paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-14 10:57:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

ldap: Clarify order of role processing by AUTH_LDAP_USER_FLAGS_BY_GROUP.

Browse Source
This commit is contained in:
Mateusz Mandera
2024-02-20 21:04:02 +01:00
committed by Tim Abbott
parent 834dbd552b
commit 8349437aff
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/production/authentication-methods.md
View File

@@ -350,14 +350,23 @@ the next time you run `manage.py sync_ldap_user_data`.
Other fields you may want to sync from LDAP include: Other fields you may want to sync from LDAP include:
- Boolean flags describing the user's level of permission: - Boolean flags describing the user's role / permission level:
`is_realm_owner` (Organization owner), `is_realm_admin` (Organization administrator), `is_realm_owner` (Organization owner), `is_realm_admin` (Organization administrator),
`is_guest` (Guest), `is_moderator` (Moderator). You can use the `is_guest` (Guest), `is_moderator` (Moderator). You can use the
[AUTH_LDAP_USER_FLAGS_BY_GROUP][django-auth-booleans] feature of [AUTH_LDAP_USER_FLAGS_BY_GROUP][django-auth-booleans] feature of
`django-auth-ldap` to configure a group to get any of these permissions. `django-auth-ldap` to configure a group to get any of these permissions.
(Don't use this to modify other boolean flags such as (Don't use this to modify other boolean flags such as
`is_active` as that can introduce inconsistent state in the database; `is_active` as that can introduce inconsistent state in the database;
see the above discussion of automatic deactivation for how to do that properly). see the above discussion of automatic deactivation for how to do
that properly).
Because the upstream `django-auth-ldap` library processes flags in
the order they are listed in `AUTH_LDAP_USER_FLAGS_BY_GROUP`, flags
should be listed in order from **lowest** to **highest** precedence
(i.e., declare the `is_guest` group first and the `is_realm_owner`
group last, if you'd like a user who is in both groups to be a realm
owner rather than a guest).
- String fields like `default_language` (e.g. `en`) or `timezone`, if - String fields like `default_language` (e.g. `en`) or `timezone`, if
you have that data in the right format in your LDAP database. you have that data in the right format in your LDAP database.