Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LLDAP - Update ReadMe #4571

Merged
merged 6 commits into from
Apr 30, 2024
Merged

LLDAP - Update ReadMe #4571

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
538d683
Update readme.md
docjyJ Apr 22, 2024
d5c754d
Update readme.md
docjyJ Apr 22, 2024
f32df3e
Update readme.md
docjyJ Apr 22, 2024
5fb3c9d
New doc
docjyJ Apr 22, 2024
bc259e4
Update readme.md
docjyJ Apr 27, 2024
2e964b9
Update readme.md
docjyJ Apr 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 82 additions & 59 deletions community-containers/lldap/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,68 +1,91 @@
## Light LDAP server
This container bundles LLDAP server and auto-configures your nextcloud instance for you.
This container bundles LLDAP server and auto-configures your Nextcloud instance for you.

### Notes
- In order to access your LLDAP web interface outside the local network, you have to set up your own reverse proxy. You can set up a reverse proxy following [these instructions](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md) OR use the [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container that will automatically configure `ldap.$NC_DOMAIN` to redirect to your Lldap. You need to point the reverse proxy at port 17170 of this server.
- After adding and starting the container, you can log in to the lldap web interface by using the password that you can retrieve via `sudo docker inspect nextcloud-aio-lldap | grep LLDAP_JWT_SECRET`.
- Also, you need to run the following script one time in order to activate the ldap config in nextcloud so that Nextcloud uses lldap as user backend. You can see a [nextcloud example configuration provide by LLDAP](https://github.com/lldap/lldap/blob/main/example_configs/nextcloud.md)<br>
First, you need to retrieve the LLDAP admin password via `sudo docker inspect nextcloud-aio-lldap | grep LLDAP_LDAP_USER_PASS`. This will be used later on which you need to type in or copy and paste.
```bash
# Now go into the container
sudo docker exec --user www-data -it nextcloud-aio-nextcloud bash
```
Now inside the container:
```bash
# Get Base
BASE_DN="dc=${NC_DOMAIN//./,dc=}"

# Create a new empty ldap config
CONF_NAME=$(php /var/www/html/occ ldap:create-empty-config -p)

# Set the ldap password
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapAgentPassword "<your-password>"

# Set the ldap config
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapAgentName "uid=ro_admin,ou=people,$BASE_DN"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapBase "$BASE_DN"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapBaseGroups "$BASE_DN"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapBaseUsers "$BASE_DN"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapCacheTTL 600
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapConfigurationActive 1
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapEmailAttribute "mail"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapExperiencedAdmin 0
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGidNumber "gidNumber"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupDisplayName "cn"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupFilter "(&(objectclass=groupOfUniqueNames))"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupFilterGroups ""
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupFilterMode 0
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupFilterObjectclass "groupOfUniqueNames"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapGroupMemberAssocAttr "uniqueMember"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapHost "nextcloud-aio-lldap"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapLoginFilterAttributes "uid"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapLoginFilterEmail 0
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapLoginFilterUsername 1
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapMatchingRuleInChainState "unknown"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapNestedGroups 0
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapPagingSize 500
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapPort 3890
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapTLS 0
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUserAvatarRule "default"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUserDisplayName "displayname"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUserFilter "(&(objectClass=person)(uid=%uid))"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUserFilterMode 1
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUserFilterObjectclass "person"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUuidGroupAttribute "auto"
php /var/www/html/occ ldap:set-config "$CONF_NAME" ldapUuidUserAttribute "auto"
php /var/www/html/occ ldap:set-config "$CONF_NAME" turnOnPasswordChange 0

# Test the ldap config
php /var/www/html/occ ldap:test-config "$NAME"

# Exit the container shell
exit
```
- After adding and starting the container, you can log in to the lldap web interface by using the username `admin` and the password that you can retrieve via `sudo docker inspect nextcloud-aio-lldap | grep LLDAP_JWT_SECRET`.
- To configure Nextcloud, you can use the generic configuration proposed below.
- For advanced configurations, see how to configure a client with lldap https://github.com/lldap/lldap#client-configuration
- Also, see how Nextcloud's LDAP application works https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html
- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack

### Generic Nextcloud LDAP config
Functionality with this configuration:
- User and group management.
- Login via username (or email) and password.
- Profile picture sync.
- Synchronization of administrator accounts (via the lldap_admin group).

> For simplicity, this configuration is done via the command line (don't worry, it's very simple).

First, you need to retrieve the LLDAP admin password, this will be used later on. Which you need to type in or copy and paste:
```bash
sudo docker inspect nextcloud-aio-lldap | grep LLDAP_LDAP_USER_PASS
```

Now go into the Nextcloud container:
```bash
sudo docker exec --user www-data -it nextcloud-aio-nextcloud bash
```
Now inside the container:
```bash
# Get Base
BASE_DN="dc=${NC_DOMAIN//./,dc=}"

# Create a new empty ldap config
CONF_NAME=$(php /var/www/html/occ ldap:create-empty-config -p)

# Check that the base DN matches your domain and retrieve your configuration name
echo "Base DN: '$BASE_DN', Config name: '$CONF_NAME'"

# Set the ldap password
php /var/www/html/occ ldap:set-config $CONF_NAME ldapAgentPassword "<your-password>"

# Set the ldap config: Host and connection
php /var/www/html/occ ldap:set-config $CONF_NAME ldapAdminGroup lldap_admin
php /var/www/html/occ ldap:set-config $CONF_NAME ldapAgentName "cn=admin,ou=people,$BASE_DN"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapBase "$BASE_DN"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapHost "ldap://nextcloud-aio-lldap"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapPort 3890
php /var/www/html/occ ldap:set-config $CONF_NAME ldapTLS 0
php /var/www/html/occ ldap:set-config $CONF_NAME turnOnPasswordChange 0

# Set the ldap config: Users
php /var/www/html/occ ldap:set-config $CONF_NAME ldapBaseUsers "ou=people,$BASE_DN"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapEmailAttribute mail
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGidNumber gidNumber
php /var/www/html/occ ldap:set-config $CONF_NAME ldapLoginFilter "(&(|(objectclass=person))(|(uid=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid))))"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapLoginFilterEmail 1
php /var/www/html/occ ldap:set-config $CONF_NAME ldapLoginFilterUsername 1
php /var/www/html/occ ldap:set-config $CONF_NAME ldapUserAvatarRule default
php /var/www/html/occ ldap:set-config $CONF_NAME ldapUserDisplayName cn
php /var/www/html/occ ldap:set-config $CONF_NAME ldapUserFilter "(|(objectclass=person))"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapUserFilterMode 0
php /var/www/html/occ ldap:set-config $CONF_NAME ldapUserFilterObjectclass person

# Set the ldap config: Groups
php /var/www/html/occ ldap:set-config $CONF_NAME ldapBaseGroups "ou=groups,$BASE_DN"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGroupDisplayName cn
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGroupFilter "(&(|(objectclass=groupOfUniqueNames)))"
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGroupFilterMode 0
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGroupFilterObjectclass groupOfUniqueNames
php /var/www/html/occ ldap:set-config $CONF_NAME ldapGroupMemberAssocAttr uniqueMember
php /var/www/html/occ ldap:set-config $CONF_NAME useMemberOfToDetectMembership 1

# Optional : Check the configuration
#php /var/www/html/occ ldap:show-config $CONF_NAME

# Test the ldap config
php /var/www/html/occ ldap:test-config $CONF_NAME

# Enable ldap config
php /var/www/html/occ ldap:set-config $CONF_NAME ldapConfigurationActive 1

# Exit the container shell
exit
```
It's done ! All you have to do is go to the Nextcloud administration interface to see the magic of LDAP.

### Repository
https://github.com/lldap/lldap

Expand Down