atoti.LdapConfig(The config to delegate authentication to an LDAP provider. The user’s roles can be defined using
*,
username_case_conversion: ‘upper’ | ‘lower’ | None =None,
url: str,
base_dn: str,
manager_dn: str | None =None,
manager_password: str | None =None,
user_search_filter: str ='(uid={0})',
user_search_base: str ='',
group_search_filter: str ='(uniqueMember={0})',
group_search_base: str | None =None,
group_role_attribute_name: str ='cn',
)
atoti.security.Security.ldap and individual_roles.
Attributes
url
The LDAP URL including the protocol and port.base_dn
The base Distinguished Name of the directory service.manager_dn
The Distinguished Name (DN) used to log into the Directory Service and to search for user accounts. IfNone, the connection to the service will be done anonymously.
manager_password
The password for the manager account specified in the manager_dn attribute.user_search_filter
The filter to search for users. The substituted parameter is the user’s login name.username_case_conversion
The case conversion applied to the username of a user when they authenticate through this provider. This provider is generally case insensitive: A user named Alex can log in as"alex", "Alex", or "ALEX".
individual_roles and other username-keyed mappings are case sensitive though, so each spelling is a different user and Alex is denied their roles unless they log in with the exact spelling these roles are registered under.
A conversion collapses all the spellings into one: with session.security.individual_roles == {"alex": {"ROLE_USER"}}, set username_case_conversion to "lower".
Added in version 6.2.1:
None keeps the username’s case unchanged.