Is there documentation on how to create users and groups from LDAP/AD?

[kastl-ars]

Dear all,

I managed to get the LDAP connection to our ActiveDirectory working, but now I am struggling with the actual user and group configuration.

Where to configure - Squest or Django?

I found that I can create groups and users in both Squest and the Django admin interface. But I also found that groups/users created in one are not reflected in the other?

(Uses from LDAP/AD seem to appear in both, as well as the admin user)

Where to configure things properly?

Groups from LDAP?

Can I create the groups from LDAP/AD? If so, is there documentation on how to do that?

Can Squest add/remove users from groups following LDAP/AD?

Allow only users in a LDAP/AD group to login?

Can I restrict logon to only users in a group via the UI? Or do I have to tweak the ldap_config.py file to include this into the AUTH_LDAP_USER_SEARCH?

Manage LDAP/AD via Ansible/Terraform/OpenTofu/...

In case using groups and group membership from LDAP/AD is not possible:

Is there tooling to configure this? Ansible, Terraform, OpenTofu, ...?

Lots of questions, I know.

Kind Regards,
Johannes

[Sispheor]

1- Django group are not used by squest app. Use only what is in the Squest UI
2- No native link between Squest and LDAP group. But as we provide the way to insert a ldap python script you can tweak thing to create user once connected.
3- You need to reduce the scope of the LDAP search filter
4 - See answer 2.

[kastl-ars]

Thanks for the reply, Nicolas.

I found the django-auth-ldap examples where they restrict Logins or set the active/staff/superuser flags for a user based on AD-group membership:

# Simple group restrictions
AUTH_LDAP_REQUIRE_GROUP = 'cn=enabled,ou=django,ou=groups,dc=example,dc=com'

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    'is_active': 'cn=active,ou=django,ou=groups,dc=example,dc=com',
    'is_staff': 'cn=staff,ou=django,ou=groups,dc=example,dc=com',
    'is_superuser': 'cn=superuser,ou=django,ou=groups,dc=example,dc=com',
}

This means my question 3) is answered by AUTH_LDAP_REQUIRE_GROUP.

ad 2)

Can I use these flags (active/staff/superuser) in Squest automatically? I.e. add users to groups or give permissions to users?

• allow view permissions for all active users (inactive ones cannot login at all)
• allow permissions to "order services" for all active users
• allow edit permissions to staff users
• superusers are admins automatically, aren't they?

[Sispheor]

Only superuser is used by squest. And yes superuser is admin.

Perms are set via organizations and teams.

To place newly connected user into a team or an org I would go with a custom authentication script.

[kastl-ars]

Do you have an example for such a custom script?

And, as I have almost no knowledge of Django: You said before that groups in Django are not used by Squest. How would a script putting users into groups in django-ldap-auth be usable in Squest? Or did I misunderstand you before?

[Sispheor]

No examples on our side.

Only the superuser is used because it's a particular user in Django world which has all perms. Other native group are not used because we have created our own RBAC system.