Active Directory Integration

IScorE has the ability to authenticate users against an Active Directory domain. In order to activate and configure the integration, several things need to be set in your localsettings.py. They are described below.

AD_DNS_NAME
The FQDN or IP address of your domain controller. (Ex. “ad.iserink.org”)
AD_LDAP_PORT
If your DC is not listing on the standard LDAP port, you will need to set this value. If using SSL, you will need to set this to 636 if using the default LDAPS port.
AD_LDAP_URL
Set this to 'ldap://%s:%s' % (AD_DNS_NAME, AD_LDAP_PORT)'; replace the protocol with ldaps if using SSL.
AD_SEARCH_DN
Set this to the DN of your domain. (Ex. “dc=iserink,dc=org”)
AD_NT4_DOMAIN
Set this to the NT4 version of your domain. (Ex. “ISERINK”)
AD_MEMBERSHIP_ADMIN
A list of all ad groups that should get super user status in IScorE. ‘Domain Admins’ by default.
AD_MEMBERSHIP_REQ
A list of all ad groups that should be able to login to IScorE. Defaults to the value of AD_MEMBERSHIP_ADMIN plus “CDCUsers”, “Green”, “White”, and “Red”. Does need to be set again if AD_MEMBERSHIP_ADMIN has changed.
AD_WHITE_GROUP
A list of ad groups that will be considered White team. Defaults to “White”.
AD_GREEN_GROUP
A list of ad groups that will be considered Green team. Defaults to “Green”.
AD_GREEN_ADMIN_GROUP
A list of ad groups that will be considered Green team leaders. Defaults to “GreenAdmin”.
AD_RED_GROUP
A list of ad groups that will be considered Red team. Defaults to “Red”.
AD_BLUE_GROUP_PREFIX
The prefix for groups that will be considered Blue team. Defaults to “Blue”.
AUTHENTICATION_BACKENDS
In order to use the AD integration, auth.ActiveDirectoryAuthenticationBackend should be listed first in this setting.
AD_PW_CHANGE_URL
If specified, all LDAP users’ profile page will show this link instead of a password reset button.
AD_PW_CHANGE_INSTRUCTION
If not using AD_PW_CHANGE_URL, you can give users instructions on how to change their passwords. If neither option is selected, the text “Please content White Team for password changes” will be displayed to LDAP users on their profile pages instead of a password change button.

Assumptions

The AD integration assumes that you have a group for each team that followings the pattern “AD_BLUE_GROUP_PREFIX #” (Ex. Blue 1, Blue 2, etc.).