Adding LDAP support

app/core/config.py

@@ -40,6 +40,40 @@ class Settings(BaseSettings):
     # CORS
     cors_origins: list[str] = ["*"]
 
+    # --- LDAP / Active Directory (optional) --------------------------------
+    # When ``ldap_enabled`` is true, login credentials are validated by binding
+    # to the directory. A local ``User`` row is provisioned on first successful
+    # login so RBAC, tokens, and the admin UI keep working. Local database auth
+    # remains available as a fallback (so the seeded superuser can still log in).
+    ldap_enabled: bool = False
+    # e.g. "ldap://ldap.example.com:389" or "ldaps://ldap.example.com:636"
+    ldap_server_uri: str = ""
+    ldap_use_ssl: bool = False
+    ldap_start_tls: bool = False
+    # Verify the server's TLS certificate (ldaps/StartTLS). Disable only for dev.
+    ldap_tls_validate: bool = True
+    ldap_ca_certs_file: str = ""
+
+    # Two ways to locate/authenticate the user (direct bind takes precedence):
+    #
+    # 1. Direct bind — build the user's DN from the login name, then bind as it:
+    #      LDAP_BIND_DN_TEMPLATE="uid={username},ou=people,dc=example,dc=com"
+    ldap_bind_dn_template: str = ""
+    #
+    # 2. Search + bind — bind with a service account (or anonymously), search for
+    #    the user, then re-bind as the found DN to verify the password:
+    ldap_bind_dn: str = ""
+    ldap_bind_password: str = ""
+    ldap_user_search_base: str = ""
+    ldap_user_search_filter: str = "(uid={username})"
+
+    # Attributes read from the directory entry to populate the local user.
+    ldap_attr_email: str = "mail"
+    ldap_attr_full_name: str = "cn"
+
+    # Roles (by name) granted to a user provisioned from LDAP on first login.
+    ldap_default_roles: list[str] = ["user"]
+
     # Bootstrap superuser (used by scripts/seed.py)
     first_superuser_email: str = "admin@example.com"
     first_superuser_password: str = "changethis"

app/core/security.py

@@ -1,6 +1,7 @@
 """Password hashing and JWT token helpers."""
 
 import hashlib
+import secrets
 import uuid
 from datetime import UTC, datetime, timedelta
 
@@ -27,6 +28,16 @@ def verify_password(password: str, hashed: str) -> bool:
         return False
 
 
+def make_unusable_password() -> str:
+    """A sentinel hash that no password can match.
+
+    Used for externally-authenticated users (e.g. LDAP) who have no local
+    password. It is not a valid bcrypt hash, so ``verify_password`` always
+    returns ``False`` for it — local password auth can never succeed.
+    """
+    return "!" + secrets.token_urlsafe(32)
+
+
 # --- JWT ---------------------------------------------------------------------