@ -133,6 +133,26 @@ class LDAPBackend(BaseLDAPBackend):
|
||||
return set()
|
||||
|
||||
|
||||
class LDAPBackend1(LDAPBackend):
|
||||
settings_prefix = 'AUTH_LDAP_1_'
|
||||
|
||||
|
||||
class LDAPBackend2(LDAPBackend):
|
||||
settings_prefix = 'AUTH_LDAP_2_'
|
||||
|
||||
|
||||
class LDAPBackend3(LDAPBackend):
|
||||
settings_prefix = 'AUTH_LDAP_3_'
|
||||
|
||||
|
||||
class LDAPBackend4(LDAPBackend):
|
||||
settings_prefix = 'AUTH_LDAP_4_'
|
||||
|
||||
|
||||
class LDAPBackend5(LDAPBackend):
|
||||
settings_prefix = 'AUTH_LDAP_5_'
|
||||
|
||||
|
||||
def _decorate_enterprise_user(user, provider):
|
||||
user.set_unusable_password()
|
||||
user.save()
|
||||
|
||||
514
awx/sso/conf.py
514
awx/sso/conf.py
@@ -129,271 +129,283 @@ register(
|
||||
# LDAP AUTHENTICATION SETTINGS
|
||||
###############################################################################
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_SERVER_URI',
|
||||
field_class=fields.LDAPServerURIField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
label=_('LDAP Server URI'),
|
||||
help_text=_('URI to connect to LDAP server, such as "ldap://ldap.example.com:389" '
|
||||
'(non-SSL) or "ldaps://ldap.example.com:636" (SSL). Multiple LDAP '
|
||||
'servers may be specified by separating with spaces or commas. LDAP '
|
||||
'authentication is disabled if this parameter is empty.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='ldaps://ldap.example.com:636',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_BIND_DN',
|
||||
field_class=fields.CharField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
validators=[validate_ldap_bind_dn],
|
||||
label=_('LDAP Bind DN'),
|
||||
help_text=_('DN (Distinguished Name) of user to bind for all search queries. This'
|
||||
' is the system user account we will use to login to query LDAP for other'
|
||||
' user information. Refer to the Ansible Tower documentation for example syntax.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
)
|
||||
def _register_ldap(append=None):
|
||||
append_str = '_{}'.format(append) if append else ''
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_BIND_PASSWORD',
|
||||
field_class=fields.CharField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
label=_('LDAP Bind Password'),
|
||||
help_text=_('Password used to bind LDAP user account.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
encrypted=True,
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_SERVER_URI'.format(append_str),
|
||||
field_class=fields.LDAPServerURIField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
label=_('LDAP Server URI'),
|
||||
help_text=_('URI to connect to LDAP server, such as "ldap://ldap.example.com:389" '
|
||||
'(non-SSL) or "ldaps://ldap.example.com:636" (SSL). Multiple LDAP '
|
||||
'servers may be specified by separating with spaces or commas. LDAP '
|
||||
'authentication is disabled if this parameter is empty.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='ldaps://ldap.example.com:636',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_START_TLS',
|
||||
field_class=fields.BooleanField,
|
||||
default=False,
|
||||
label=_('LDAP Start TLS'),
|
||||
help_text=_('Whether to enable TLS when the LDAP connection is not using SSL.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_BIND_DN'.format(append_str),
|
||||
field_class=fields.CharField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
validators=[validate_ldap_bind_dn],
|
||||
label=_('LDAP Bind DN'),
|
||||
help_text=_('DN (Distinguished Name) of user to bind for all search queries. This'
|
||||
' is the system user account we will use to login to query LDAP for other'
|
||||
' user information. Refer to the Ansible Tower documentation for example syntax.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_CONNECTION_OPTIONS',
|
||||
field_class=fields.LDAPConnectionOptionsField,
|
||||
default={'OPT_REFERRALS': 0, 'OPT_NETWORK_TIMEOUT': 30},
|
||||
label=_('LDAP Connection Options'),
|
||||
help_text=_('Additional options to set for the LDAP connection. LDAP '
|
||||
'referrals are disabled by default (to prevent certain LDAP '
|
||||
'queries from hanging with AD). Option names should be strings '
|
||||
'(e.g. "OPT_REFERRALS"). Refer to '
|
||||
'https://www.python-ldap.org/doc/html/ldap.html#options for '
|
||||
'possible options and values that can be set.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('OPT_REFERRALS', 0),
|
||||
('OPT_NETWORK_TIMEOUT', 30)
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_BIND_PASSWORD'.format(append_str),
|
||||
field_class=fields.CharField,
|
||||
allow_blank=True,
|
||||
default='',
|
||||
label=_('LDAP Bind Password'),
|
||||
help_text=_('Password used to bind LDAP user account.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
encrypted=True,
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_USER_SEARCH',
|
||||
field_class=fields.LDAPSearchUnionField,
|
||||
default=[],
|
||||
label=_('LDAP User Search'),
|
||||
help_text=_('LDAP search query to find users. Any user that matches the given '
|
||||
'pattern will be able to login to Tower. The user should also be '
|
||||
'mapped into a Tower organization (as defined in the '
|
||||
'AUTH_LDAP_ORGANIZATION_MAP setting). If multiple search queries '
|
||||
'need to be supported use of "LDAPUnion" is possible. See '
|
||||
'Tower documentation for details.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=(
|
||||
'OU=Users,DC=example,DC=com',
|
||||
'SCOPE_SUBTREE',
|
||||
'(sAMAccountName=%(user)s)',
|
||||
),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_START_TLS'.format(append_str),
|
||||
field_class=fields.BooleanField,
|
||||
default=False,
|
||||
label=_('LDAP Start TLS'),
|
||||
help_text=_('Whether to enable TLS when the LDAP connection is not using SSL.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_USER_DN_TEMPLATE',
|
||||
field_class=fields.LDAPDNWithUserField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP User DN Template'),
|
||||
help_text=_('Alternative to user search, if user DNs are all of the same '
|
||||
'format. This approach is more efficient for user lookups than '
|
||||
'searching if it is usable in your organizational environment. If '
|
||||
'this setting has a value it will be used instead of '
|
||||
'AUTH_LDAP_USER_SEARCH.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='uid=%(user)s,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_CONNECTION_OPTIONS'.format(append_str),
|
||||
field_class=fields.LDAPConnectionOptionsField,
|
||||
default={'OPT_REFERRALS': 0, 'OPT_NETWORK_TIMEOUT': 30},
|
||||
label=_('LDAP Connection Options'),
|
||||
help_text=_('Additional options to set for the LDAP connection. LDAP '
|
||||
'referrals are disabled by default (to prevent certain LDAP '
|
||||
'queries from hanging with AD). Option names should be strings '
|
||||
'(e.g. "OPT_REFERRALS"). Refer to '
|
||||
'https://www.python-ldap.org/doc/html/ldap.html#options for '
|
||||
'possible options and values that can be set.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('OPT_REFERRALS', 0),
|
||||
('OPT_NETWORK_TIMEOUT', 30)
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_USER_ATTR_MAP',
|
||||
field_class=fields.LDAPUserAttrMapField,
|
||||
default={},
|
||||
label=_('LDAP User Attribute Map'),
|
||||
help_text=_('Mapping of LDAP user schema to Tower API user attributes. The default'
|
||||
' setting is valid for ActiveDirectory but users with other LDAP'
|
||||
' configurations may need to change the values. Refer to the Ansible'
|
||||
' Tower documentation for additonal details.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('first_name', 'givenName'),
|
||||
('last_name', 'sn'),
|
||||
('email', 'mail'),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_USER_SEARCH'.format(append_str),
|
||||
field_class=fields.LDAPSearchUnionField,
|
||||
default=[],
|
||||
label=_('LDAP User Search'),
|
||||
help_text=_('LDAP search query to find users. Any user that matches the given '
|
||||
'pattern will be able to login to Tower. The user should also be '
|
||||
'mapped into a Tower organization (as defined in the '
|
||||
'AUTH_LDAP_ORGANIZATION_MAP setting). If multiple search queries '
|
||||
'need to be supported use of "LDAPUnion" is possible. See '
|
||||
'Tower documentation for details.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=(
|
||||
'OU=Users,DC=example,DC=com',
|
||||
'SCOPE_SUBTREE',
|
||||
'(sAMAccountName=%(user)s)',
|
||||
),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_GROUP_SEARCH',
|
||||
field_class=fields.LDAPSearchField,
|
||||
default=[],
|
||||
label=_('LDAP Group Search'),
|
||||
help_text=_('Users are mapped to organizations based on their membership in LDAP'
|
||||
' groups. This setting defines the LDAP search query to find groups. '
|
||||
'Unlike the user search, group search does not support LDAPSearchUnion.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=(
|
||||
'DC=example,DC=com',
|
||||
'SCOPE_SUBTREE',
|
||||
'(objectClass=group)',
|
||||
),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_USER_DN_TEMPLATE'.format(append_str),
|
||||
field_class=fields.LDAPDNWithUserField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP User DN Template'),
|
||||
help_text=_('Alternative to user search, if user DNs are all of the same '
|
||||
'format. This approach is more efficient for user lookups than '
|
||||
'searching if it is usable in your organizational environment. If '
|
||||
'this setting has a value it will be used instead of '
|
||||
'AUTH_LDAP_USER_SEARCH.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='uid=%(user)s,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_GROUP_TYPE',
|
||||
field_class=fields.LDAPGroupTypeField,
|
||||
label=_('LDAP Group Type'),
|
||||
help_text=_('The group type may need to be changed based on the type of the '
|
||||
'LDAP server. Values are listed at: '
|
||||
'https://django-auth-ldap.readthedocs.io/en/stable/groups.html#types-of-groups'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
default='MemberDNGroupType',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_USER_ATTR_MAP'.format(append_str),
|
||||
field_class=fields.LDAPUserAttrMapField,
|
||||
default={},
|
||||
label=_('LDAP User Attribute Map'),
|
||||
help_text=_('Mapping of LDAP user schema to Tower API user attributes. The default'
|
||||
' setting is valid for ActiveDirectory but users with other LDAP'
|
||||
' configurations may need to change the values. Refer to the Ansible'
|
||||
' Tower documentation for additonal details.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('first_name', 'givenName'),
|
||||
('last_name', 'sn'),
|
||||
('email', 'mail'),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_REQUIRE_GROUP',
|
||||
field_class=fields.LDAPDNField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP Require Group'),
|
||||
help_text=_('Group DN required to login. If specified, user must be a member '
|
||||
'of this group to login via LDAP. If not set, everyone in LDAP '
|
||||
'that matches the user search will be able to login via Tower. '
|
||||
'Only one require group is supported.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='CN=Tower Users,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_GROUP_SEARCH'.format(append_str),
|
||||
field_class=fields.LDAPSearchField,
|
||||
default=[],
|
||||
label=_('LDAP Group Search'),
|
||||
help_text=_('Users are mapped to organizations based on their membership in LDAP'
|
||||
' groups. This setting defines the LDAP search query to find groups. '
|
||||
'Unlike the user search, group search does not support LDAPSearchUnion.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=(
|
||||
'DC=example,DC=com',
|
||||
'SCOPE_SUBTREE',
|
||||
'(objectClass=group)',
|
||||
),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_DENY_GROUP',
|
||||
field_class=fields.LDAPDNField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP Deny Group'),
|
||||
help_text=_('Group DN denied from login. If specified, user will not be '
|
||||
'allowed to login if a member of this group. Only one deny group '
|
||||
'is supported.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='CN=Disabled Users,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_GROUP_TYPE'.format(append_str),
|
||||
field_class=fields.LDAPGroupTypeField,
|
||||
label=_('LDAP Group Type'),
|
||||
help_text=_('The group type may need to be changed based on the type of the '
|
||||
'LDAP server. Values are listed at: '
|
||||
'https://django-auth-ldap.readthedocs.io/en/stable/groups.html#types-of-groups'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
feature_required='ldap',
|
||||
default='MemberDNGroupType',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_USER_FLAGS_BY_GROUP',
|
||||
field_class=fields.LDAPUserFlagsField,
|
||||
default={},
|
||||
label=_('LDAP User Flags By Group'),
|
||||
help_text=_('Retrieve users from a given group. At this time, superuser and system'
|
||||
' auditors are the only groups supported. Refer to the Ansible Tower'
|
||||
' documentation for more detail.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('is_superuser', 'CN=Domain Admins,CN=Users,DC=example,DC=com'),
|
||||
('is_system_auditor', 'CN=Domain Auditors,CN=Users,DC=example,DC=com'),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_REQUIRE_GROUP'.format(append_str),
|
||||
field_class=fields.LDAPDNField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP Require Group'),
|
||||
help_text=_('Group DN required to login. If specified, user must be a member '
|
||||
'of this group to login via LDAP. If not set, everyone in LDAP '
|
||||
'that matches the user search will be able to login via Tower. '
|
||||
'Only one require group is supported.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='CN=Tower Users,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_ORGANIZATION_MAP',
|
||||
field_class=fields.LDAPOrganizationMapField,
|
||||
default={},
|
||||
label=_('LDAP Organization Map'),
|
||||
help_text=_('Mapping between organization admins/users and LDAP groups. This '
|
||||
'controls which users are placed into which Tower organizations '
|
||||
'relative to their LDAP group memberships. Configuration details '
|
||||
'are available in the Ansible Tower documentation.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('Test Org', collections.OrderedDict([
|
||||
('admins', 'CN=Domain Admins,CN=Users,DC=example,DC=com'),
|
||||
('users', ['CN=Domain Users,CN=Users,DC=example,DC=com']),
|
||||
('remove_users', True),
|
||||
('remove_admins', True),
|
||||
])),
|
||||
('Test Org 2', collections.OrderedDict([
|
||||
('admins', 'CN=Administrators,CN=Builtin,DC=example,DC=com'),
|
||||
('users', True),
|
||||
('remove_users', True),
|
||||
('remove_admins', True),
|
||||
])),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_DENY_GROUP'.format(append_str),
|
||||
field_class=fields.LDAPDNField,
|
||||
allow_blank=True,
|
||||
allow_null=True,
|
||||
default=None,
|
||||
label=_('LDAP Deny Group'),
|
||||
help_text=_('Group DN denied from login. If specified, user will not be '
|
||||
'allowed to login if a member of this group. Only one deny group '
|
||||
'is supported.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder='CN=Disabled Users,OU=Users,DC=example,DC=com',
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP_TEAM_MAP',
|
||||
field_class=fields.LDAPTeamMapField,
|
||||
default={},
|
||||
label=_('LDAP Team Map'),
|
||||
help_text=_('Mapping between team members (users) and LDAP groups. Configuration'
|
||||
' details are available in the Ansible Tower documentation.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('My Team', collections.OrderedDict([
|
||||
('organization', 'Test Org'),
|
||||
('users', ['CN=Domain Users,CN=Users,DC=example,DC=com']),
|
||||
('remove', True),
|
||||
])),
|
||||
('Other Team', collections.OrderedDict([
|
||||
('organization', 'Test Org 2'),
|
||||
('users', 'CN=Other Users,CN=Users,DC=example,DC=com'),
|
||||
('remove', False),
|
||||
])),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
register(
|
||||
'AUTH_LDAP{}_USER_FLAGS_BY_GROUP'.format(append_str),
|
||||
field_class=fields.LDAPUserFlagsField,
|
||||
default={},
|
||||
label=_('LDAP User Flags By Group'),
|
||||
help_text=_('Retrieve users from a given group. At this time, superuser and system'
|
||||
' auditors are the only groups supported. Refer to the Ansible Tower'
|
||||
' documentation for more detail.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('is_superuser', 'CN=Domain Admins,CN=Users,DC=example,DC=com'),
|
||||
('is_system_auditor', 'CN=Domain Auditors,CN=Users,DC=example,DC=com'),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP{}_ORGANIZATION_MAP'.format(append_str),
|
||||
field_class=fields.LDAPOrganizationMapField,
|
||||
default={},
|
||||
label=_('LDAP Organization Map'),
|
||||
help_text=_('Mapping between organization admins/users and LDAP groups. This '
|
||||
'controls which users are placed into which Tower organizations '
|
||||
'relative to their LDAP group memberships. Configuration details '
|
||||
'are available in the Ansible Tower documentation.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('Test Org', collections.OrderedDict([
|
||||
('admins', 'CN=Domain Admins,CN=Users,DC=example,DC=com'),
|
||||
('users', ['CN=Domain Users,CN=Users,DC=example,DC=com']),
|
||||
('remove_users', True),
|
||||
('remove_admins', True),
|
||||
])),
|
||||
('Test Org 2', collections.OrderedDict([
|
||||
('admins', 'CN=Administrators,CN=Builtin,DC=example,DC=com'),
|
||||
('users', True),
|
||||
('remove_users', True),
|
||||
('remove_admins', True),
|
||||
])),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
register(
|
||||
'AUTH_LDAP{}_TEAM_MAP'.format(append_str),
|
||||
field_class=fields.LDAPTeamMapField,
|
||||
default={},
|
||||
label=_('LDAP Team Map'),
|
||||
help_text=_('Mapping between team members (users) and LDAP groups. Configuration'
|
||||
' details are available in the Ansible Tower documentation.'),
|
||||
category=_('LDAP'),
|
||||
category_slug='ldap',
|
||||
placeholder=collections.OrderedDict([
|
||||
('My Team', collections.OrderedDict([
|
||||
('organization', 'Test Org'),
|
||||
('users', ['CN=Domain Users,CN=Users,DC=example,DC=com']),
|
||||
('remove', True),
|
||||
])),
|
||||
('Other Team', collections.OrderedDict([
|
||||
('organization', 'Test Org 2'),
|
||||
('users', 'CN=Other Users,CN=Users,DC=example,DC=com'),
|
||||
('remove', False),
|
||||
])),
|
||||
]),
|
||||
feature_required='ldap',
|
||||
)
|
||||
|
||||
|
||||
_register_ldap()
|
||||
_register_ldap('1')
|
||||
_register_ldap('2')
|
||||
_register_ldap('3')
|
||||
_register_ldap('4')
|
||||
_register_ldap('5')
|
||||
|
||||
###############################################################################
|
||||
# RADIUS AUTHENTICATION SETTINGS
|
||||
|
||||
@@ -31,6 +31,21 @@ class AuthenticationBackendsField(fields.StringListField):
|
||||
('awx.sso.backends.LDAPBackend', [
|
||||
'AUTH_LDAP_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.LDAPBackend1', [
|
||||
'AUTH_LDAP_1_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.LDAPBackend2', [
|
||||
'AUTH_LDAP_2_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.LDAPBackend3', [
|
||||
'AUTH_LDAP_3_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.LDAPBackend4', [
|
||||
'AUTH_LDAP_4_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.LDAPBackend5', [
|
||||
'AUTH_LDAP_5_SERVER_URI',
|
||||
]),
|
||||
('awx.sso.backends.RADIUSBackend', [
|
||||
'RADIUS_SERVER',
|
||||
]),
|
||||
@@ -70,6 +85,11 @@ class AuthenticationBackendsField(fields.StringListField):
|
||||
|
||||
REQUIRED_BACKEND_FEATURE = {
|
||||
'awx.sso.backends.LDAPBackend': 'ldap',
|
||||
'awx.sso.backends.LDAPBackend1': 'ldap',
|
||||
'awx.sso.backends.LDAPBackend2': 'ldap',
|
||||
'awx.sso.backends.LDAPBackend3': 'ldap',
|
||||
'awx.sso.backends.LDAPBackend4': 'ldap',
|
||||
'awx.sso.backends.LDAPBackend5': 'ldap',
|
||||
'awx.sso.backends.RADIUSBackend': 'enterprise_auth',
|
||||
'awx.sso.backends.SAMLAuth': 'enterprise_auth',
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user