Admin user not working after ading this plugin

[titansmc]

The admin user cannot do login anymore after adding LDAP plugin. Is it somehow related?

[j-kwan]

The backend is not using LDAP authentication.
You have to login with the local account.

[madmath03]

Hello @titansmc ,

As mentioned by @j-kwan, the backend is not using the LDAP authentication and relies only on the local account, but it is important to note that the LDAP plugin will automatically create a local user at the first LDAP login.
This means that you can make a LDAP user a "super admin" and to allow access to the backend.

Right now, it is only possible to give those access through the backend so you need another admin account. See #17 for the open discussion about it. Any help to implement the discussed feature is appreciated 😅

But I would like to go back to what you said. You are mentioning that "the admin user cannot do login anymore ".
Does that mean you have a local user with the admin rights ? If so, I'm guessing you created a similar user in your LDAP and are now expecting to login with the same account but using your LDAP password, is that correct ?

If that's the case, then you should be able to login as usual but using your local password. Take a look at issue #18 for a similar situation.

If my guess is wrong, feel free to give us a bit more details about your situation.

[titansmc]

Hi, Thanks for the explanation. After finding out that there is a Django admin panel I see I can login there with the admin with no problem, even creating a new user that is able to login there too, but none of them can log in to the taiga interface. With the LDAP tree that I had specify , I don't have any admin account. From the backend logs I only see: [13/Dec/2018 09:24:02] "POST /api/v1/auth HTTP/1.0" 400 41 Thanks. Missatge de Mathieu Brunot <[email protected]> del dia dc., 12 de des. 2018 a les 20:47:

…

Hello @titansmc <https://github.com/titansmc> , As mentioned by @j-kwan <https://github.com/j-kwan>, the backend is not using the LDAP authentication and relies only on the local account, but it is important to note that the LDAP plugin will automatically create a local user at the first LDAP login. This means that you can make a LDAP user a "*super admin*" and to allow access to the backend. Right now, it is only possible to give those access through the backend so you need another admin account. See #17 <#17> for the open discussion about it. Any help to implement the discussed feature is appreciated 😅 But I would like to go back to what you said. You are mentioning that "the admin user cannot do login *anymore* ". Does that mean you have a local user with the admin rights ? If so, I'm guessing you created a similar user in your LDAP and are now expecting to login with the same account but using your LDAP password, is that correct ? If that's the case, then you should be able to login as usual but using your local password. Take a look at issue #18 <#18> for a similar situation. If my guess is wrong, feel free to give us a bit more details about your situation. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#20 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AH0AYCW5h12J6Wbje03S-EFjFWHeNyp7ks5u4V05gaJpZM4ZQJqi> .

-- ------------------------------------------------ http://www.arruixaqueplou.org http://www.terradelfoc.blogspot.com -------------------------------------------------

[scheiblr]

I have the same issue: either ldap users work or local users, but not both.

[scheiblr]

After reading some of the code, I just got aware of LDAP_FALLBACK.

By uncommenting the following line in settings/local.py, the issue got solved and everything works as expected

LDAP_FALLBACK = "normal"

@titansmc I suggest you to check that, too.

[madmath03]

As @scheiblr said, the LDAP_FALLBACK feature is there to allow to both LDAP and local users to log in.

@titansmc Feel free to close this issue if that solve it.

For the future and maybe to avoid problems like that, would you guys think that this LDAP_FALLBACK should be enabled by default ?
My point in not making it default was that, most of the time, when you use Taiga with LDAP you probably do not want users outside of your company to login, but I might be wrong in what most of people want to do when using Taiga/LDAP.