Metadata-Version: 2.4
Name: ophix-auth-ldap
Version: 2026.10.4.1
Summary: LDAP / Active Directory authentication plugin for Ophix Project Servers
Author: Ophix Project
License-Expression: MIT
Project-URL: Homepage, https://ophix.io
Project-URL: Documentation, https://github.com/ophixproject/ophix-auth-ldap#readme
Project-URL: Source, https://github.com/ophixproject/ophix-auth-ldap
Keywords: django,ophix,ldap,active directory,authentication
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Web Environment
Classifier: Framework :: Django
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: ophix-server-base>=2026.06.08.01
Requires-Dist: django-auth-ldap>=4.0

# ophix-auth-ldap

**Your fleet admin login shouldn't be a separate account from the one IT already manages in Active Directory.**

Provisioning a standalone username/password for every operator — and remembering to revoke it when they leave — is exactly the kind of drift that turns into a security incident nobody notices for months. `ophix-auth-ldap` lets any [Ophix](https://ophix.io) server authenticate directly against your Active Directory or LDAP directory: staff and superuser access stay in sync with AD group membership automatically, re-evaluated on every login.

Activated automatically when `LDAP_SERVER_URI` is set in `.env`. Uses AD defaults:
`sAMAccountName` for user lookup, `NestedActiveDirectoryGroupType` for nested group
support. Users are auto-provisioned on first login; AD attributes are synced on every
login.

---

## Installation

`python-ldap` (a dependency of `django-auth-ldap`) is a C extension and requires
OpenLDAP development headers to be installed at the OS level before running `pip install`.

On Debian/Ubuntu:

```bash
sudo apt install libldap2-dev libsasl2-dev
```

Then:

```bash
pip install ophix-auth-ldap
```

---

## Configuration (`.env`)

| Variable | Default | Purpose |
| --- | --- | --- |
| `LDAP_SERVER_URI` | — | LDAP server URI — setting this activates the plugin (e.g. `ldap://dc.example.com`) |
| `LDAP_BIND_DN` | — | Bind DN for directory queries |
| `LDAP_BIND_PASSWORD` | — | Bind password |
| `LDAP_USER_SEARCH_BASE` | — | Base DN for user search (e.g. `OU=Users,DC=example,DC=com`) |
| `LDAP_GROUP_SEARCH_BASE` | *(`LDAP_USER_SEARCH_BASE`)* | Base DN for group search, if different from the user search base |
| `LDAP_STAFF_GROUP` | — | Full DN of AD group whose members get `is_staff=True` |
| `LDAP_SUPERUSER_GROUP` | — | Full DN of AD group whose members get `is_superuser=True` |
| `LDAP_REQUIRE_GROUP` | — | Full DN of AD group — only members can log in (optional) |
| `LDAP_START_TLS` | `False` | Set `True` to enable STARTTLS. Use `ldaps://` URI for direct TLS on port 636. |
| `LDAP_LOG_LEVEL` | `WARNING` | Logging verbosity for the LDAP backend |

Group membership is re-evaluated on every login — staff and superuser flags are kept
in sync with AD group membership automatically.

---

## Notes

- LDAP and SSO (`ophix-auth-oidc`) can be active simultaneously — LDAP handles the
  admin username/password form, SSO handles the redirect flow.
- Falls back gracefully if `django-auth-ldap` is not installed — a warning is logged
  and the plugin has no effect.
