to use LDAP, You have to install python-ldap_ package. This package is available

LDAP settings are located in admin->ldap section,

This is a typical LDAP setup::

 Connection settings

 Enable LDAP          = checked

 Host                 = host.example.org

 Port                 = 389

 Account              = <account>

 Password             = <password>

 Enable LDAPS         = checked

 Certificate Checks   = DEMAND

 Search settings

 Base DN              = CN=users,DC=host,DC=example,DC=org

 LDAP Filter          = (&(objectClass=user)(!(objectClass=computer)))

 LDAP Search Scope    = SUBTREE

 Attribute mappings

 Login Attribute      = uid

 First Name Attribute = firstName

 Last Name Attribute  = lastName

 E-mail Attribute     = mail

.. _enable_ldap:

Enable LDAP : required

    Whether to use LDAP for authenticating users.

.. _ldap_host:

Host : required

    LDAP server hostname or IP address.

.. _Port:

Port : required

    389 for un-encrypted LDAP, 636 for SSL-encrypted LDAP.

.. _ldap_account:

Account : optional

    Only required if the LDAP server does not allow anonymous browsing of

    records.  This should be a special account for record browsing.  This

    will require `LDAP Password`_ below.

.. _LDAP Password:

Password : optional

    Only required if the LDAP server does not allow anonymous browsing of

    records.

.. _Enable LDAPS:

Enable LDAPS : optional

    Check this if SSL encryption is necessary for communication with the

    LDAP server - it will likely require `Port`_ to be set to a different

    value (standard LDAPS port is 636).  When LDAPS is enabled then

    `Certificate Checks`_ is required.

.. _Certificate Checks:

Certificate Checks : optional

    How SSL certificates verification is handled - this is only useful when

    `Enable LDAPS`_ is enabled.  Only DEMAND or HARD offer full SSL security while

    the other options are susceptible to man-in-the-middle attacks.  SSL

    certificates can be installed to /etc/openldap/cacerts so that the

    DEMAND or HARD options can be used with self-signed certificates or

    certificates that do not have traceable certificates of authority.

    NEVER

        A serve certificate will never be requested or checked.

    ALLOW

        A server certificate is requested.  Failure to provide a

        certificate or providing a bad certificate will not terminate the

        session.

    TRY

        A server certificate is requested.  Failure to provide a

        certificate does not halt the session; providing a bad certificate

        halts the session.

    DEMAND

        A server certificate is requested and must be provided and

        authenticated for the session to proceed.

    HARD

        The same as DEMAND.

.. _Base DN:

Base DN : required

    The Distinguished Name (DN) where searches for users will be performed.

    Searches can be controlled by `LDAP Filter`_ and `LDAP Search Scope`_.

.. _LDAP Filter:

LDAP Filter : optional

    A LDAP filter defined by RFC 2254.  This is more useful when `LDAP

    Search Scope`_ is set to SUBTREE.  The filter is useful for limiting

    which LDAP objects are identified as representing Users for

    authentication.  The filter is augmented by `Login Attribute`_ below.

    This can commonly be left blank.

.. _LDAP Search Scope:

LDAP Search Scope : required

    This limits how far LDAP will search for a matching object.

    BASE

        Only allows searching of `Base DN`_ and is usually not what you

        want.

    ONELEVEL

        Searches all entries under `Base DN`_, but not Base DN itself.

    SUBTREE

        Searches all entries below `Base DN`_, but not Base DN itself.

        When using SUBTREE `LDAP Filter`_ is useful to limit object

        location.

.. _Login Attribute:

Login Attribute : required        

    The LDAP record attribute that will be matched as the USERNAME or

    ACCOUNT used to connect to RhodeCode.  This will be added to `LDAP

    Filter`_ for locating the User object.  If `LDAP Filter`_ is specified as

    "LDAPFILTER", `Login Attribute`_ is specified as "uid" and the user has

    connected as "jsmith" then the `LDAP Filter`_ will be augmented as below

    ::

        (&(LDAPFILTER)(uid=jsmith))

.. _ldap_attr_firstname:

First Name Attribute : required

    The LDAP record attribute which represents the user's first name.

.. _ldap_attr_lastname:

Last Name Attribute : required

    The LDAP record attribute which represents the user's last name.

.. _ldap_attr_email:

Email Attribute : required

    The LDAP record attribute which represents the user's email address.

If all data are entered correctly, and python-ldap_ is properly installed

users should be granted access to RhodeCode with ldap accounts.  At this

time user information is copied from LDAP into the RhodeCode user database.

This means that updates of an LDAP user object may not be reflected as a

user update in RhodeCode.

If You have problems with LDAP access and believe You entered correct

information check out the RhodeCode logs, any error messages sent from LDAP

will be saved there.

Active Directory

''''''''''''''''

RhodeCode can use Microsoft Active Directory for user authentication.  This

is done through an LDAP or LDAPS connection to Active Directory.  The

following LDAP configuration settings are typical for using Active

Directory ::

 Base DN              = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local

 Login Attribute      = sAMAccountName

 First Name Attribute = givenName

 Last Name Attribute  = sn

 E-mail Attribute     = mail

All other LDAP settings will likely be site-specific and should be

appropriately configured.

.. _rabbitmq: http://www.rabbitmq.com/

.. _python-ldap: http://www.python-ldap.org/

    search_scope_choices = [('BASE',     _('BASE'),),

                            ('ONELEVEL', _('ONELEVEL'),),

                            ('SUBTREE',  _('SUBTREE'),),

                            ]

    search_scope_default = 'SUBTREE'

    tls_reqcert_choices = [('NEVER',  _('NEVER'),),

                           ('ALLOW',  _('ALLOW'),),

                           ('TRY',    _('TRY'),),

                           ('DEMAND', _('DEMAND'),),

                           ('HARD',   _('HARD'),),

                           ]

    tls_reqcert_default = 'DEMAND'

        c.search_scope_choices = self.search_scope_choices

        c.tls_reqcert_choices  = self.tls_reqcert_choices

        c.search_scope_cur = defaults.get('ldap_search_scope')

        c.tls_reqcert_cur  = defaults.get('ldap_tls_reqcert')

        _form = LdapSettingsForm([x[0] for x in self.tls_reqcert_choices],

                                 [x[0] for x in self.search_scope_choices])()

            c.search_scope_cur = self.search_scope_default

            c.tls_reqcert_cur  = self.search_scope_default

    if user is not None and not user.ldap_dn:

        if user_obj is not None and not user_obj.ldap_dn:

                  'tls_reqcert':ldap_settings.get('ldap_tls_reqcert'),

                  'ldap_filter':ldap_settings.get('ldap_filter'),

                  'search_scope':ldap_settings.get('ldap_search_scope'),

                  'attr_login':ldap_settings.get('ldap_attr_login'),

                (user_dn, ldap_attrs) = aldap.authenticate_ldap(username, password)

                log.debug('Got ldap DN response %s', user_dn)

                user_attrs = {

                    'name'     : ldap_attrs[ldap_settings.get('ldap_attr_firstname')][0],

                    'lastname' : ldap_attrs[ldap_settings.get('ldap_attr_lastname')][0],

                    'email'    : ldap_attrs[ldap_settings.get('ldap_attr_email')][0],

                    }

                if user_model.create_ldap(username, password, user_dn, user_attrs):

                 use_ldaps=False, tls_reqcert='DEMAND', ldap_version=3,

                 ldap_filter='(&(objectClass=user)(!(objectClass=computer)))',

                 search_scope='SUBTREE',

                 attr_login='uid'):

        self.TLS_REQCERT = ldap.__dict__['OPT_X_TLS_' + tls_reqcert]

        self.LDAP_FILTER = ldap_filter

        self.SEARCH_SCOPE = ldap.__dict__['SCOPE_' + search_scope]

        self.attr_login = attr_login

            ldap.set_option(ldap.OPT_REFERRALS, ldap.OPT_OFF)

            ldap.set_option(ldap.OPT_RESTART, ldap.OPT_ON)

            ldap.set_option(ldap.OPT_TIMEOUT, 20)

            ldap.set_option(ldap.OPT_TIMELIMIT, 15)

            if self.LDAP_USE_LDAPS:

                ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, self.TLS_REQCERT)

            filt = '(&%s(%s=%s))' % (self.LDAP_FILTER, self.attr_login, username)

            log.debug("Authenticating %r filt %s at %s", self.BASE_DN, filt, self.LDAP_SERVER)

            lobjects = server.search_ext_s(self.BASE_DN, self.SEARCH_SCOPE, filt)

            if not lobjects:

                raise ldap.NO_SUCH_OBJECT()

            for (dn, attrs) in lobjects:

                try:

                    server.simple_bind_s(dn, password)

                    break

                except ldap.INVALID_CREDENTIALS, e:

                    log.debug("LDAP rejected password for user '%s' (%s): %s", uid, username, dn)

                else:

                    log.debug("No matching LDAP objecs for authentication of '%s' (%s)", uid, username)

                    raise LdapPasswordError()

        return (dn, attrs)

                      'ldap_tls_reqcert', 'ldap_dn_user', 'ldap_dn_pass',

                      'ldap_base_dn', 'ldap_filter', 'ldap_search_scope',

                      'ldap_attr_login', 'ldap_attr_firstname', 'ldap_attr_lastname',

                      'ldap_attr_email']:

    ldap_dn = Column("ldap_dn", String(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

class AttrLoginValidator(formencode.validators.FancyValidator):

        if not value or not isinstance(value, (str, unicode)):

            raise formencode.Invalid(_("The LDAP Login attribute of the CN must be specified "

                                       "- this is the name of the attribute that is equivalent to 'username'"),

def LdapSettingsForm(tls_reqcert_choices, search_scope_choices):

        ldap_tls_reqcert = OneOf(tls_reqcert_choices)

        ldap_base_dn = UnicodeString(strip=True,)

        ldap_filter = UnicodeString(strip=True,)

        ldap_search_scope = OneOf(search_scope_choices)

        ldap_attr_login = All(AttrLoginValidator, UnicodeString(strip=True,))

        ldap_attr_firstname = UnicodeString(strip=True,)

        ldap_attr_lastname = UnicodeString(strip=True,)

        ldap_attr_email = UnicodeString(strip=True,)

        ldap_tls_reqcert

        ldap_filter

        ldap_search_scope

        ldap_attr_login

        ldap_attr_firstname

        ldap_attr_lastname

        ldap_attr_email

        # ldap_search_scope

    def create_ldap(self, username, password, user_dn, attrs):

        :param user_dn:

        :param attrs:

                new_user.email = attrs['email']

                new_user.ldap_dn = user_dn

                new_user.name = attrs['name']

                new_user.lastname = attrs['lastname']

	  <h3>${_('Connection settings')}</h3>

                <div class="label label-checkbox"><label for="ldap_active">${_('Enable LDAP')}</label></div>

                <div class="label label-checkbox"><label for="ldap_ldaps">${_('Enable LDAPS')}</label></div>

                <div class="checkboxes"><div class="checkbox">${h.checkbox('ldap_ldaps',True,class_='small')}</div></div>

            </div>

            <div class="field">

                <div class="label"><label for="ldap_tls_reqcert">${_('Certificate Checks')}</label></div>

                <div class="select">${h.select('ldap_tls_reqcert',c.tls_reqcert_cur,c.tls_reqcert_choices,class_='small')}</div>

            </div>

	  <h3>${_('Search settings')}</h3>

            <div class="field">

            <div class="field">

                <div class="label"><label for="ldap_filter">${_('LDAP Filter')}</label></div>

                <div class="input">${h.text('ldap_filter',class_='small')}</div>

            </div>

            <div class="field">

                <div class="label"><label for="ldap_search_scope">${_('LDAP Search Scope')}</label></div>

                <div class="select">${h.select('ldap_search_scope',c.search_scope_cur,c.search_scope_choices,class_='small')}</div>

            </div>

	  <h3>${_('Attribute mappings')}</h3>

            <div class="field">

                <div class="label"><label for="ldap_attr_login">${_('Login Attribute')}</label></div>

                <div class="input">${h.text('ldap_attr_login',class_='small')}</div>

            </div>

            <div class="field">

                <div class="label"><label for="ldap_attr_firstname">${_('First Name Attribute')}</label></div>

                <div class="input">${h.text('ldap_attr_firstname',class_='small')}</div>

            </div>

            <div class="field">

                <div class="label"><label for="ldap_attr_lastname">${_('Last Name Attribute')}</label></div>

                <div class="input">${h.text('ldap_attr_lastname',class_='small')}</div>

            </div>

            <div class="field">

                <div class="label"><label for="ldap_attr_email">${_('E-mail Attribute')}</label></div>

                <div class="input">${h.text('ldap_attr_email',class_='small')}</div>

            </div>

                    <label for="ldap_dn">${_('LDAP DN')}:</label>

                </div>

                <div class="input">

                    ${h.text('ldap_dn',class_='small')}

                </div>

             </div>

             <div class="field">

                <div class="label">

</%def>

                    <td>${h.bool2icon(bool(user.ldap_dn))}</td>