Skip to main content

devpi-ldap: LDAP authentication for devpi-server

Project description

devpi-ldap: LDAP authentication for devpi-server

Latest Version

For use with devpi-server >= 2.1.0.


devpi-ldap needs to be installed alongside devpi-server.

You can install it with:

pip install devpi-ldap

For devpi-server there is no configuration needed to activate the plugin, as it will automatically discover the plugin through calling hooks using the setuptools entry points mechanism. However, you need to pass a path with a YAML config file to devpi-server, via the --ldap-config command-line option.

Details about LDAP configuration below.


A script named devpi-ldap can be used to test your LDAP configuration.

To configure LDAP, create a yaml file with a dictionary containing another dictionary under the devpi-ldap key with the following options:

The url of the LDAP server. Using ldaps:// enables SSL. No certificate validation is performed at the moment.
The template to generate the distinguished name for the user. If the structure is fixed, this is faster than specifying a user_search, but devpi-server can’t know whether a user exists or not.
If you can’t or don’t want to use user_template, then these are the search settings for the users distinguished name. You can use username in the search filter. See specifics below.
The search settings for the group objects of the user. You can use username and userdn (the distinguished name) in the search filter. See specifics below.
Whether to follow referrals. This needs to be set to false in many cases when using LDAP via Active Directory on Windows. The default is true.
Report all failed authentication attempts as unknown instead of reject. This is useful e.g. if using the provided credentials to bind to ldap, in which case we cannot distinguish authentication failures from unknown users. unknown is required to let other auth hooks attempt to authenticate the user.
The timeout for connections to the LDAP server. Defaults to 10 seconds.
Parameters to the ldap3.Tls object for Transport Layer Security, used with LDAPS connections.

The user_search and group_search settings are dictionaries with the following options:

The base location from which to search.
The search filter. To use replacements, put them in curly braces. Example: (&(objectClass=group)(member={userdn}))
The scope for the search. Valid values are base-object, single-level and whole-subtree. The default is whole-subtree.
The name of the attribute which contains the user DN which will be used to check the user’s password. devpi-ldap will extract this attribute from the search results and attempt to bind to the LDAP server using this DN and the password supplied by the user. If this bind succeeds, access is granted.
The distinguished name of the user which should be used for the search operation. For user_search, if you don’t have anonymous user search or for group_search if the users can’t search their own groups, then you need to set this to a user which has the necessary rights.
The password for the user in userdn.

The YAML file should then look similar to this:

  url: ldap://
  user_template: CN={username},CN=Partition1,DC=Example,DC=COM
    base: CN=Partition1,DC=Example,DC=COM
    filter: (&(objectClass=group)(member={userdn}))
    attribute_name: CN

An example with user search and Active Directory might look like this:

  url: ldap://
    base: CN=Partition1,DC=Example,DC=COM
    filter: (&(objectClass=user)(sAMAccountName={username}))
    attribute_name: distinguishedName
    base: CN=Partition1,DC=Example,DC=COM
    filter: (&(objectClass=group)(member={userdn}))
    attribute_name: CN


2.0.0 - 2021-05-16

  • Add timeout option for LDAP connections. Defaults to 10 seconds.
  • Use safe_load to read YAML config.
  • The reject_as_unknown option is now true by default.
  • Drop support for Python < 3.6, support for Python 3.x will end with their respective EOLs.
  • Fix deprecation warning with devpi-server 6.0.0.
  • Fix pluggy deprecation warning.
  • Require at least devpi-server 5.0.0.

1.2.2 - 2018-05-28

  • More ldap3 2.x fixes. [fschulze]

1.2.1 - 2018-05-25

  • Fix compatibility with ldap3 2.x. [fschulze, abrasive (James Laird-Wah)]
  • Stopped testing with Python 2.6, but no changes made which break compatibility.

1.2.0 - 2016-03-25

  • Add support for TLS parameters in the config. [jaraco (Jason R. Coombs)]
  • Allow invocation via python -m devpi-ldap and fix cli for Python 3. [jaraco]
  • Add exit codes to testing script when authentication fails. [jaraco]

1.1.1 - 2016-01-28

  • set minimum version of ldap3 library, which adds hiding of password in debug logging. [cannatag (Giovanni Cannata), rodcloutier (Rodrigue Cloutier), fschulze]
  • change dependency for the ldap library, which was renamed. [kumy]
  • fix issue #5: dn and distinguishedName may appear as a top level response attribute instead of the attributes list. [kainz (Bryon Roché)]
  • fix issue #24: Ignore additional search result data. [bonzani (Patrizio Bonzani), fschulze]

1.1.0 - 2014-11-10

  • add reject_as_unknown option [davidszotten (David Szotten)]

1.0.1 - 2014-10-10

  • fix the plugin hook [fschulze]

1.0.0 - 2014-09-22

  • initial release [fschulze (Florian Schulze)]

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for devpi-ldap, version 2.0.0
Filename, size File type Python version Upload date Hashes
Filename, size devpi_ldap-2.0.0-py2.py3-none-any.whl (7.9 kB) File type Wheel Python version 2.7 Upload date Hashes View
Filename, size devpi-ldap-2.0.0.tar.gz (12.1 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page