855384 - Use native LDAP lookup to look up group membership

Status: RESOLVED FIXED

(Socorro :: General, task)

Description

[Peter Bengtsson [:peterbe]]

Whenever someone authenticates with Persona we should reduce if they're actually welcome if they belong to a certain LDAP group.

(NB: if we can resolve https://bugzilla.mozilla.org/show_bug.cgi?id=855382 we can resolve/wontfix this bug)

Comment 1

[Peter Bengtsson [:peterbe]]

I felt compelled to get started on this. Maybe not to finish it but to at least get a start to see if I can connect at all. 

But then it hit me: I have NO IDEA what the spec is. :)

I think it boils down to: What groups do users specifically have to belong to to be able to sign in?

Comment 2

[Robert Helmer [:rhelmer]]

(In reply to Peter Bengtsson [:peterbe] from comment #1)
> I felt compelled to get started on this. Maybe not to finish it but to at
> least get a start to see if I can connect at all. 
> 
> But then it hit me: I have NO IDEA what the spec is. :)
> 
> I think it boils down to: What groups do users specifically have to belong
> to to be able to sign in?

You should be able to find all the info you need in /etc/socorro/web/ldap.php on dev/stage/prod

Comment 3

[Peter Bengtsson [:peterbe]]

Pull Request: https://github.com/mozilla/socorro-crashstats/pull/322

Notice, I added a little tool which you can use like this::

 $ ./manage.py test-ldap-lookup [e-mail]
 YES!
 $ ./manage.py test-ldap-lookup [e-mail]
 No go :(

And here's a little secret that I'm not 101% confident in, but hopefully it'll spread that Just Works(tm) feeling::

 $ ./manage.py test-ldap-lookup [e-mail]
 YES!

I.e. you can use your LDAP alias to log in.

Comment 5

[[github robot]]

Commit pushed to master at https://github.com/mozilla/socorro-crashstats

https://github.com/mozilla/socorro-crashstats/commit/6ff76fcaffd767bec9f4105a8fef1a2098a18fba
bug 855384 - Use native LDAP lookup to look up group membership, r=adrian

Comment 6

[Peter Bengtsson [:peterbe]]

All coding is done. Now we just need to wait for the IT to set up the binduser and password on stage and prod
https://bugzilla.mozilla.org/show_bug.cgi?id=857695