Web UI for changing LDAP password

The aim of this project is to provide a very simple web form for users to be able to change their password stored in LDAP or Active Directory (Samba 4 AD). It’s built with Bottle, a WSGI micro web-framework for Python.

Installation

Alpine Linux

1. Install package ldap-passwd-webui-waitress from the Alpine’s community repository:

   apk add ldap-passwd-webui-waitress

   Important

   This package is in Alpine stable since v3.7. You can also install it from edge (unstable) branch.

2. Adjust configuration in /etc/ldap-passwd-webui.ini and /etc/conf.d/.

3. Start service ldap-passwd-webui:

   /etc/init.d/ldap-passwd-webui start

Manually

Clone this repository and install dependencies:

git clone git@github.com:jirutka/ldap-passwd-webui.git
cd ldap-passwd-webui
pip install -r requirements.txt

Read the next sections to learn how to run it.

Requirements

• Python 3.x

• bottle

• ldap3 2.x

Configuration

Configuration is read from the file settings.ini. You may change location of the settings file using the environment variable CONF_FILE.

If you have Active Directory (or Samba 4 AD), then you must use encrypted connection (i.e. LDAPS or StartTLS) – AD doesn’t allow changing password via unencrypted connection.

Run it

There are multiple ways how to run it:

• with the built-in default WSGI server based on wsgiref,

• under a WSGI server like uWSGI, Waitress, Gunicorn, … (recommended)

• as a CGI script.

Run with the built-in server

Simply execute the app.py:

python3 app.py

Then you can access the app on http://localhost:8080. The port and host may be changed in settings.ini.

Run with Waitress

cd ldap-passwd-webui
waitress-serve --listen=*:8080 app:application

Run with uWSGI and nginx

If you have many micro-apps like this, it’s IMO kinda overkill to run each in a separate uWSGI process, isn’t it? It’s not so well known, but uWSGI allows to “mount” multiple application in a single uWSGI process and with a single socket.

Sample uWSGI configuration:

[uwsgi]
plugins = python3
socket = /run/uwsgi/main.sock
chdir = /var/www/scripts
logger = file:/var/log/uwsgi/main.log
processes = 1
threads = 2
# map URI paths to applications
mount = /admin/ldap-passwd-webui=ldap-passwd-webui/app.py
#mount = /admin/change-world=change-world/app.py
manage-script-name = true

Sample nginx configuration as a reverse proxy in front of uWSGI:

server {
    listen 443 ssl;
    server_name example.org;

    ssl_certificate     /etc/ssl/nginx/nginx.crt;
    ssl_certificate_key /etc/ssl/nginx/nginx.key;

    # uWSGI scripts
    location /admin/ {
        uwsgi_pass  unix:/run/uwsgi/main.sock;
        include     uwsgi_params;
    }
}

Screenshot

License

This project is licensed under MIT License. For the full text of the license, see the LICENSE file.