mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-13 03:13:58 +03:00
FreeIPA and LDAP group sync #2691
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @samip5 on GitHub (Mar 2, 2022).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
Using FreeIPA with LDAP and trying to get LDAP groups to sync
Exact BookStack Version
v22.02.1
Log Content
No response
PHP Version
No response
Hosting Environment
Linuxserver.io Docker container with nginx reverse proxy
@samip5 commented on GitHub (Mar 2, 2022):
How can I map LDAP groups to Bookstack roles? I don't want to create exact replicas of the roles in LDAP?
I'm using the baseDN:
cn=accounts,dc=redacted,dc=redacted,dc=fi@ssddanbrown commented on GitHub (Mar 2, 2022):
Hi @samip5,
My video here explains LDAP group mapping with BookStack:
https://youtu.be/50qw_LkhwoM?t=1126
Around the
27:45timestamp of the video I talk about mapping groups to roles with differing names.@samip5 commented on GitHub (Mar 2, 2022):
Oh, thank you. Somehow didin't even tought to look if there's video docs about it, I think that should probably be created into the docs site as well, or have a link to the video there next to LDAP Group mappings.
Can I not do those mappings from an .env file? I would love to be able to do those there, so that's more easy to do ansible on.
@ssddanbrown commented on GitHub (Mar 2, 2022):
Yeah, am planning to do this, the videos are fairly new.
No, since the BookStack roles can be dynamic (managed within the interface) I'd look to keep this mapping within the interface alongside other role detail. It is just a text field within the database though, on the
rolestable (If you can ansible up some cheeky database update commands).@samip5 commented on GitHub (Mar 2, 2022):
co-workers might not like that.... even if that is more than likely possible.
@ssddanbrown commented on GitHub (Mar 2, 2022):
Sure, but I'm not keen to add an optional system for mapping, for an optional component of an optional authentication system 😬
I'll keep this open as a reminder to add video links to our docs to support future readers.
@samip5 commented on GitHub (Mar 2, 2022):
Also, in my FreeIPA, the solution in https://github.com/BookStackApp/BookStack/pull/2753#issuecomment-843558165 doesn't seem to work anymore. Using FreeIPA v4.9.0.
Bookstack doesn't seem to find any groups when set to use memberOf and Base DN:
cn=accounts,dc=redacted,dc=redacted,dc=fiShould those be visiable when trying to login with
LDAP_DUMP_USER_DETAILSenabled?@ssddanbrown commented on GitHub (Mar 2, 2022):
No, not for LDAP, group fetching is done via secondary lookups after the user is dumped for this option.
The solution in that thread was to add an additional filter to the
LDAP_USER_FILTERoption to prevent matching against duplicates. Did you update theLDAP_USER_FILTER? What part is not working?@samip5 commented on GitHub (Mar 2, 2022):
I'm sorry but what filter there? I did not spot any changes to that filter there? I just changed my base DN to the one with
cn=accounts.Then how should I debug this properly?
@samip5 commented on GitHub (Mar 2, 2022):
It seems anonymous bind will not see mail address nor the groups users are members of.
However it also created an expection when I logged-in while it edited the user to be admin.
Exception Content
@ssddanbrown commented on GitHub (Mar 2, 2022):
Within #2753 there were two potential solutions I put forward, changing base DN or altering the
LDAP_USER_FILTERto only target one set of users. I'm not sure what approach they used though. Might have been the base DN change.Debugging options for LDAP groups are limited within BookStack to be honest. I think most people may debug via using
ldapsearchon the command line from the same machine, using the same options to emulate the BookStack calls.Adding the below between these two lines would dump out the groups although after some BookStack processing.
You might need
APP_DEBUG=trueenabled while doing that (Can potentially expose details while enabled).@samip5 commented on GitHub (Mar 2, 2022):
It seems that the exception only happens if the user already exists, but doesn't for new one with group sync working.
It does work though still, it just throws an exception too.
@ssddanbrown commented on GitHub (Mar 3, 2022):
YouTube links added to docs in
9e9e77c114so will therefore close this off.@samip5 If that's exception is a reproducible error feel free to raise an issue for it. Not sure how that can occur in normal usage unless you're replacing numeric IDs in the URL with words, but might point to a bad link somewhere.