Features

• LDAP access via node.ext.ldap

• Application integration into cone.app

• Integration into cone.ugm

• POSIX support

• Samba support

Prerequirements

lxml, python-ldap and openldap gets compiled, the required dev headers must be installed on the system.

On debian based systems install:

$ apt-get install -y libxml2-dev libxslt1-dev
$ apt-get install -y libsasl2-dev libssl-dev libdb-dev

Installation

cone.ldap contains a Makefile. Download or checkout package and run:

cone.ldap$ make install

Start Test LDAP server with appropriate LDIF layer:

cone.ldap$ make start-ldap-gon-10-10

Start the application:

cone.ldap$ make run-gon-10-10

and browse http://localhost:8081/. Default admin user password is admin.

The “roles” behavior in the principal form is only displayed if roles configuration is sane. The LDIF imported for test layer does not provide the roles container by default. Browse “Settings -> LDAP Roles” and perform “create roles container” action if you want to enable roles in the demo.

Note: If python_ldap fails, don’t use buildout offline mode!

General

For customizing the plugin, make an integration package and include it in your setup.

Application configuration

To define the LDAP related configuration locations, provide the following settings in your application ini file.

# LDAP UGM backend activation
ugm.backend = ldap

# Basic LDAP server configuration
ldap.server_config = /path/to/ldap_server.xml

# LDAP UGM backend related configuration
ldap.users_config = /path/to/ldap_users.xml
ldap.groups_config = /path/to/ldap_groups.xml
ldap.roles_config = /path/to/ldap_roles.xml

Examples of these configuration file can be found at cfg folder of the source package.

UGM Default values and default value callbacks

Depending on the LDAP object classes used for users and groups, more or less attributes are required for the entries. Maybe not all of these attributes should be visible to the user. Some might even require to be computed. Therefor the plugin supports default values and default value callbacks.

Default values and callbacks are registered via factory_defaults.users, factory_defaults.groups and factory_defaults.roles.

from cone.ldap.settings import factory_defaults

The factory defaults can be static values.

factory_defaults.user['someField'] = '12345'

Default value callbacks get the principal node and id as attributes.

def some_field_callback(node, id):
    return 'some computed value'

factory_defaults.user['someField'] = some_field_callback

Samba support

Example configuration to enable samba support.

from cone.ldap.settings import factory_defaults
from node.ext.ldap.ugm import posix
from node.ext.ldap.ugm import shadow
from node.ext.ldap.ugm import samba

samba.SAMBA_LOCAL_SID = 'S-1-5-21-1234567890-1234567890-1234567890'
samba.SAMBA_DEFAULT_DOMAIN = 'yourdomain'
samba.SAMBA_PRIMARY_GROUP_SID = 'S-1-5-21-1234567890-1234567890-1234567890-123'

user = factory_defaults.user
user['gidNumber'] = posix.memberGid
user['loginShell'] = posix.loginShell
user['shadowFlag'] = shadow.shadowFlag
user['shadowMin'] = shadow.shadowMin
user['shadowMax'] = shadow.shadowMax
user['shadowWarning'] = shadow.shadowWarning
user['shadowInactive'] = shadow.shadowInactive
user['shadowLastChange'] = shadow.shadowLastChange
user['shadowExpire'] = shadow.shadowExpire
user['sambaSID'] = samba.sambaUserSID
user['sambaDomainName'] = samba.sambaDomainName
user['sambaPrimaryGroupSID'] = samba.sambaPrimaryGroupSID
user['sambaAcctFlags'] = samba.sambaAcctFlags
user['sambaPwdLastSet'] = samba.sambaPwdLastSet

group = factory_defaults.group
factory_defaults.group['memberUid'] = posix.memberUid

2.0.0 (2026-10-24)

• Modernise the code ruff flags as outdated: u'' prefixes, class X(object). Behaviour unchanged. super(Class, self) is kept, see cone.app. [rnix]

• Add qa.ruff domain to Makefile and pin the ruff rule selection in pyproject.toml, make check runs ruff check. [rnix]

• Check out cone.app, cone.ugm and treibstoff from their 2.0 branches in mx.ini and pin setuptools<82.0.0. make install failed on the cone.ugm>1.99 requirement, and pyramid 2.0.2 still imports pkg_resources, which setuptools 82 removed. [rnix]

• Bootstrap 5 styles.

1.1.0 (2026-02-03)

• Refactor package layout to use pyproject.toml and implicit namespace packages. [rnix]

• Adopt Settings UI changes from cone.app. [rnix]

• Use webresource for resource registration. [rnix]

0.3 (2025-10-25)

• Pin upper versions of dependencies. [rnix]

0.2 (2022-12-05)

• Move users_expires_attr and users_expires_unit settings from cone.ugm, since they always have been used only for LDAP UGM backend.

0.1 (2020-07-09)

• Initial release.