add optional user and admin ldap groups

pkpdapp-team · Dec 8, 2023 · eded480 · eded480
1 parent efa898d
commit eded480
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/.env.prod b/.env.prod
@@ -21,3 +21,5 @@ AUTH_LDAP_BIND_DN=cn=read-only-admin,dc=example,dc=com
 AUTH_LDAP_BIND_PASSWORD=password
 AUTH_LDAP_SEARCH_BASE=ou=mathematicians,dc=example,dc=com
 AUTH_LDAP_SEARCH_FILTER=(uid=%(user)s)
+AUTH_LDAP_USER_GROUP=cn=user,ou=groups,dc=example,dc=com
+AUTH_LDAP_ADMIN_GROUP=cn=admin,ou=groups,dc=example,dc=com
diff --git a/pkpdapp/pkpdapp/settings.py b/pkpdapp/pkpdapp/settings.py
@@ -118,6 +118,17 @@
         'ldap://ldap.forumsys.com:389'
     )
 
+    user_group = os.environ.get('AUTH_LDAP_USER_GROUP', None)
+    admin_group = os.environ.get('AUTH_LDAP_ADMIN_GROUP', None)
+
+    if user_group is not None:
+        AUTH_LDAP_REQUIRE_GROUP = user_group
+
+    if admin_group is not None:
+        AUTH_LDAP_USER_FLAGS_BY_GROUP = {
+            "is_superuser": admin_group 
+        }
+
     use_direct_bind = bool(int(os.environ.get('AUTH_LDAP_DIRECT_BIND', '0')))
     if use_direct_bind:
         AUTH_LDAP_USER_DN_TEMPLATE = os.environ.get(