PostgreSQL-LDAP Sync

LDAP is often used for a centralized user and role management in an enterprise environment. PostgreSQL offers LDAP as one of its authentication methods, but the users must already exist in the database, before the authentication can be used. There is currently no direct authorization of database users on LDAP, so roles and memberships have to be administered twice.

This program helps to solve the issue by synchronizing users, groups and their memberships from LDAP to PostgreSQL, where access to LDAP is read-only.

It is meant to run as a cron job.

🧑‍💻 Usage

1. Install the package from PyPi:

   pip install postgresql-ldap-sync
   

2. Import and build the Synchronizer object:

   from postgresql_ldap_sync.clients import DefaultPostgresClient
   from postgresql_ldap_sync.clients import GLAuthClient
   from postgresql_ldap_sync.matcher import DefaultMatcher
   from postgresql_ldap_sync.syncher import Synchronizer
   
   ldap_client = GLAuthClient(...)
   psql_client = DefaultPostgresClient(...)
   matcher = DefaultMatcher(...)
   
   syncher = Synchronizer(
       ldap_client=ldap_client,
       psql_client=psql_client,
       entity_matcher=matcher,
   )
   

3. Define the actions the synchronizer is allowed to take:

   user_actions = ["CREATE", "KEEP"]
   group_actions = ["CREATE", "KEEP"]
   member_actions = ["GRANT", "REVOKE", "KEEP"]
   

4. Run the synchronizer, as a cron-job:

   import time
   
   while True:
       syncher.sync_users(user_actions)
       syncher.sync_groups(group_actions)
       syncher.sync_group_memberships(member_actions)
       time.sleep(30)
   

🔧 Development

Dependencies

In order to install all the development packages:

poetry install --all-extras

Linting

All Python files are linted using Ruff, to run it:

tox -e lint

Testing

Project testing is performed using Pytest, to run them:

tox -e unit

export GLAUTH_USERNAME="..."
export GLAUTH_PASSWORD="..."
export POSTGRES_DATABASE="..."
export POSTGRES_USERNAME="..."
export POSTGRES_PASSWORD="..."

podman-compose -f compose.yaml up --detach && tox -e integration
podman-compose -f compose.yaml down

Release

Commits can be tagged to create releases of the package, in order to do so:

1. Bump up the version within the pyproject.toml file.
2. Add a new section to the CHANGELOG.md.
3. Commit + push the changes.
4. Trigger the release workflow.

🧡 Acknowledges

This project is a Python port of the popular pg-ldap-sync Ruby project.