scott
f4bd03dc52
New ldap-gateway/ service (Twisted + ldaptor) that exposes Keycloak users and groups over LDAP v3 for legacy apps and Linux hosts (SSSD/NSS). Design (see ldap-gateway/SPEC.md): - Reads directly from the KC Admin API with an in-memory TTL cache + background refresh; fully stateless, no DB or queue. - Service-bind read-only: only configured service accounts may bind; no end-user password auth. Writes return unwillingToPerform. - Serves POSIX + inetOrgPerson entries (uid/gid/home, memberOf, group memberUid/member). UID/GID from a KC custom attribute else derived from the stable KC UUID. - Pluggable IdentityResolver (LDAP_IDENTITY_SOURCE): username today, a cert_cn strategy stubbed for the future cert-CN-as-identity direction. Build/deploy: - build.sh builds and (optionally) pushes mgmt-ldap-gateway alongside backend/frontend. - Helm: ldap-gateway deployment/service/configmap, gated by ldapGateway.enabled (off by default), reusing the shared KC secret. Verified end to end against a live Keycloak: service bind, user/group search, anonymous + bad-password denial, write rejection; container image builds, runs as non-root, warms from KC, and serves searches. 125 tests pass; ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
33 lines
606 B
TOML
33 lines
606 B
TOML
[build-system]
|
|
requires = ["setuptools>=68"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "ldap_gateway"
|
|
version = "0.1.0"
|
|
description = "LDAP v3 gateway exposing Keycloak users and groups (read-only) for legacy LDAP consumers."
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"twisted",
|
|
"ldaptor",
|
|
"requests",
|
|
"pyopenssl",
|
|
"service_identity",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest",
|
|
"ruff",
|
|
]
|
|
|
|
[tool.setuptools.packages.find]
|
|
include = ["ldap_gateway*"]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|