Thanks for forwarding my message to the proper group, I'll continue from here.
Regarding your reply, this doesn't really answer the question of where I should be looking in the code to make the change correctly. And if this is in fact the right bit of code where users are looked up in LDAP, why did none of my changes have any affect on the outcome? Surely modifying the query to force an invalid user, such as "department=INVALID", should have prevented me from being able to log in with my user account? And finally, I don't understand your suggestion to modify the call to _get_ldapuser -- That function only accepts a username and attrlist for inputs, there is nothing in the function that allows setting a filter for the lookup. According to the notes for LdapAuth, _ldap_search seems to be called first to confirm the user exists, and only after that is successful does the function proceed to call _get_ldapuser to get the details. And since _ldap_search actually has a query passed to it, wouldn't this be the ideal place to add a filter to the criteria? > On Thursday, 30 July 2015 03:02:07 UTC+1, Dima Pasechnik wrote: > this looks fishy. You should modify the call to this > function in _get_ldapuser, not the function itself. > Check out the documentation on Python ldap module on how to create a proper > query in this case. > > > Or do not modify this call, but just parse what you get, and filter out users > which are not in Math. > > > HTH, > Dima -- You received this message because you are subscribed to the Google Groups "sage-support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/sage-support. For more options, visit https://groups.google.com/d/optout.
