Skip to content

Very simple web interface for changing password stored in LDAP or Active Directory (Samba 4 AD).

License

Notifications You must be signed in to change notification settings

jirutka/ldap-passwd-webui

Repository files navigation

Web UI for changing LDAP password

The aim of this project is to provide a very simple web form for users to be able to change their password stored in LDAP or Active Directory (Samba 4 AD). It’s built with Bottle, a WSGI micro web-framework for Python.

Installation

Alpine Linux

  1. Install package ldap-passwd-webui-waitress from the Alpine’s community repository:

    apk add ldap-passwd-webui-waitress
    Important
    This package is in Alpine stable since v3.7. You can also install it from edge (unstable) branch.
  2. Adjust configuration in /etc/ldap-passwd-webui.ini and /etc/conf.d/.

  3. Start service ldap-passwd-webui:

    /etc/init.d/ldap-passwd-webui start

Manually

Clone this repository and install dependencies:

git clone git@github.com:jirutka/ldap-passwd-webui.git
cd ldap-passwd-webui
pip install -r requirements.txt

Read the next sections to learn how to run it.

Requirements

Configuration

Configuration is read from the file settings.ini. You may change location of the settings file using the environment variable CONF_FILE.

If you have Active Directory (or Samba 4 AD), then you must use encrypted connection (i.e. LDAPS or StartTLS) – AD doesn’t allow changing password via unencrypted connection.

Run it

There are multiple ways how to run it:

Run with the built-in server

Simply execute the app.py:

python3 app.py

Then you can access the app on http://localhost:8080. The port and host may be changed in settings.ini.

Run with Waitress

cd ldap-passwd-webui
waitress-serve --listen=*:8080 app:application

Run with uWSGI and nginx

If you have many micro-apps like this, it’s IMO kinda overkill to run each in a separate uWSGI process, isn’t it? It’s not so well known, but uWSGI allows to “mount” multiple application in a single uWSGI process and with a single socket.

Sample uWSGI configuration:
[uwsgi]
plugins = python3
socket = /run/uwsgi/main.sock
chdir = /var/www/scripts
logger = file:/var/log/uwsgi/main.log
processes = 1
threads = 2
# map URI paths to applications
mount = /admin/ldap-passwd-webui=ldap-passwd-webui/app.py
#mount = /admin/change-world=change-world/app.py
manage-script-name = true
Sample nginx configuration as a reverse proxy in front of uWSGI:
server {
    listen 443 ssl;
    server_name example.org;

    ssl_certificate     /etc/ssl/nginx/nginx.crt;
    ssl_certificate_key /etc/ssl/nginx/nginx.key;

    # uWSGI scripts
    location /admin/ {
        uwsgi_pass  unix:/run/uwsgi/main.sock;
        include     uwsgi_params;
    }
}

Screenshot

screenshot

License

This project is licensed under MIT License. For the full text of the license, see the LICENSE file.