ophix-auth-ldap
Your fleet admin login shouldn't be a separate account from the one IT already manages in Active Directory.
Provisioning a standalone username/password for every operator — and remembering to revoke it when they leave — is exactly the kind of drift that turns into a security incident nobody notices for months. ophix-auth-ldap lets any Ophix server authenticate directly against your Active Directory or LDAP directory: staff and superuser access stay in sync with AD group membership automatically, re-evaluated on every login.
Activated automatically when LDAP_SERVER_URI is set in .env. Uses AD defaults:
sAMAccountName for user lookup, NestedActiveDirectoryGroupType for nested group
support. Users are auto-provisioned on first login; AD attributes are synced on every
login.
Installation
python-ldap (a dependency of django-auth-ldap) is a C extension and requires
OpenLDAP development headers to be installed at the OS level before running pip install.
On Debian/Ubuntu:
sudo apt install libldap2-dev libsasl2-dev
Then:
pip install ophix-auth-ldap
Configuration (.env)
| Variable | Default | Purpose |
|---|---|---|
LDAP_SERVER_URI |
— | LDAP server URI — setting this activates the plugin (e.g. ldap://dc.example.com) |
LDAP_BIND_DN |
— | Bind DN for directory queries |
LDAP_BIND_PASSWORD |
— | Bind password |
LDAP_USER_SEARCH_BASE |
— | Base DN for user search (e.g. OU=Users,DC=example,DC=com) |
LDAP_GROUP_SEARCH_BASE |
(LDAP_USER_SEARCH_BASE) |
Base DN for group search, if different from the user search base |
LDAP_STAFF_GROUP |
— | Full DN of AD group whose members get is_staff=True |
LDAP_SUPERUSER_GROUP |
— | Full DN of AD group whose members get is_superuser=True |
LDAP_REQUIRE_GROUP |
— | Full DN of AD group — only members can log in (optional) |
LDAP_START_TLS |
False |
Set True to enable STARTTLS. Use ldaps:// URI for direct TLS on port 636. |
LDAP_LOG_LEVEL |
WARNING |
Logging verbosity for the LDAP backend |
Group membership is re-evaluated on every login — staff and superuser flags are kept in sync with AD group membership automatically.
Notes
- LDAP and SSO (
ophix-auth-oidc) can be active simultaneously — LDAP handles the admin username/password form, SSO handles the redirect flow. - Falls back gracefully if
django-auth-ldapis not installed — a warning is logged and the plugin has no effect.
1 maintainer
Metadata
1 maintainer
Release files for ophix-auth-ldap 2026.10.4.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ophix_auth_ldap-2026.10.4.1.tar.gz | 7.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ophix_auth_ldap-2026.10.4.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 14.7 kB
Release files / ophix_auth_ldap-2026.10.4.1.tar.gz
| Download URL | ophix_auth_ldap-2026.10.4.1.tar.gz |
|---|---|
| Size | 7.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9f6fc9c84870a92e431d972800282745d01d435f4a4ecc6840e8a0e9e35fbe34
|
|
BLAKE2b-256 checksum How to use checksums |
84fcaafa415fcd84ebe172cb34238679edbd8af09481fac90b089885c0a1c225
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.3
|
Release files / ophix_auth_ldap-2026.10.4.1-py3-none-any.whl
| Download URL | ophix_auth_ldap-2026.10.4.1-py3-none-any.whl |
|---|---|
| Size | 7.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b825f391d4152450b7d64a43c7cc0fad88cde660263a025ff5003dd455e595b7
|
|
BLAKE2b-256 checksum How to use checksums |
b4318d99fd4f831f4e65642fa175335211a0c63a3f5065c45fa7454496528df3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.3
|
