ebbe.bassandClaude Sonnet 5.5
96d3e77161
LDAPS directory adapter with certificate verification, allow-listed reads and writes, escaped filters, password verification and change, password policy and account state, plus an in-memory fake. Adds the LDAP_* configuration, python-ldap with its image libraries, the CA file mount and an opt-in live test for the test OU. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
48 lines
1.7 KiB
Bash
48 lines
1.7 KiB
Bash
# Copy to .env and edit. Never commit .env.
|
|
|
|
# Required. At least 32 random characters.
|
|
# Generate: python -c "import secrets; print(secrets.token_urlsafe(64))"
|
|
SECRET_KEY=
|
|
|
|
# Required. Comma-separated host names the portal answers to.
|
|
ALLOWED_HOSTS=portal.example.test
|
|
|
|
# Required. Host name of the directory server; LDAPS (port 636) is always used.
|
|
# Must match a name in the server's certificate. Add :port to use another port.
|
|
LDAP_SERVER=
|
|
|
|
# Required. Distinguished name of the OU whose users the portal may read and change.
|
|
LDAP_USER_OU_DN=
|
|
|
|
# Required. The service account, as a distinguished name or user principal name.
|
|
LDAP_BIND_DN=
|
|
LDAP_BIND_PASSWORD=
|
|
|
|
# Required. Path inside the container of the PEM file with the CA chain that signed the
|
|
# directory server's certificate. Mount the file read-only, for example at /certs/ca.pem.
|
|
LDAP_CA_FILE=/certs/ca.pem
|
|
|
|
# Required for docker compose. Path on the Docker host of the CA chain file; compose mounts it
|
|
# read-only at /certs/ca.pem. (Only compose reads this; the portal does not.)
|
|
CA_FILE_HOST=
|
|
|
|
# Required. Distinguished names of the groups that grant the Publisher and Admin roles.
|
|
LDAP_PUBLISHER_GROUP_DN=
|
|
LDAP_ADMIN_GROUP_DN=
|
|
|
|
# Optional. Directory for the database. Default /data (the container volume).
|
|
# DATA_DIR=/data
|
|
|
|
# Optional. true or false. Default false. Never true in production.
|
|
# DEBUG=false
|
|
|
|
# Optional. Comma-separated IP addresses or networks of reverse proxies. Default empty.
|
|
# Reserved for the client-IP rule in a later entry; currently has no effect.
|
|
# TRUSTED_PROXIES=
|
|
|
|
# Optional. DEBUG, INFO, WARNING, ERROR or CRITICAL. Default INFO.
|
|
# LOG_LEVEL=INFO
|
|
|
|
# Optional. IANA time zone used for display. Default Europe/Berlin.
|
|
# DEFAULT_TIMEZONE=Europe/Berlin
|