Merge pull request #280 from consideRatio/pr/use-lookup-dn-username-f…

…alse

Change `use_lookup_dn_username` default value to False

README.md

@@ -293,9 +293,16 @@ If found, these will be available as `auth_state["user_attributes"]`.
 
 Only used with `lookup_dn=True`.
 
-If configured True (default value), the `lookup_dn_user_dn_attribute`
-value used to build the LDAP user's DN string is also used as the
-authenticated user's JuptyerHub username.
+If configured True, the `lookup_dn_user_dn_attribute` value used to
+build the LDAP user's DN string is also used as the authenticated user's
+JuptyerHub username.
+
+If this is configured True, its important to ensure that the values of
+`lookup_dn_user_dn_attribute` are unique even after the are normalized
+to be lowercase, otherwise two LDAP users could end up sharing the same
+JupyterHub username.
+
+With ldapauthenticator 2, the default value was changed to False.
 
 #### `LDAPAuthenticator.search_filter`
 

ldapauthenticator/ldapauthenticator.py

@@ -391,14 +391,21 @@ def _observe_escape_userdn(self, change):
     )
 
     use_lookup_dn_username = Bool(
-        True,
+        False,
         config=True,
         help="""
         Only used with `lookup_dn=True`.
 
-        If configured True (default value), the `lookup_dn_user_dn_attribute`
-        value used to build the LDAP user's DN string is also used as the
-        authenticated user's JuptyerHub username.
+        If configured True, the `lookup_dn_user_dn_attribute` value used to
+        build the LDAP user's DN string is also used as the authenticated user's
+        JuptyerHub username.
+
+        If this is configured True, its important to ensure that the values of
+        `lookup_dn_user_dn_attribute` are unique even after the are normalized
+        to be lowercase, otherwise two LDAP users could end up sharing the same
+        JupyterHub username.
+
+        With ldapauthenticator 2, the default value was changed to False.
         """,
     )
 

ldapauthenticator/tests/conftest.py

@@ -19,7 +19,6 @@ def c():
     c.LDAPAuthenticator.user_attribute = "uid"
     c.LDAPAuthenticator.lookup_dn_user_dn_attribute = "cn"
     c.LDAPAuthenticator.attributes = ["uid", "cn", "mail", "ou"]
-    c.LDAPAuthenticator.use_lookup_dn_username = False
 
     c.LDAPAuthenticator.allowed_groups = [
         "cn=admin_staff,ou=people,dc=planetexpress,dc=com",