yesod-auth-ldap-native-0.1.0.0: Yesod LDAP authentication plugin

Copyright(C) 2015 Maciej Kazulak
LicenseBSD-style (see the file LICENSE)
MaintainerMaciej Kazulak <kazulakm@gmail.com>
Stabilityexperimental
Portabilityportable
Safe HaskellNone
LanguageHaskell2010

Yesod.Auth.LdapNative

Contents

Description

Yesod LDAP authentication plugin using Haskell native LDAP client.

Synopsis

Usage

This module follows the service bind approach. I will bite if you ask for prefix/suffix stuff.

Basic configuration in Foundation.hs:

ldapConf :: LdapAuthConf
ldapConf = 
    setHost (Secure "127.0.0.1") $ setPort 636
  $ mkLdapConf "cn=Manager,dc=example,dc=com" "v3ryS33kret" "ou=people,dc=example,dc=com"

And add authLdap ldapConf to your authPlugins.

For plain connection (only for testing!):

setHost (Plain "127.0.0.1")

For additional group authentication use setGroupQuery:

ldapConf :: LdapAuthConf
ldapConf = 
    setGroupQuery (Just $ mkGroupQuery "ou=group,dc=example,dc=com" "cn" "it" "memberUid")
  $ setHost (Secure "127.0.0.1") $ setPort 636
  $ mkLdapConf "cn=yourapp,ou=services,dc=example,dc=com" "v3ryS33kret" "ou=people,dc=example,dc=com"

In the example above user jdoe will only be successfully authenticated when:

  • service bind using the provided account is successful
  • exactly one entry with objectclass=posixAccount and uid=jdoe exists somewhere in ou=people,dc=example,dc=com
  • at least one group exists with cn=it and memberUid=jdoe in ou=group,dc=example,dc=com

Fine control of the queries is available with setUserQuery and setGroupQuery.

When testing or during initial configuration consider using setDebug - set to 1 to enable. This will give you exact error condition instead of "That is all we know". Never use it in production though as it may reveal sensitive information.

Refer to 'ldap-client' documentation for details.

Plugin Configuration

LDAP Configuration

data LdapAuthConf Source

LDAP configuration.

Details hidden on purpose. Use mkLdapConf to create default config and functions below to adjust to taste.

data LdapAuthQuery Source

Query parameters.

Standard LDAP query parameters except filter is a function of the username.

Constructors

LdapAuthQuery Dn (Mod Search) (Text -> Filter) [Attr] 

mkLdapConf Source

Arguments

:: Text

bindDn

-> Text

bindPw

-> Text

user query baseDn

-> LdapAuthConf 

Default LDAP configuration.

mkGroupQuery Source

Arguments

:: Text

baseDn

-> Text

group name attr

-> Text

group name

-> Text

member attr

-> LdapAuthQuery 

Default LDAP group query.

Re-exports

data Host :: *

LDAP host.

Constructors

Plain String

Plain LDAP. Do not use!

Insecure String

LDAP over TLS without the certificate validity check. Only use for testing!

Secure String

LDAP over TLS. Use!

Instances