/usr/share/doc/python-django-auth-ldap-doc/html/groups.html is in python-django-auth-ldap-doc 1.1.8-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Working With Groups — django-auth-ldap 1.1.8 documentation</title>
<link rel="stylesheet" href="_static/default.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: './',
VERSION: '1.1.8',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="top" title="django-auth-ldap 1.1.8 documentation" href="index.html" />
<link rel="next" title="User objects" href="users.html" />
<link rel="prev" title="Authentication" href="authentication.html" />
</head>
<body>
<div class="related">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="users.html" title="User objects"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="authentication.html" title="Authentication"
accesskey="P">previous</a> |</li>
<li><a href="index.html">django-auth-ldap 1.1.8 documentation</a> »</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body">
<div class="section" id="working-with-groups">
<h1>Working With Groups<a class="headerlink" href="#working-with-groups" title="Permalink to this headline">¶</a></h1>
<div class="section" id="types-of-groups">
<h2>Types of Groups<a class="headerlink" href="#types-of-groups" title="Permalink to this headline">¶</a></h2>
<p>Working with groups in LDAP can be a tricky business, mostly because there are
so many different kinds. This module includes an extensible API for working with
any kind of group and includes implementations for the most common ones.
<a class="reference internal" href="reference.html#django_auth_ldap.config.LDAPGroupType" title="django_auth_ldap.config.LDAPGroupType"><tt class="xref py py-class docutils literal"><span class="pre">LDAPGroupType</span></tt></a> is a base class whose concrete
subclasses can determine group membership for particular grouping mechanisms.
Three built-in subclasses cover most grouping mechanisms:</p>
<blockquote>
<div><ul class="simple">
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.PosixGroupType" title="django_auth_ldap.config.PosixGroupType"><tt class="xref py py-class docutils literal"><span class="pre">PosixGroupType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.MemberDNGroupType" title="django_auth_ldap.config.MemberDNGroupType"><tt class="xref py py-class docutils literal"><span class="pre">MemberDNGroupType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.NestedMemberDNGroupType" title="django_auth_ldap.config.NestedMemberDNGroupType"><tt class="xref py py-class docutils literal"><span class="pre">NestedMemberDNGroupType</span></tt></a></li>
</ul>
</div></blockquote>
<p>posixGroup objects are somewhat specialized, so they get their own class. The
other two cover mechanisms whereby a group object stores a list of its members
as distinguished names. This includes groupOfNames, groupOfUniqueNames, and
Active Directory groups, among others. The nested variant allows groups to
contain other groups, to as many levels as you like. For convenience and
readability, several trivial subclasses of the above are provided:</p>
<blockquote>
<div><ul class="simple">
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.GroupOfNamesType" title="django_auth_ldap.config.GroupOfNamesType"><tt class="xref py py-class docutils literal"><span class="pre">GroupOfNamesType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.NestedGroupOfNamesType" title="django_auth_ldap.config.NestedGroupOfNamesType"><tt class="xref py py-class docutils literal"><span class="pre">NestedGroupOfNamesType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.GroupOfUniqueNamesType" title="django_auth_ldap.config.GroupOfUniqueNamesType"><tt class="xref py py-class docutils literal"><span class="pre">GroupOfUniqueNamesType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.NestedGroupOfUniqueNamesType" title="django_auth_ldap.config.NestedGroupOfUniqueNamesType"><tt class="xref py py-class docutils literal"><span class="pre">NestedGroupOfUniqueNamesType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.ActiveDirectoryGroupType" title="django_auth_ldap.config.ActiveDirectoryGroupType"><tt class="xref py py-class docutils literal"><span class="pre">ActiveDirectoryGroupType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.NestedActiveDirectoryGroupType" title="django_auth_ldap.config.NestedActiveDirectoryGroupType"><tt class="xref py py-class docutils literal"><span class="pre">NestedActiveDirectoryGroupType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.OrganizationalRoleGroupType" title="django_auth_ldap.config.OrganizationalRoleGroupType"><tt class="xref py py-class docutils literal"><span class="pre">OrganizationalRoleGroupType</span></tt></a></li>
<li><a class="reference internal" href="reference.html#django_auth_ldap.config.NestedOrganizationalRoleGroupType" title="django_auth_ldap.config.NestedOrganizationalRoleGroupType"><tt class="xref py py-class docutils literal"><span class="pre">NestedOrganizationalRoleGroupType</span></tt></a></li>
</ul>
</div></blockquote>
</div>
<div class="section" id="finding-groups">
<h2>Finding Groups<a class="headerlink" href="#finding-groups" title="Permalink to this headline">¶</a></h2>
<p>To get started, you’ll need to provide some basic information about your LDAP
groups. <a class="reference internal" href="reference.html#std:setting-AUTH_LDAP_GROUP_SEARCH"><tt class="xref std std-setting docutils literal"><span class="pre">AUTH_LDAP_GROUP_SEARCH</span></tt></a> is an
<a class="reference internal" href="reference.html#django_auth_ldap.config.LDAPSearch" title="django_auth_ldap.config.LDAPSearch"><tt class="xref py py-class docutils literal"><span class="pre">LDAPSearch</span></tt></a> object that identifies the set of
relevant group objects. That is, all groups that users might belong to as well
as any others that we might need to know about (in the case of nested groups,
for example). <a class="reference internal" href="reference.html#std:setting-AUTH_LDAP_GROUP_TYPE"><tt class="xref std std-setting docutils literal"><span class="pre">AUTH_LDAP_GROUP_TYPE</span></tt></a> is an instance of the class
corresponding to the type of group that will be returned by
<a class="reference internal" href="reference.html#std:setting-AUTH_LDAP_GROUP_SEARCH"><tt class="xref std std-setting docutils literal"><span class="pre">AUTH_LDAP_GROUP_SEARCH</span></tt></a>. All groups referenced elsewhere in the
configuration must be of this type and part of the search results.</p>
<div class="highlight-python"><div class="highlight"><pre><span class="kn">import</span> <span class="nn">ldap</span>
<span class="kn">from</span> <span class="nn">django_auth_ldap.config</span> <span class="kn">import</span> <span class="n">LDAPSearch</span><span class="p">,</span> <span class="n">GroupOfNamesType</span>
<span class="n">AUTH_LDAP_GROUP_SEARCH</span> <span class="o">=</span> <span class="n">LDAPSearch</span><span class="p">(</span><span class="s">"ou=groups,dc=example,dc=com"</span><span class="p">,</span>
<span class="n">ldap</span><span class="o">.</span><span class="n">SCOPE_SUBTREE</span><span class="p">,</span> <span class="s">"(objectClass=groupOfNames)"</span>
<span class="p">)</span>
<span class="n">AUTH_LDAP_GROUP_TYPE</span> <span class="o">=</span> <span class="n">GroupOfNamesType</span><span class="p">()</span>
</pre></div>
</div>
</div>
<div class="section" id="limiting-access">
<h2>Limiting Access<a class="headerlink" href="#limiting-access" title="Permalink to this headline">¶</a></h2>
<p>The simplest use of groups is to limit the users who are allowed to log in. If
<a class="reference internal" href="reference.html#std:setting-AUTH_LDAP_REQUIRE_GROUP"><tt class="xref std std-setting docutils literal"><span class="pre">AUTH_LDAP_REQUIRE_GROUP</span></tt></a> is set, then only users who are members of
that group will successfully authenticate. <a class="reference internal" href="reference.html#std:setting-AUTH_LDAP_DENY_GROUP"><tt class="xref std std-setting docutils literal"><span class="pre">AUTH_LDAP_DENY_GROUP</span></tt></a> is
the reverse: if given, members of this group will be rejected.</p>
<div class="highlight-python"><div class="highlight"><pre><span class="n">AUTH_LDAP_REQUIRE_GROUP</span> <span class="o">=</span> <span class="s">"cn=enabled,ou=groups,dc=example,dc=com"</span>
<span class="n">AUTH_LDAP_DENY_GROUP</span> <span class="o">=</span> <span class="s">"cn=disabled,ou=groups,dc=example,dc=com"</span>
</pre></div>
</div>
<p>When groups are configured, you can always get the list of a user’s groups from
<tt class="docutils literal"><span class="pre">user.ldap_user.group_dns</span></tt> or <tt class="docutils literal"><span class="pre">user.ldap_user.group_names</span></tt>. More advanced
uses of groups are covered in the next two sections.</p>
</div>
</div>
</div>
</div>
</div>
<div class="sphinxsidebar">
<div class="sphinxsidebarwrapper">
<h3><a href="index.html">Table Of Contents</a></h3>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="install.html">Installation</a></li>
<li class="toctree-l1"><a class="reference internal" href="authentication.html">Authentication</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="">Working With Groups</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#types-of-groups">Types of Groups</a></li>
<li class="toctree-l2"><a class="reference internal" href="#finding-groups">Finding Groups</a></li>
<li class="toctree-l2"><a class="reference internal" href="#limiting-access">Limiting Access</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="users.html">User objects</a></li>
<li class="toctree-l1"><a class="reference internal" href="permissions.html">Permissions</a></li>
<li class="toctree-l1"><a class="reference internal" href="multiconfig.html">Multiple LDAP Configs</a></li>
<li class="toctree-l1"><a class="reference internal" href="logging.html">Logging</a></li>
<li class="toctree-l1"><a class="reference internal" href="performance.html">Performance</a></li>
<li class="toctree-l1"><a class="reference internal" href="example.html">Example Configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="reference.html">Reference</a></li>
<li class="toctree-l1"><a class="reference internal" href="changes.html">Change Log</a></li>
</ul>
<h4>Previous topic</h4>
<p class="topless"><a href="authentication.html"
title="previous chapter">Authentication</a></p>
<h4>Next topic</h4>
<p class="topless"><a href="users.html"
title="next chapter">User objects</a></p>
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/groups.txt"
rel="nofollow">Show Source</a></li>
</ul>
<div id="searchbox" style="display: none">
<h3>Quick search</h3>
<form class="search" action="search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
<p class="searchtip" style="font-size: 90%">
Enter search terms or a module, class or function name.
</p>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="users.html" title="User objects"
>next</a> |</li>
<li class="right" >
<a href="authentication.html" title="Authentication"
>previous</a> |</li>
<li><a href="index.html">django-auth-ldap 1.1.8 documentation</a> »</li>
</ul>
</div>
<div class="footer">
© Copyright 2009, Peter Sagerson.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.2.2.
</div>
</body>
</html>
|