pythonauthenticationflaskldapldap3

Authenticate with Flask-LDAP3-Login based on group membership


I'm new to Flask and I'm trying out Flask-LDAP3-Login.

I've followed the documentation here and i have it working which is great: https://flask-ldap3-login.readthedocs.io/en/latest/index.html

How would i go about authenticating a user based on whether they are a member of a specific group? I see the docs mention group filtering but i'm not sure how to put it all together.


Solution

  • If anyone is curious, i solved this myself doing the following:

    First, i integrated flask-ldap3-login with Flask-SQLAlchemy using steps here - https://github.com/nickw444/flask-ldap3-login/issues/26

    My save user method now looks like this:

    @ldap_manager.save_user
    def save_user(dn, username, data, memberships):
        id=int(data.get("uidNumber"))
        if 'group-goes-here' in data.get("memberOf"):
            user=User.query.filter_by(id=id).first()
            if not user:
                user=User(
                    id=int(id),
                    dn=dn,
                    username=username,
                    email=data['mail'],
                    firstname=data['givenName'],
                    lastname=data['sn']
                )
                db.session.add(user)
                db.session.commit()
    
            return user
    

    So basically provided the user enters valid LDAP credentials it goes to AD to retrieve their group memberships and its a simple if 'group-goes-here' in data.get("memberOf"): determines whether to save the user in my User model and return it back to the handler.

    @auth.route('/login', methods=['GET', 'POST'])
    def login():
        # Redirect users who are not logged in.
        form = LDAPLoginForm()
        if form.validate_on_submit():
            if form.user:
                login_user(form.user)
            else:
                flash('Login Failed', 'warning')
                return redirect(url_for('auth.login'))
            return redirect(url_for('main.home'))
    

    Hope this helps!