You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, local user creation by the LDAPAuthenticator is unsupported as this is insecure since there's no cleanup method for these created users. As a result, users who are disabled in LDAP will have access to this for far longer.
Alternatively, there's good support in Linux for integrating LDAP into the system user setup directly, and users can just use PAM (which is supported in not just JupyterHub, but ssh and a lot of other tools) to log in. You can see http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/pamnss.html and lots of other documentation on the web on how to set up LDAP to provide user accounts for your system. Those methods are very widely used, much more secure and more widely documented. We recommend you use them rather than have JupyterHub create local accounts using the LDAPAuthenticator.
Issue #19 provides additional discussion on local user creation.
I think its time to re-evaluate the creation of a LocalLDAPAuthenticator, currently there isn't one making creation of local users something one needs to get done manually, for example like described here: #107 (comment)
The text was updated successfully, but these errors were encountered:
LDAP is designed to be integrated at the OS level, e.g. to provide consistent UIDs across systems. Adding official support for LocalLDAPAuthenticator gives the misleading impression that the created users are consistent with the LDAP database when they're completely independent.
The readme sais:
I think its time to re-evaluate the creation of a LocalLDAPAuthenticator, currently there isn't one making creation of local users something one needs to get done manually, for example like described here: #107 (comment)
The text was updated successfully, but these errors were encountered: