Authentication and Users

Authentication and Users

Login Order

1. If LDAP is enabled, HashTasker tries LDAP first.
2. If LDAP fails for any reason, it falls back to local accounts.

The built-in admin (admin.username in config.yaml) is local and always works, which keeps you able to log in if the directory is unreachable. An LDAP login can never take over the built-in admin account.

Sessions last 7 days.

How an LDAP Login Works

1. Bind as the service account (bind_dn / bind_pass).
2. Search base_dn with user_filter, substituting the escaped login name for %s.
3. Bind as the found user's DN with the supplied password.
4. Check the user's memberOf values for an exact match of admin_group. A match makes the user an admin; no match makes them a regular user. This is re-evaluated at every login.
5. Create the HashTasker user record on first login, or update it on later logins.

LDAP users have no local password and cannot change their password in HashTasker.

A user previously deleted in HashTasker is restored (with their job history) the next time they log in via LDAP.

Diagnosing LDAP Failures

The login page only says "Invalid credentials". The server log records the real reason at each stage, for example:

LDAP auth failed for "jdoe": service-account bind failed (check ldap.bind_dn/bind_pass): ...
LDAP auth failed for "jdoe": user "jdoe" not found under base_dn "OU=Users,DC=example,DC=com"
LDAP auth failed for "jdoe": credential bind failed for CN=John Doe,...: ...

Common causes:

Log message	Fix
service-account bind failed	Wrong bind_dn/bind_pass, or the account is locked
user not found under base_dn	base_dn too narrow, or user_filter uses the wrong attribute (uid vs sAMAccountName)
credential bind failed	Wrong user password, or the account is disabled
User is not an admin when expected	admin_group must be the group's full DN exactly as it appears in memberOf; nested groups are not expanded

Roles

Capability	User	Admin
Create, copy, cancel, delete, export own jobs	Yes	Yes
View other users' jobs	No	Yes (jobs page toggle)
User management	No	Yes
Analytics	No	Yes

Local Users

Admins can manage users at Admin > Users: create local accounts, set admin rights, reset passwords, and delete users. Users change their own local password from Profile.