{"id":21038522,"url":"https://github.com/tuenti/ldap-expire-notify","last_synced_at":"2025-05-15T15:33:43.245Z","repository":{"id":45887610,"uuid":"191915731","full_name":"tuenti/ldap-expire-notify","owner":"tuenti","description":"ldap-expire-notify is a tool to notify your LDAP users when their password is about to expire. It supports several kind of notification channels.","archived":false,"fork":false,"pushed_at":"2023-07-20T12:43:08.000Z","size":46,"stargazers_count":9,"open_issues_count":8,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-03T11:11:11.883Z","etag":null,"topics":["email","ldap","notify","slack","webhook"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tuenti.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-06-14T09:31:29.000Z","updated_at":"2024-02-29T07:59:06.000Z","dependencies_parsed_at":"2024-11-19T13:42:59.699Z","dependency_job_id":"fb0a0ba3-95c2-4139-8272-5c929a76eb82","html_url":"https://github.com/tuenti/ldap-expire-notify","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuenti%2Fldap-expire-notify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuenti%2Fldap-expire-notify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuenti%2Fldap-expire-notify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuenti%2Fldap-expire-notify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tuenti","download_url":"https://codeload.github.com/tuenti/ldap-expire-notify/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254367923,"owners_count":22059585,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["email","ldap","notify","slack","webhook"],"created_at":"2024-11-19T13:32:52.818Z","updated_at":"2025-05-15T15:33:42.972Z","avatar_url":"https://github.com/tuenti.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"LDAP Expire Notify\n==================\n\n.. image:: https://circleci.com/gh/tuenti/ldap-expire-notify.svg?style=svg\n    :target: https://circleci.com/gh/tuenti/ldap-expire-notify\n.. image:: https://codecov.io/gh/tuenti/ldap-expire-notify/branch/master/graph/badge.svg\n    :target: https://codecov.io/gh/tuenti/ldap-expire-notify\n\n``ldap-expire-notify`` is a tool to notify your LDAP users when their password\nis about to expire. It supports several kind of notification **channels**.\n\n\nFeatures\n--------\n\n- Configure several notification **channels** with different thresholds.\n- Currently supported channels include:\n  - Email\n  - Webhook\n\nInstallation\n------------\n\nInstall ldap-expire-notify by running:\n\n::\n\n  pip install git+https://github.com/tuenti/ldap-expire-notify@0.1.1#egg=ldap_expire_notify\n\nHow to use\n----------\n\nFor a complete list of parameters run ``ldap-expire-notify --help``\n\n::\n\n  $ ldap-expire-notify --help\n  Usage: ldap-expire-notify [OPTIONS]\n\n  Options:\n    -H, --host TEXT                 LDAP server host, must include protocol\n    -p, --port INTEGER              LDAP server port\n    -D, --bind-dn TEXT              DN used to bind to LDAP server  [required]\n    --pwd TEXT                      Password used to bind to LDAP server\n                                    [required]\n    -b, --base-dn TEXT              Base DN used to perform searches in LDAP\n                                    server  [required]\n    --starttls / --no-starttls      Use StartTLS feature when connecting to LDAP\n                                    server\n    --ignorecert / --no-ignore-cert\n                                    Ignore LDAP Certificate when binding (not\n                                    recommended)\n    -q, --users-query TEXT          Query used to retrieve all users\n    -f, --user-attrs TEXT           User attributes to be retrieved\n    --query-scope [BASE|ONELEVEL|SUBTREE]\n                                    Query used to retrieve all users\n    -e, --modify-attr TEXT          Attribute where password modification time\n                                    is stored\n    --modify-format TEXT            Modification time strptime format\n    -M, --pwd-max-age INTEGER       Maximum password age in seconds\n    --smtp-server TEXT              SMTP server used to send emails\n    --smtp-user TEXT                User used to login into SMTP server\n    --smtp-pwd TEXT                 SMTP User password\n    --smtp-ssl / --no-smtp-ssl      Use SMTP SSL connection\n    --smtp-starttls / --no-smtp-starttls\n                                    Use STARTTLS SMTP connection\n    -c, --channels TEXT             Channels configuration, can be a json/yaml\n                                    file or a folder containing json/yaml files\n                                    [required]\n    -v, --verbosity LVL             Either CRITICAL, ERROR, WARNING, INFO or\n                                    DEBUG\n    --help                          Show this message and exit.\n\nHow to configure channels\n-------------------------\n\nChannel configuration is passed via the flags ``-c`` or ``--channels``. It can be both\na yaml/json file or a folder containing yaml/json files. If passing a folder as parameter\nall channels found in files will be merged and used.\n\nChannels file syntax\n--------------------\n\nAll channel files must have the following syntax:\n\n.. code:: yaml\n\n  ---\n  channels:\n    channel-unique-name:\n      kind: email|webhook (Required)\n      threshold: Notification threshold in seconds (Required)\n      workers: Number of threads to be spawn for the channel (default: 10)\n\nDepending on the kind, the rest of parameters may vary, following is a example\nconfiguration for email channel:\n\n.. code:: yaml\n\n  ---\n  channels:\n    email-channel:\n      kind: email\n      workers: 3\n      threshold: 604800 # 1 week\n      recipient: '{{ ldap.mail | first }}' # Required, jinja2 template syntax\n      subject: '{{ ldap.uid | first }} for password is going to expire' # Required, jinja2 template syntax\n      from: 'admin@example.com' # Required, jinja2 template syntax\n      body: | # Required, jinja2 template syntax\n        \u003chtml\u003e\n          \u003cbody\u003e\n            \u003ch3\u003e This is LDAP expire password notification \u003c/h3\u003e\n            \u003cp\u003e Hi {{ ldap.givenName | first}}, your LDAP password will expire at {{ expiration }} days.\u003c/p\u003e\n            \u003cp\u003e Contact your system administrator to update it \u003c/p\u003e\n          \u003c/body\u003e\n        \u003c/html\u003e\n\nFollowing is a example configuration for webhook channel:\n\n.. code:: yaml\n\n  channels:\n    webhook-channel:\n      kind: webhook\n      workers: 3\n      threshold: 604800 # 1 week\n      throttle_code: 429 # Optional, default: 429\n      throttle_retries: 10 # Optional, default: 5\n      throttle_max_sleep: 10 # Optional, default: 30\n      headers: # Optional, must be a hash map\n        Content-Type: application/json\n      body: | # Optional, jinja2 template syntax\n        {\n          \"comment\": \"This is a test webhook that will POST a JSON body and some headers\",\n          \"msg\": \"Hi {{ ldap.cn | first }}, your LDAP password will expire in the next {{ threshold_day }} days or less\",\n          \"recipient\": \"@{{ ldap.slack | first }}\"\n        }\n      url: 'http://httpbin.org/anything/{{ ldap.uid | first }}' # Required, jinja2 template syntax\n      method: post  # Optional, default: get\n\n**About throttling**\nIf ``throttle_code`` is returned from remote endpoint as an HTTP status code, throttling mechanism\nwill be triggered. It implements exponential backoff starting from 1 seconds and applying a factor\nof 2 until ``throttle_max_sleep``. A total of ``throttle_retries`` iterations will be done before\nfailing.\n\n\nHow tool works\n--------------\n\nFor every entry returned by LDAP using ``--users-query``, the expiration time\nis computed using the ``--modify-attr`` that should be present in the the same entry,\nif the current time substracted expiration time is **less than or equal** ``channel.threshold``,\nthe a notification is sent.\n\nWhich fields are available in templates\n---------------------------------------\n\nFor all setting fields that are **jinja2** compatible, the following fields are exported:\n\n- ``expiration``: Is the expiration time. It is an instance of ``datetime.datetime``.\n- ``dn``: This is the user DN from LDAP.\n- ``threshold``: Is the channel threshold in seconds\n- ``threshold_hour``: Is the channel threshold in hours\n- ``threshold_day``: Is the channel threshold in days\n- ``ldap``: This is the the user LDAP entry, so any user's attribute can be used. \\\n  Note that LDAP library returns a list for every attribute but usually only 1 value is\n  present, so to use the first element the ``| first`` **jinja2** filter may be used.\n\nDeveloping\n----------\n\nTo setup developing environment you'll need to setup a ``virtualenv``.\n\nOnce your ``virtualenv`` is setup and activated, run:\n\n::\n\n  make develop\n\nThis will install all dependencies needed.\n\n\nContribute\n----------\n\n- Issue Tracker: `\u003cgithub.com/tuenti/ldap-expire-notify/issues\u003e`_\n- Source Code: `\u003cgithub.com/tuenti/ldap-expire-notify\u003e`_\n\nSupport\n-------\n\nIf you are having issues, please let us know by opening a Github Issue.\n\nLicense\n-------\n\nThe project is licensed under the Apache license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftuenti%2Fldap-expire-notify","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftuenti%2Fldap-expire-notify","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftuenti%2Fldap-expire-notify/lists"}