Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Re-evaluate providing a LocalLDAPAuthenticator #261

Closed
consideRatio opened this issue Sep 15, 2024 · 3 comments
Closed

Re-evaluate providing a LocalLDAPAuthenticator #261

consideRatio opened this issue Sep 15, 2024 · 3 comments

Comments

@consideRatio
Copy link
Member

The readme sais:

Configuration note on local user creation

Currently, local user creation by the LDAPAuthenticator is unsupported as this is insecure since there's no cleanup method for these created users. As a result, users who are disabled in LDAP will have access to this for far longer.

Alternatively, there's good support in Linux for integrating LDAP into the system user setup directly, and users can just use PAM (which is supported in not just JupyterHub, but ssh and a lot of other tools) to log in. You can see http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/pamnss.html and lots of other documentation on the web on how to set up LDAP to provide user accounts for your system. Those methods are very widely used, much more secure and more widely documented. We recommend you use them rather than have JupyterHub create local accounts using the LDAPAuthenticator.

Issue #19 provides additional discussion on local user creation.

I think its time to re-evaluate the creation of a LocalLDAPAuthenticator, currently there isn't one making creation of local users something one needs to get done manually, for example like described here: #107 (comment)

@manics
Copy link
Member

manics commented Sep 15, 2024

LDAP is designed to be integrated at the OS level, e.g. to provide consistent UIDs across systems. Adding official support for LocalLDAPAuthenticator gives the misleading impression that the created users are consistent with the LDAP database when they're completely independent.

@consideRatio
Copy link
Member Author

I figure we need to update docs about not providing this, as it seems like a broken expectation for some users.

@consideRatio
Copy link
Member Author

Marking as closed - let's not add this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants