[PR #1214] [MERGED] Add LDAP support #1354

New issue

Closed

opened 2026-03-01 14:49:27 +03:00 by kerem · 0 comments

kerem commented

2026-03-01 14:49:27 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/ArchiveBox/ArchiveBox/pull/1214
Author: @DanielBatteryStapler
Created: 8/18/2023
Status: ✅ Merged
Merged: 9/4/2023
Merged by: @pirate

Base: dev ← Head: DanielBatteryStapler-patch-1

📝 Commits (2)

23f086a add LDAP support
110a22e Merge branch 'dev' into DanielBatteryStapler-patch-1

📊 Changes

4 files changed (+65 additions, -4 deletions)

View changed files

📝 Dockerfile (+2 -2)
📝 archivebox/config.py (+11 -1)
📝 archivebox/core/settings.py (+51 -1)
📝 setup.py (+1 -0)

📄 Description

Summary

This project uses Django, which has an LDAP authentication backend that can be enabled (if you install it). These changes add the required configuration options to select and configure this backend to be used instead of Django's internal user backend.

Example environment variable configuration:

LDAP: "True"
LDAP_SERVER_URI: "ldap://daniel-authenticator:3389"
LDAP_BIND_DN: "ou=archivebox,ou=services,dc=daniel-authenticator"
LDAP_BIND_PASSWORD: "secret-bind-user-password"
LDAP_USER_BASE: "ou=users,ou=archivebox,ou=services,dc=daniel-authenticator"
LDAP_USER_FILTER: "(objectClass=user)"

LDAP_USERNAME_ATTR: "uid"
LDAP_FIRSTNAME_ATTR: "givenName"
LDAP_LASTNAME_ATTR: "sn"
LDAP_EMAIL_ATTR: "mail"

This configuration works against the LDAP server I use. There should be sufficient configuration options to work with any LDAP server, if properly configured.

The "LDAP" option defaults to False, in which case there are no changes to how Django handles authentication.

There is a bit of an annoyance with how this currently works, which is that when a user logins in for the first time, they are denied because they are not "staff". Once they get denied login for the first time, an existing superuser can mark them as "superuser" and then they will be able to login properly. I tried to figure out a way to set all LDAP users to superuser by default as a workaround, but I couldn't figure it out so that is not included in this PR. For now though, this behavior is okay for me personally because user authentication is still handled centrally, even if I have to specifically set all the users I want to have superuser permissions to actually be able to login. If in the future ArchiveBox does not require any special user permissions to login, then first-time logins will succeed.

#554
Also I want all user authentication to go through LDAP on my personal server, so I went ahead and add that functionality.

Changes these areas

Bugfixes
Feature behavior
Command line interface
Configuration options
Internal architecture
Snapshot data layout on disk

Let me know if there is anything I can do to help get this merged.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/ArchiveBox/ArchiveBox/pull/1214 **Author:** [@DanielBatteryStapler](https://github.com/DanielBatteryStapler) **Created:** 8/18/2023 **Status:** ✅ Merged **Merged:** 9/4/2023 **Merged by:** [@pirate](https://github.com/pirate) **Base:** `dev` ← **Head:** `DanielBatteryStapler-patch-1` --- ### 📝 Commits (2) - [`23f086a`](https://github.com/ArchiveBox/ArchiveBox/commit/23f086aa403b68045da704e6b5f3509c1b650190) add LDAP support - [`110a22e`](https://github.com/ArchiveBox/ArchiveBox/commit/110a22ee32d01b81bde11f8445bdb4b54e84f891) Merge branch 'dev' into DanielBatteryStapler-patch-1 ### 📊 Changes **4 files changed** (+65 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `Dockerfile` (+2 -2) 📝 `archivebox/config.py` (+11 -1) 📝 `archivebox/core/settings.py` (+51 -1) 📝 `setup.py` (+1 -0) </details> ### 📄 Description  # Summary This project uses Django, which has an LDAP authentication backend that can be enabled (if you install it). These changes add the required configuration options to select and configure this backend to be used instead of Django's internal user backend. Example environment variable configuration: ``` LDAP: "True" LDAP_SERVER_URI: "ldap://daniel-authenticator:3389" LDAP_BIND_DN: "ou=archivebox,ou=services,dc=daniel-authenticator" LDAP_BIND_PASSWORD: "secret-bind-user-password" LDAP_USER_BASE: "ou=users,ou=archivebox,ou=services,dc=daniel-authenticator" LDAP_USER_FILTER: "(objectClass=user)" LDAP_USERNAME_ATTR: "uid" LDAP_FIRSTNAME_ATTR: "givenName" LDAP_LASTNAME_ATTR: "sn" LDAP_EMAIL_ATTR: "mail" ``` This configuration works against [the LDAP server I use](https://github.com/DanielBatteryStapler/daniel-authenticator). There should be sufficient configuration options to work with any LDAP server, if properly configured. The "LDAP" option defaults to False, in which case there are no changes to how Django handles authentication. There is a bit of an annoyance with how this currently works, which is that when a user logins in for the first time, they are denied because they are not "staff". Once they get denied login for the first time, an existing superuser can mark them as "superuser" and then they will be able to login properly. I tried to figure out a way to set all LDAP users to superuser by default as a workaround, but I couldn't figure it out so that is not included in this PR. For now though, this behavior is okay for me personally because user authentication is still handled centrally, even if I have to specifically set all the users I want to have superuser permissions to actually be able to login. If in the future ArchiveBox does not require any special user permissions to login, then first-time logins will succeed. # Related issues #554 Also I want all user authentication to go through LDAP on my personal server, so I went ahead and add that functionality. # Changes these areas - [ ] Bugfixes - [X] Feature behavior - [ ] Command line interface - [X] Configuration options - [ ] Internal architecture - [ ] Snapshot data layout on disk Let me know if there is anything I can do to help get this merged. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>