Skip to content
Snippets Groups Projects
  • Nik | Klampfradler's avatar
    f92f9bbe
    Set password of LDAP-logged-in user in database · f92f9bbe
    Nik | Klampfradler authored
    Having a local password is needed to make changing passwords easier. In
    order to catch password changes in a universal way and forward them to
    backends (like LDAP, in this case), getting the old password first is
    necessary to authenticate as that user to LDAP.
    
    We buy the small insecurity of having a hash of the password in the
    Django database in order to not require it to have global admin permissions
    on the LDAP directory.
    
    In addition, we fail early by raising PermissionDenied if LDAP cannot
    authenticate the user, so as to not allow logins with ghost users that
    were removed in LDAP or changed their password there.
    Verified
    f92f9bbe
    History
    Set password of LDAP-logged-in user in database
    Nik | Klampfradler authored
    Having a local password is needed to make changing passwords easier. In
    order to catch password changes in a universal way and forward them to
    backends (like LDAP, in this case), getting the old password first is
    necessary to authenticate as that user to LDAP.
    
    We buy the small insecurity of having a hash of the password in the
    Django database in order to not require it to have global admin permissions
    on the LDAP directory.
    
    In addition, we fail early by raising PermissionDenied if LDAP cannot
    authenticate the user, so as to not allow logins with ghost users that
    were removed in LDAP or changed their password there.