jupyterhub with authentication on Active Directory

[ousbiz]

Hello,

I want to set up jupyterhub with authentication on Active Directory.

is it possible?

I wonder if someone has already done this use case.

With the default setting defined on https://github.com/jupyterhub/ldapauthenticator
for operation with the LDAP , what are the basic parameters to work with Active Directory in Jupyterhub_config.py ?

What does add or remove to a parameterization with AD ?

it has a specific development python do?

This is some of example of my Active Directory parameters, how can i adapt ?

Thanks for your help !!

nt_domain = org

ldap_url = ldap://127.0.0.1

base_dn = dc=org,dc=com,dc=wikipost

bind_dn = CN=call app,OU=custumer,OU=people and marketing,DC=org,DC=com,DC=wikipost

bind_password = *************

group_filter = (objectCategory=Group)

user_name_attr = sAMAccountName

user_filter = (objectClass=User)

group_member_attr = member

group_name_attr = cn

[yuvipanda]

I see some patches that will probably help with this, see #12

[ousbiz]

thank you,

i have fixed my problem, i will post it on github.

2016-08-25 3:08 GMT+02:00 Yuvi Panda notifications@github.com:

I see some patches that will probably help with this, see #12
#12

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#13 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ATxPBwuH-9AQMmUybWQM4PSxDAYUa6fFks5qjOsPgaJpZM4JdAYr
.

[yourinoelnelson]

@ousbiz Did you ever get around to posting how you fixed your issue, I can't seem to connect to Active Directory? I keep getting an invalid password error and I know for a fact that I have the right password! Any help would be greatly appreciated!

[rdewaele]

If it helps, I just got this authenticator working with AD (including allowed groups).

Two main things were required:

• Latest version (at the time of writing): see pip install not up to date #20 (includes my workaround, but if newer version got published to pip this can be skipped of course)
• Using the domain\user style in bind_dn_template, for example: c.LDAPAuthenticator.bind_dn_template = 'OUR-CORP{username}'

The latter approach is why I needed the latest version, because of the features in #12
(Make sure to read up on the new configuration variables it introduces.)

Note that at least in my environment, we got an "invalid username / password" error when a user tried to login with the first character of his ID capitalised. Adding 'A-Z' to the default regex fixed that for us:
c.LDAPAuthenticator.valid_username_regex = '^[a-zA-Z][.a-z0-9_-]*$'

[cindyburian]

I am still stuck. I have the latest ldapauthenticator.py, and I have these lines at the bottom of jupyterhub_config.py:

c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
c.LDAPAuthenticator.server_address = 'ad2predco'
c.LDAPAuthenticator.bind_dn_template = 'uid=mycompany{username},ou=Our User Accounts,dc=predict,dc=com'
c.LDAPAuthenticator.lookup_dn = True
c.LDAPAuthenticator.user_search_base = 'ou=Our User Accounts,dc=predict,dc=com'
c.LDAPAuthenticator.user_attribute = 'sAMAccountName'

However, when I put in userid and password it fails:

[W 2016-11-01 11:47:19.018 JupyterHub ldapauthenticator:147] Invalid password for user uid=mycompany\chodgins,ou=Our User Accounts,dc=predict,dc=com

Any help is greatly appreciated. Thanks.

[rdewaele]

Please try the steps outlined above. It seems you did not change the c.LDAPAuthenticator.bind_dn_template as suggested, but you do login "windows domain style".

Note that this is for Active Directory, please clarify if you are not working with AD.

[yourinoelnelson]

c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
c.LDAPAuthenticator.server_address = 'mycompanyADserverIP'
c.LDAPAuthenticator.bind_dn_template = 'mycompanydomainname{username}'
c.LDAPAuthenticator.lookup_dn = False
c.LDAPAuthenticator.user_search_base = 'OU=Users,DC=mycompany,DC=local'
c.LDAPAuthenticator.user_attribute = 'sAMAccountName'
c.LDAPAuthenticator.allowed_groups = []

That's the setup that ended up working for me, the user_search_base is going to be specific to your company so you may want to get with your network administrator to see exactly what the structure is for you.

[verbunk]

I'm also using this method although I specified (in ldapauthenticator.py) authentication='NTLM' to make sure. I'm not using user_search_base or user_attribute for our AD connection.

Maybe authentication='NTLM' could be made an proper optional param?

[ixxie]

FWIW I have managed to get it working and outlined instructions at #54, based partially on some comments on this thread.

[dhirschfeld]

Closing as stale. Multiple people do actually run against AD so this is possible with the right config. If after the latest release (#70) you're still having problems please feel free to open a new issue.