mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
LDAP and local authentication #878
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @emmanuelhaine on GitHub (Oct 24, 2018).
Hey guys,
I setting up a fresh installation and I'm having a problem with ldap and local authentication together.
When I change the AUTH_METHOD to ldap I cannot login with he local account. I followed the steps bellow
"You may find that you cannot log in with your initial Admin account after changing the AUTH_METHOD to ldap. To get around this set the AUTH_METHOD to standard, login with your admin account then change it back to ldap. You get then edit your profile and add your LDAP uid under the ‘External Authentication ID’ field. You will then be able to login in with that ID."
But I haven't success.
@ssddanbrown commented on GitHub (Oct 24, 2018):
Hi @emanuelhaine, As it stands, LDAP cannot be used alongside the standard email/username option.
@emmanuelhaine commented on GitHub (Oct 24, 2018):
Hey @ssddanbrown, first of all thanks for your response. I'd like to know if there's a way to use the local account in this case.
@emmanuelhaine commented on GitHub (Oct 25, 2018):
Hey @ssddanbrown , Now I understood what to do. I have a doubt about the roles. I create a role with the same group name I have on LDAP, but when I log in, the user always get the public role. How can I filter it? I set the options bellow
LDAP_USER_TO_GROUPS=true
LDAP_REMOVE_FROM_GROUPS=true
And I'm not sure about this variable
LDAP_GROUP_ATTRIBUTE
@ssddanbrown commented on GitHub (Oct 26, 2018):
@emanuelhaine I most cases
LDAP_GROUP_ATTRIBUTEcan be left as-is if things are syncing since it uses the popularmemberOfattribute by default.I think the default registration role might get applied to users on LDAP group sync. Is the public role set as the default for new registrants in settings?
@emmanuelhaine commented on GitHub (Oct 26, 2018):
@ssddanbrown Thanks for your help, but I got how it works. The application recognize the LDAP groups if the role is with the same name and the LDAP_GROUP_ATTRIBUTE is with "memberOf"
So, my configuration is:
LDAP_USER_TO_GROUPS=true
LDAP_GROUP_ATTRIBUTE="memberOf"
LDAP_REMOVE_FROM_GROUPS=true
I also set this variable bellow, because some users on my LDAP don't have e-mail. If this variable is not set, I can't login with a user without e-mail.
LDAP_EMAIL_ATTRIBUTE=false
I think this issue can be closed.
@emmanuelhaine commented on GitHub (Oct 26, 2018):
I had to change thist variable to default value
LDAP_EMAIL_ATTRIBUTE
In cases users don't have e-mail, they can type a valid email and login.