To deploy the flask app you can use the configuration and systemd service for a gunicorn provided in the repository. The gunicorn creates in the default configuration a socket that can be used by a proxy daemon like nginx to deploy the app to the internet. The proxy daemon also would be responsible for stuff like SSL encryption.

Apart from the usual manage.py runserver and manage.py shell, the following commands are supported:

• manage.py createuser uid FirstName Surname [email] [password] - create a user
• manage.py delete_user uid - delete a user
• manage.py passwd uid - change a password for the user
• manage.py sanity - runs sanity checks, like checking that the base DN's for different things exist, and creates them if necessary
• manage.py groups - lists groups
• manage.py members group_name - list members in a group
• manage.py newgroup group_name - create a group
• manage.py delgroup group_name - delete a group
• manage.py join username group_name - add a user to a group
• manage.py remove username group_name - remove a user from a group
• manage.py unis - list unis and their tokens
• manage.py adduni name token - add a uni and a token
• manage.py deluni name - delete a uni
• manage.py set_token name token - set the token for a uni
• manage.py profile [length] [profile_dir] - run the app under a profiler
• manage.py db - Flask-Migrate DB commands:
  • manage.py db upgrade - Run database migrations
  • manage.py db migrate - Create database migrations

Permissions are managed via groups. The members of the following groups have special permissions:

• members of admin are superusers, and can administrate oauth2 applications
• members of orga can see and edit uni registration data

The following schema are required:

• core
• inetOrgPerson
• cosine
• nis
• oidc-schema

Please make sure the bind user can bind and has read&write access to the users, groups, and oauth2 subtrees.

Using the contrib/sha2 module for OpenLDAP is highly recommended, otherwise the following hashes do not work:

• HASHED_SHA256
• HASHED_SHA385
• HASHED_SHA512
• HASHED_SALTED_SHA256
• HASHED_SALTED_SHA385
• HASHED_SALTED_SHA512

A sample OpenLDAP configuration to run a testing server is included. Tests hoever are run by mocking the ldap connection. A script is included to generate the serialized data objects used from a LDIF file.