Repository navigation
feature/ldap pseudo users - #307
Merged
Merged
Conversation
eschweikert
force-pushed
the
feature/ldap-pseudo-users
branch
3 times, most recently
from
July 24, 2026 14:18
8716228 to
0aec721
Compare
eschweikert
marked this pull request as draft
July 24, 2026 14:20
eschweikert
force-pushed
the
feature/ldap-pseudo-users
branch
2 times, most recently
from
July 24, 2026 14:48
2885703 to
ea07857
Compare
eschweikert
marked this pull request as ready for review
July 24, 2026 14:53
eschweikert
force-pushed
the
feature/ldap-pseudo-users
branch
2 times, most recently
from
August 24, 2026 12:16
f346d9c to
e5b7a81
Compare
This commit implements comprehensive support for synchronizing technical/pseudo users (service accounts and API accounts) from a dedicated LDAP base DN. Core Implementation: - Updated User database model in rights.py to add an explicit is_pseudo column. - Incremented schema version to 13 in schema.py. - Created SQL schema migration script migrate_12_to_13.sql and rollback script rollback_13_to_12.sql. - Added default LDAP_PSEUDO_USER_BASE setting in defaults.py. LDAP Sync & Import Overhaul: - Refactored users() to safely read attributes, guarding against index/key errors. - Enhanced sync_users() to perform dual LDAP base queries when LDAP_PSEUDO_USER_BASE is configured. - Implemented robust fail-fast error handling for LDAP queries in sync_users() to prevent accidental mass deletion on network issues. - Enhanced add_user() to use EAFP exception pattern for database existence checks (using NoResultFound) and added fallback LDAP searching. Documentation: - Updated change notes in dim/CHANGES. - Added a dedicated 'Pseudo / Service Accounts' section to user_management.rst. Co-authored-by: Gemini <gemini@local>
This commit introduces a fail-fast schema version check during create_app() bootstrapping. - Verifies that SchemaInfo.current_version() matches SCHEMA_VERSION (13) on startup. - Automatically bypasses the sys.exit(1) block if the command is executed via 'manage_db' or standard 'flask' CLI runners to prevent application boot deadlocks. - Gracefully handles empty databases by catching initial connection/table-not-found exceptions. Co-authored-by: Gemini <gemini@local>
This commit adds automated unit tests to verify standard and pseudo-user manual import features: - Created dim-testsuite/tests/ldap_sync_test.py with test cases for both standard and pseudo-user fallback searches. - Employs unittest.mock to mock LDAP class instantiation, connection instances, and users() method queries defensively. Co-authored-by: Gemini <gemini@local>
This commit configures VS Code workspace settings to resolve import warning errors: - Adds sub-package search paths (dim, ndcli, dimclient) to python.analysis.extraPaths in .vscode/settings.json. - Restores full autocompletion, type hinting, and clickable navigation in VS Code across the multi-package repository. Co-authored-by: Gemini <gemini@local>
This commit fixes a regression in user synchronization where new users with unpopulated ldap_uid were accidentally filtered out and ignored: - Reverted standard db_users query in dim/dim/ldap_sync.py back to db_users_all to ensure newly created users are successfully populated. - Updated integration test assertions in dim-testsuite/tests/ldap_sync_test.py to verify that local users with unpopulated ldap_uid are correctly searched in both LDAP bases but safely preserved during reconciliation. Co-authored-by: Gemini <gemini@local>
This commit adds comprehensive support for authenticated LDAP binds during nightly synchronization and user import: - Enhanced the LDAP connection constructor in dim/dim/ldap_sync.py to dynamically switch between authenticated bind (using LDAP_BIND_DN and LDAP_BIND_PASSWORD) and anonymous bind depending on configuration. - Added default values for LDAP_BIND_DN and LDAP_BIND_PASSWORD in dim/dim/defaults.py to maintain 100% backward compatibility. - Updated change notes in dim/CHANGES to document the new authenticated bind options. Co-authored-by: Gemini <gemini@local>
eschweikert
force-pushed
the
feature/ldap-pseudo-users
branch
from
August 25, 2026 13:11
e5b7a81 to
e0c0640
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
This adds the possibility to sync pseudo users.
ToDo: