Integrating LDAP authentication into py4web

[Trukitro]

I'm integrating LDAP authentication into my py4web app using py4web.utils.auth_plugins.ldap_plugin.LDAPPlugin, connected to an Active Directory server.

Here's some issues I encountered along the way:

❗ Issues Encountered:

LDAPPlugin.__init__() got an unexpected keyword argument 'use_tls'
→ Removed use_tls & timeout keys to make it work.

Default login page rendered only a single blank input with no labels
→ It seems the default auth.login() template doesn't render LDAP-based fields properly.

Auth.login() raises:
TypeError: Auth.login() missing 2 required positional arguments: 'email' and 'password'
→ I expected a form, not a function call.

💡 What Worked:

Using:

@action('index')
@action.uses('index.html', auth.user)
def index():
    user = auth.get_user()
    return dict(message=f"Hello {user['username']}")
Adding auth.use_username = True in common.py

Avoiding manual call to auth.login() in a controller (let py4web handle it via /auth/login route)

🙋‍♂️ Questions:

Is there a canonical way to render a working login form with LDAP (e.g., username/password)?

Is there a recommended template override or plugin fix for better LDAP support?

Are there plans to improve the docs around LDAPPlugin?

Thanks for the amazing work on py4web! I'd be happy to contribute improved docs/examples for LDAP if needed.

[nicozanf]

Hi Trukitro, can you kindly write an email directly to me with all the needed details? I cannot find your email, and I think this can be easily resolved.
If possible, start with integrating the _scaffold app in your AD.

[Trukitro]

Hi @nicozanf,

Thanks for the quick response!

I'd be happy to follow up via email. You can reach me at [rjvr28@outlook.com].

To give you a quick overview, I’ve been working on integrating LDAP authentication into a py4web app using LDAPPlugin from py4web.utils.auth_plugins. I’m currently testing against an Active Directory server.

Thanks again for your help—looking forward to resolving this with your guidance!

Best regards,
Trukitro

[Trukitro]

✅ Findings and Fix for LDAPPlugin Integration in py4web

After further testing, I’ve confirmed that the issue with the login form not rendering when using LDAPPlugin is not a bug in the plugin, but rather a result of the order in which the auth system is configured.

---

❗ Root Cause

The login form fails to render (i.e., a blank page at /auth/login) when:

• LDAPPlugin is registered before setting up or testing SQLite-based authentication.
• auth.use_username is not set before registering the plugin.
• Email confirmation or approval is still required.

---

✅ Working Setup Order (Required for LDAP to Work)

1. Start with SQLite Auth Only

   • Set up auth with SQLite and confirm /auth/register and /auth/login routes work normally.
   • Set:

     auth.use_username = True
     auth.param.registration_requires_confirmation = False
     auth.param.registration_requires_approval = False

2. Register a Test User First

   • Visit /auth/register and confirm the form renders correctly.
   • Log in with that test user via /auth/login.

3. Then Enable LDAPPlugin

   • Once the form is working and templates are loaded:

     from py4web.utils.auth_plugins.ldap_plugin import LDAPPlugin
     
     LDAP_SETTINGS = {
         "mode": "ad",
         "server": "192.168.x.x",
         "base_dn": "CN=Users,DC=yourdomain,DC=local",
         "secure": False,
     }
     
     auth.register_plugin(LDAPPlugin(**LDAP_SETTINGS))

4. Do NOT Call auth.login() in a Controller

   • Let /auth/login handle form rendering.

---

📝 Suggestion

It would be very helpful to add a note in the docs or LDAPPlugin examples clarifying that:

• Initializing LDAP auth without first validating SQLite login flow may cause blank login pages due to template or auth config dependencies.
• auth.use_username must be set before plugin registration.

---

Let me know if you'd like me to PR these findings as part of a docs update. Thanks again for the great framework!