You've already forked lldap
mirror of
https://github.com/lldap/lldap.git
synced 2026-04-05 20:42:57 +01:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 6f31147bb7 |
@@ -520,7 +520,7 @@ jobs:
|
||||
path: web
|
||||
|
||||
- name: Setup QEMU
|
||||
uses: docker/setup-qemu-action@v4
|
||||
uses: docker/setup-qemu-action@v3
|
||||
- name: Setup buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
@@ -623,14 +623,14 @@ jobs:
|
||||
# Docker login to nitnelave/lldap and lldap/lldap
|
||||
- name: Login to Nitnelave/LLDAP Docker Hub
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: nitnelave
|
||||
|
||||
@@ -50,7 +50,6 @@ configuration files:
|
||||
- [Nexus](nexus.md)
|
||||
- [OCIS (OwnCloud Infinite Scale)](ocis.md)
|
||||
- [OneDev](onedev.md)
|
||||
- [OpenCloud](opencloud.md)
|
||||
- [Organizr](Organizr.md)
|
||||
- [Peertube](peertube.md)
|
||||
- [Penpot](penpot.md)
|
||||
|
||||
@@ -1,55 +0,0 @@
|
||||
# OpenCloud example config
|
||||
|
||||
|
||||
## About OpenCloud
|
||||
|
||||
A light-weight file-hosting / webDAV service written in Go and forked from ownCloud Infinite Scale (oCIS).
|
||||
|
||||
More information:
|
||||
* https://opencloud.eu
|
||||
* https://github.com/opencloud-eu
|
||||
|
||||
|
||||
## LLDAP Configuration
|
||||
|
||||
OpenCloud ships an OIDC provider and a built-in LDAP server. It officially supports using a third-party OIDC provider.
|
||||
|
||||
This is **not** what this config does. This config leaves the general auth/OIDC infrastructure in place, but replaces the LDAP server from underneath it with LLDAP.
|
||||
|
||||
Configuration happens via environment variables. On FreeBSD, these are provided via `/usr/local/etc/opencloud/config.env`; on Linux you can provide them via the Docker configuration.
|
||||
|
||||
|
||||
```dotenv
|
||||
# Replace with actual IP and Port
|
||||
OC_LDAP_URI=ldap://<lldap_ip>:3890
|
||||
# Remove the following if you use LDAPS and your cert is not self-signed
|
||||
OC_LDAP_INSECURE="true"
|
||||
|
||||
# Replace with your bind-user; can be in
|
||||
OC_LDAP_BIND_DN="cn=<bind_user>,ou=people,dc=example,dc=com"
|
||||
OC_LDAP_BIND_PASSWORD="<secret>"
|
||||
|
||||
OC_LDAP_GROUP_BASE_DN="ou=groups,dc=example,dc=com"
|
||||
OC_LDAP_GROUP_SCHEMA_ID=entryuuid
|
||||
|
||||
OC_LDAP_USER_BASE_DN="ou=people,dc=example,dc=com"
|
||||
OC_LDAP_USER_SCHEMA_ID=entryuuid
|
||||
|
||||
# Only allow users from specific group to login; remove this if everyone's allowed
|
||||
OC_LDAP_USER_FILTER='(&(objectClass=person)(memberOf=cn=<opencloud_users>,ou=groups,dc=example,dc=com))'
|
||||
|
||||
# Other options have not been tested
|
||||
OC_LDAP_DISABLE_USER_MECHANISM="none"
|
||||
|
||||
# If you bind-user is in lldap_strict_readonly set to false (this hides "forgot password"-buttons)
|
||||
OC_LDAP_SERVER_WRITE_ENABLED="false"
|
||||
# If your bind-user can change passwords:
|
||||
OC_LDAP_SERVER_WRITE_ENABLED="true" # Not tested, yet!
|
||||
|
||||
# Don't start built-in LDAP, because it's replaced by LLDAP
|
||||
OC_EXCLUDE_RUN_SERVICES="idm"
|
||||
```
|
||||
|
||||
There is currently no (documented) way to give an LDAP user (or group) admin rights in OpenCloud.
|
||||
|
||||
See also [the official LDAP documentation](https://github.com/opencloud-eu/opencloud/blob/main/devtools/deployments/opencloud_full/ldap.yml).
|
||||
@@ -48,13 +48,3 @@ To integrate with LLDAP,
|
||||
allow-invalid-certs = true
|
||||
enable = false
|
||||
```
|
||||
|
||||
## Email alias
|
||||
If you want to enable [email aliases](https://stalw.art/docs/mta/inbound/rcpt/#catch-all-addresses), you have to create a new *User-defined attribute* under *User schema* of type string. Currently, LLDAP doesn't support multi-value filters. If you want multiple aliases, you will have to create multiple attributes (`mailAlias1`, `mailAlias2`, ..., `mailAliasN`), where `N` is the maximum number of aliases an account will have.
|
||||
|
||||
You also need to change your ldap filter for emails.
|
||||
```toml
|
||||
[directory.ldap.filter]
|
||||
# Add one clause per alias attribute you created (example: mailAlias1..mailAlias3)
|
||||
email = "(&(objectclass=person)(|(mail=?)(mailAlias1=?)(mailAlias2=?)(mailAlias3=?)))"
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user