Tandoor-Recipes working with LDAP?

Smithoo4 · March 2, 2024, 5:21pm

Hello

Has anyone gotten Tandoor-Recipes installed on Nixos to work with LDAP? Below is my attempt, which is not working. When I try and log in with an LDAP user, I get:

The username and/or password you specified are not correct.

services.tandoor-recipes = {
    enable = true;
    port = 8888;
    address = "127.0.0.1";
    extraConfig = {
      SECRET_KEY = "something";
      DB_ENGINE = "django.db.backends.postgresql";
      POSTGRES_HOST = "127.0.0.1";
      POSTGRES_PORT = "5432";
      POSTGRES_USER = "djangouser";
      POSTGRES_PASSWORD = "something";
      POSTGRES_DB = "djangodb";
#      DEBUG = "1";
#      DEBUG_TOOLBAR = "1";
      LDAP_AUTH = "1";
      AUTH_LDAP_SERVER_URI = "ldap://127.0.0.1:3890/";
      AUTH_LDAP_BIND_DN = "uid=ro_admin,ou=people,dc=example,dc=com";
      AUTH_LDAP_BIND_PASSWORD = "password";
      AUTH_LDAP_USER_SEARCH_BASE_DN = "ou=people,dc=example,dc=com";
      AUTH_LDAP_USER_SEARCH_FILTER_STR = "(&(&(objectclass=person)(memberOf=cn=tandoor_users,ou=groups,dc=example,dc=com))(uid=%(user)s))";
      AUTH_LDAP_USER_ATTR_MAP = "{'first_name': 'givenName', 'last_name': 'sn', 'email': 'mail'}";
      AUTH_LDAP_ALWAYS_UPDATE_USER = "1";
      AUTH_LDAP_CACHE_TIMEOUT = "3600";
    };
  };  

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15;
    ensureDatabases = [ "djangodb" ];
    ensureUsers = [
      { name = "djangouser"; }
    ];
    initialScript = pkgs.writeText "psqlSetupScript.sql" ''
      CREATE DATABASE djangodb;
      CREATE USER djangouser WITH PASSWORD 'something';
      GRANT ALL PRIVILEGES ON DATABASE djangodb TO djangouser;
      ALTER DATABASE djangodb OWNER TO djangouser;
      ALTER ROLE djangouser SET client_encoding TO 'utf8';
      ALTER ROLE djangouser SET default_transaction_isolation TO 'read committed';
      ALTER ROLE djangouser SET timezone TO 'UTC';
      ALTER USER djangouser WITH SUPERUSER;
    '';
  };



services.nginx.virtualHosts."tandoor.example.com" = {
    enableACME = true;
    forceSSL = true;

    locations."/" = {
      proxyPass = "http://127.0.0.1:8888";
      proxyWebsockets = true;
    };
  };

Also, I cannot get the debug option in Tandoor to work, when I try and enable it DEBUG = "1"; the
tandoor-recipes.service will not start and give the following:

Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:                  ^^^^^^^^^^^^^^^^^^^^^^^
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:   File "/nix/store/wkl8fnxj2jmf8vjv0bjn4mv007nxzrwn-python3.11-Django-4.2.10/lib/python3.11/site-packages/django/apps/config.py", line 193, in create
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:     import_module(entry)
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:   File "/nix/store/qzaa6lxhvlbb9nn2v6ssppmqg4c3pb1p-python3-3.11.8/lib/python3.11/importlib/__init__.py", line 126, in import_module
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:     return _bootstrap._gcd_import(name[level:], package, level)
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:   File "<frozen importlib._bootstrap>", line 1204, in _gcd_import
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:   File "<frozen importlib._bootstrap>", line 1176, in _find_and_load
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]:   File "<frozen importlib._bootstrap>", line 1140, in _find_and_load_unlocked
Mar 02 10:15:56 auir tandoor-recipes-pre-start[14873]: ModuleNotFoundError: No module named 'debug_toolbar'

Here are some links I have been using:

github.com

lldap/lldap/blob/3d8aafaa9d3aa62890966af041dc05822be15716/example_configs/tandoor_recipes.md

# Tandoor Recipes LDAP configuration

## LDAP settings are defined by environmental variables as defined in [Tandoor's documentation](https://docs.tandoor.dev/features/authentication/#ldap)

### #Required#
It is recommended to have a read-only account to bind to
```
LDAP_AUTH=1
AUTH_LDAP_SERVER_URI=ldap://lldap:3890/
AUTH_LDAP_BIND_DN=uid=ro_admin,ou=people,DC=example,DC=com
AUTH_LDAP_BIND_PASSWORD=CHANGEME
AUTH_LDAP_USER_SEARCH_BASE_DN=ou=people,DC=example,DC=com
```

### #Optional#

By default it authenticates everybody identified by the search base DN, this allows you to pull certain users from the ```tandoor_users``` group
```
AUTH_LDAP_USER_SEARCH_FILTER_STR=(&(&(objectclass=person)(memberOf=cn=tandoor_users,ou=groups,dc=example,dc=com))(uid=%(user)s))
```

This file has been truncated. show original

Smithoo4 · March 4, 2024, 1:17am

So I wipe ever clean and started from scratch, and now the ldap authentication is work. I am not really sure what the issue was, but it now seems fine.

However, I still have not been able to get the debug option to work.

Cheers,
Morgan Smith