-
|
Has anyone been able to use LLDAP as the auth backend for Rundeck (community edition)? I have them both running in a single docker compose and LLDAP itself is behaving beautifully, but Rundeck is apparently not liking the reply: If I am reading that correctly, the credentials that Rundeck uses to search LLDAP work. LLDAP showing success ("response: SearchResultDone(LdapResult { code: Success"), but Rundeck immediately states, "Found user?: false" |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 6 replies
-
|
Here is the docker-compose.yaml services:
lldap:
image: lldap/lldap:stable
container_name: lldap
ports:
# For LDAP, not recommended to expose, see Usage section.
#- "3890:3890"
# For LDAPS (LDAP Over SSL), enable port if LLDAP_LDAPS_OPTIONS__ENABLED set true, look env below
#- "6360:6360"
# For the web front-end
- "8084:17170"
volumes:
#- "lldap_data:/data"
# Alternatively, you can mount a local folder
- "/volume2/docker/rundeck/lldap_data:/data"
environment:
- UID=1026
- GID=100
- TZ=Europe/Berlin
- LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
- LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
- LLDAP_LDAP_BASE_DN=dc=example,dc=com
- LLDAP_LDAP_USER_PASS=adminpass
rundeck:
hostname: rundeck
image: rundeck/rundeck:5.13.0
links:
- lldap
tty: true
environment:
RUNDECK_JAAS_MODULES_0: JettyCombinedLdapLoginModule
RUNDECK_JAAS_LDAP_PROVIDERURL: ldap://lldap:3890
RUNDECK_JAAS_LDAP_BINDDN: cn=admin,ou=people,dc=example,dc=com
RUNDECK_JAAS_LDAP_BINDPASSWORD: adminpass
RUNDECK_JAAS_LDAP_USERBASEDN: ou=people,dc=example,dc=com
RUNDECK_JAAS_LDAP_ROLEBASEDN: ou=groups,dc=example,dc=com
RUNDECK_GRAILS_URL: http://127.0.0.1:4440
RUNDECK_LOGGING_LOGLEVEL_DEFAULT: debug
RUNDECK_LOGGING_LOGLEVEL_ROOT: debug
#RUNDECK_LOGGING_LOGLEVEL_HIBERNATE: debug
#RUNDECK_LOGGING_LOGLEVEL_SPRING: debug
#RUNDECK_LOGGING_LOGLEVEL_SPRINGBEAN: debug
#RUNDECK_LOGGING_LOGLEVEL_INTERNALS: debug
#RUNDECK_LOGGING_LOGLEVEL_GRAILS: debug
RUNDECK_LOGGING_LOGLEVEL_JETTY: debug
RUNDECK_JAAS_LDAP_FORCEBINDINGLOGIN: true
volumes:
#- /u01/app/rundeck/.ssh:/home/rundeck/.ssh
- /volume2/docker/rundeck/rundeck_data:/home/rundeck/server/data
# - ${RUNDECK_LICENSE_FILE:-/dev/null}:/home/rundeck/etc/rundeckpro-license.key
ports:
- 8083:4440NOTE: this is just a first attempt to get these running together so it is just a "throw example". no need to chide me for posting a password. :) |
Beta Was this translation helpful? Give feedback.
-
|
You should use "uid" rather than "cn", both when logging in and when looking up users. Logging in works right now, but when looking for a user with cn "admin", it fails to find. Having a quick look at the config from the website, it seems that you're looking for the userRdnAttribute or userIdAttribute, which should both be "uid" |
Beta Was this translation helpful? Give feedback.
-
|
This is what was needed. I added these to my docker-compose.yaml as environment variables for rundeck: RUNDECK_JAAS_LDAP_USERRDNATTRIBUTE: uid
RUNDECK_JAAS_LDAP_USERIDATTRIBUTE: uidand now I can use |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! Do you think you can contribute a configuration guide? |
Beta Was this translation helpful? Give feedback.
-
|
Yes. Maybe not tonight, but I will do one. We have been trying to use Rundeck in my organisation to make it easier for our users to be more self sufficient with technical tasks, but the authentication set up for the community edition is limited to options that do not allow the user to change their own password or the administrator to create new users easily. LLDAP is a great solution to this problem. I would be happy to help others connect the two applications. |
Beta Was this translation helpful? Give feedback.
-
|
So I may have figured this out. I noticed in an ldapsearch result that my admin user was: but I had used my dn is uid=admin and not cn=admin. so I changed it to no luck. Rundeck apparently wants a cn not a uid. So I changed it back to and went into the LLDAP front end and change the display name from Administrator to admin (making it the cn). Authentication now works. I then added an "admin" group and put my admin user in it. Rundeck now lets me login as an administrator. |
Beta Was this translation helpful? Give feedback.
-
|
Right, but other users won't be found unless their display game will be the same as their uid |
Beta Was this translation helpful? Give feedback.
-
|
yep. just ran into that. looking into your previous comment about definining the attributes. thanks for the help. |
Beta Was this translation helpful? Give feedback.
You should use "uid" rather than "cn", both when logging in and when looking up users. Logging in works right now, but when looking for a user with cn "admin", it fails to find.
Having a quick look at the config from the website, it seems that you're looking for the userRdnAttribute or userIdAttribute, which should both be "uid"