8000 Working LDAP settings for FreeIPA v4.6.6 · Issue #3357 · wekan/wekan · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Working LDAP settings for FreeIPA v4.6.6 #3357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
tromlet opened this issue Nov 17, 2020 · 1 comment
Closed

Working LDAP settings for FreeIPA v4.6.6 #3357

tromlet opened this issue Nov 17, 2020 · 1 comment

Comments

@tromlet
Copy link
tromlet commented Nov 17, 2020 •
edited
Loading

Hey @xet7 -

I've got some LDAP settings that I've tested to work correctly with FreeIPA v4.6.6, thought you might want to add them to this page (between "Active Directory" and "OpenLDAP" for alphabetization) in order to help IPA users find their way with WeKan. This is not the latest version of FreeIPA, but it's close enough that the schema should be consistent with even the latest version, or older versions. This is also using LDAP over SSL, so that's nice. :)

I have not gotten groups to work (see: wekan/ldap#87), but users can authenticate with LDAP and use their passwords. Works great.

snap set wekan ldap-enable='true'
snap set wekan ldap-host='ldap.example.com'

# Use 'tls' and port 389 for STARTTLS, which is more secure than standard LDAPS.
snap set wekan ldap-port='389'
snap set wekan ldap-encryption='tls'

snap set wekan ldap-timeout='10000'
snap set wekan ldap-idle-timeout='10000'
snap set wekan ldap-connect-timeout='10000'
snap set wekan ldap-authentication='true'
snap set wekan ldap-authentication-userdn='uid=ldapuser,cn=users,cn=accounts,dc=example, dc=com'
snap set wekan ldap-authentication-password='password'

# This must be set to "false" for self-signed certificates to work - enable it
# for better security if you are using a certificate verified by a commercial
# Certificate Authority (like DigiCert, Let's Encrypt, etc.)
snap set wekan ldap-reject-unauthorized='false'


# This must be the plaintext certificate data, which you can get by running the
# follwing command:
#     cat ca.example.com.pem | tr -d '\n'
# This removes the hidden newline characters, and allows you to copy it
# straight from your terminal and past it into the snap set command.
#
# Pointing it to a file doesn't work - I tried.
snap set wekan ldap-ca-cert='-----BEGIN CERTIFICATE-----[blahblahblah]-----END CERTIFICATE-----'

snap set wekan ldap-log-enabled='true'
snap set wekan ldap-basedn='dc=example,dc=com'
snap set wekan ldap-background-sync='true'
snap set wekan ldap-background-sync-keep-existant-users-updated='true'
snap set wekan ldap-background-sync-import-new-users='true'
snap set wekan ldap-background-sync-interval='Every 1 minute'
snap set wekan ldap-merge-existing-users='true'
snap set wekan ldap-user-search-field='uid'
snap set wekan ldap-user-search-filter='(&(objectclass=person))'
snap set wekan ldap-user-search-scope='sub'
snap set wekan ldap-username-field='uid'
snap set wekan ldap-fullname-field='displayName'
snap set wekan ldap-email-field='mail'
snap set wekan ldap-sync-user-data='true'
snap set wekan ldap-sync-user-data-fieldmap='{"displayName":"name", "mail":"email", "initials":"initials"}'
@xet7
Copy link
Member
xet7 commented Nov 18, 2020

@tromlet

Thanks! I added it to https://github.com/wekan/wekan/wiki/LDAP#freeipa-v466

@xet7 xet7 closed this as completed Nov 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@xet7 @tromlet
0