nginx-ldap-auth | Example of LDAP authentication | Identity Management library

The NGINX Plus configuration file that is provided with the reference implementation configures all components other than the LDAP server (that is, NGINX Plus, the client, the ldap-auth daemon, and the back-end daemon) to run on the same host, which is adequate for testing purposes. The LDAP server can also run on that host during testing. In an actual deployment, the back-end application and authentication server typically each run on a separate host, with NGINX Plus on a third host. The ldap-auth daemon does not consume many resources in most situations, so it can run on the NGINX Plus host or another host of your choice. To install and configure the reference implementation, perform the following steps.
Create a clone of the GitHub repository (nginx-ldap-auth).
If NGINX Plus is not already running, install it according to the instructions for your operating system.
If an LDAP authentication server is not already running, install and configure one. By default the ldap-auth daemon communicates with OpenLDAP, but can be configured to work with Active Directory. If you are using the LDAP server only to test the reference implementation, you can use the OpenLDAP server Docker image that is available on GitHub, or you can set up a server in a virtual environment using instructions such as How To Install and Configure a Basic LDAP Server on an Ubuntu 12.04 VPS.
On the host where the ldap-auth daemon is to run, install the following additional software. We recommend using the versions that are distributed with the operating system, instead of downloading the software from an open source repository. Python versions 2 and 3 are supported. The Python LDAP module, python-ldap (created by the python-ldap.org open source project).
Copy the following files from your repository clone to the indicated hosts: nginx-ldap-auth.conf – NGINX Plus configuration file, which contains the minimal set of directives for testing the reference implementation. Install on the NGINX Plus host (in the /etc/nginx/conf.d directory if using the conventional configuration scheme). To avoid configuration conflicts, remember to move or rename any default configuration files installed with NGINX Plus. nginx-ldap-auth-daemon.py – Python code for the ldap-auth daemon. Install on the host of your choice. Alternatively, use provided Dockerfile to build Docker image: docker build -t nginx-ldap-auth-daemon . docker run nginx-ldap-auth-daemon If you desire to use a container with Python3, you can supply an appropriate build argument: docker build -t nginx-ldap-auth-daemon --build-arg PYTHON_VERSION=3 . nginx-ldap-auth-daemon-ctl.sh – Sample shell script for starting and stopping the daemon. Install on the same host as the ldap-auth daemon. backend-sample-app.py – Python code for the daemon that during testing stands in for a real back-end application server. Install on the host of your choice.
Modify the NGINX Plus configuration file as described in Required Modifications to the NGINX Plus Configuration File below. For information about customizing your deployment, see Customization below. We recommend running the nginx -t command after making your changes to verify that the file is syntactically valid.
Start NGINX Plus. If it is already running, run the following command to reload the configuration file: root# nginx -s reload
Run the following commands to start the ldap-auth daemon and the back-end daemon. root# nginx-ldap-auth-daemon-ctl.sh start root# python backend-sample-app.py
To test the reference implementation, use a web browser to access http://nginx-server-address:8081. Verify that the browser presents a login form. After you fill out the form and submit it, verify that the server returns the expected response to valid credentials. The sample back-end daemon returns this: