Skip to content
Snippets Groups Projects

Set password of LDAP-logged-in user in database

Merged Set password of LDAP-logged-in user in database
feature/keep_local_password_ldap into master
Merged Nik | Klampfradler requested to merge feature/keep_local_password_ldap into master
  1. Feb 07, 2021
    • Nik | Klampfradler's avatar
      Set password of LDAP-logged-in user in database · f92f9bbe
      Nik | Klampfradler authored 
      Having a local password is needed to make changing passwords easier. In
order to catch password changes in a universal way and forward them to
backends (like LDAP, in this case), getting the old password first is
necessary to authenticate as that user to LDAP.

We buy the small insecurity of having a hash of the password in the
Django database in order to not require it to have global admin permissions
on the LDAP directory.

In addition, we fail early by raising PermissionDenied if LDAP cannot
authenticate the user, so as to not allow logins with ghost users that
were removed in LDAP or changed their password there.
      Verified
      f92f9bbe