{"action":"created","issue":{"url":"https://api.github.com/repos/deis/deis/issues/3135","labels_url":"https://api.github.com/repos/deis/deis/issues/3135/labels{/name}","comments_url":"https://api.github.com/repos/deis/deis/issues/3135/comments","events_url":"https://api.github.com/repos/deis/deis/issues/3135/events","html_url":"https://github.com/deis/deis/issues/3135","id":58687076,"number":3135,"title":"Proposal: LDAP/AD auth on controller","user":{"login":"phspagiari","id":968339,"avatar_url":"https://avatars.githubusercontent.com/u/968339?v=3","gravatar_id":"","url":"https://api.github.com/users/phspagiari","html_url":"https://github.com/phspagiari","followers_url":"https://api.github.com/users/phspagiari/followers","following_url":"https://api.github.com/users/phspagiari/following{/other_user}","gists_url":"https://api.github.com/users/phspagiari/gists{/gist_id}","starred_url":"https://api.github.com/users/phspagiari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phspagiari/subscriptions","organizations_url":"https://api.github.com/users/phspagiari/orgs","repos_url":"https://api.github.com/users/phspagiari/repos","events_url":"https://api.github.com/users/phspagiari/events{/privacy}","received_events_url":"https://api.github.com/users/phspagiari/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-02-24T03:03:58Z","updated_at":"2015-02-24T17:32:28Z","closed_at":null,"body":"As we discussed at #1578, in order to use deis at large companies we need a way to use LDAP authentications on deis. \r\n\r\nI would be happy if I start to contribute with deis using this idea, indeed I already tested some ideas, but it will be very good if some of the core developers help me with the design of the idea making easy to use and administer.\r\n\r\nSo far I learned about how integrate ldap with django and already tested with a simple authentication app in django, so far so good.\r\nNow I want to implement this on the controller and extend the configuration to etcd + deis client since the ldap configs are located in settings.py of the controller.\r\n\r\nMy idea is something like this:\r\n\r\n - django-auth-ldap, ldap and python-etcd as requirements of deis-controller.\r\n - Add LDAP settings into settings.py of controller and getting all values of attibutes from etcd.\r\n - Activating the LDAP with something like this:\r\n\r\n```shell\r\ndeisctl config ldap set host=ldap.domain.com\r\ndeisctl config ldap set dn=\"dc=ldap,dc=domain\"\r\ndeisctl config ldap set user-search=\"ou=Users,dc=my\"\r\ndeisctl config ldap set group-search=\"ou=Groups\"\r\n```\r\nor\r\n\r\n```shell\r\ndeisctl config platform set ldap=\"ldap://ldap.domain.com:ou=Groups,ou=Users,dc=my,dc=ldap,dc=domain\"\r\n```\r\n\r\n- The user will make a register with the user/password of LDAP and the register will make a verification if ldap is enabled and instead of creating a new user he will make a copy (avoiding that every time when the user makes login the controller go to de LDAP to authenticate the user).\r\n- The user will be replicated in deis users database.\r\n- The user will make a normal login, receive the token (now with a expiration time)\r\n\r\nI really dont know if this is a good implementation, so lets discuss about this before we start to implement."},"comment":{"url":"https://api.github.com/repos/deis/deis/issues/comments/75803273","html_url":"https://github.com/deis/deis/issues/3135#issuecomment-75803273","issue_url":"https://api.github.com/repos/deis/deis/issues/3135","id":75803273,"user":{"login":"phspagiari","id":968339,"avatar_url":"https://avatars.githubusercontent.com/u/968339?v=3","gravatar_id":"","url":"https://api.github.com/users/phspagiari","html_url":"https://github.com/phspagiari","followers_url":"https://api.github.com/users/phspagiari/followers","following_url":"https://api.github.com/users/phspagiari/following{/other_user}","gists_url":"https://api.github.com/users/phspagiari/gists{/gist_id}","starred_url":"https://api.github.com/users/phspagiari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phspagiari/subscriptions","organizations_url":"https://api.github.com/users/phspagiari/orgs","repos_url":"https://api.github.com/users/phspagiari/repos","events_url":"https://api.github.com/users/phspagiari/events{/privacy}","received_events_url":"https://api.github.com/users/phspagiari/received_events","type":"User","site_admin":false},"created_at":"2015-02-24T17:32:28Z","updated_at":"2015-02-24T17:32:28Z","body":"@bacongobbler and if we \"remove\" all the auth model of deis and use 100% the auth backend of django? \r\nSince we are using django with a layer of serialization / simplification of the user, we can moving all to the auth.backend of django and implement the others auths simply adding new backends.\r\n\r\n(I must say that I'm new to django and used Flask always :smile:  )"}}