I'm testing out wekan to see if its features match our needs.
I have installed the latest version via docker compose, with an apache httpd reverse proxy, and configured it to use LDAP with our assigned directory.
The only issue I have is that wekan's LDAP integration does not allow authenticating with LDAP users if the users are in a different "ou" than the groups, in the LDAP directory I have been assigned users and groups are in different branches :
ou=users,dc=example,dc=org,
ou=groups,dc=example,dc=org
As far as I understand, the way wekan's LDAP integration is thought does not allow binding to the directory with the userusing a "Bind DN" different from the "Base DN", so I cannot retrieve groups info if I'm binding with the user.
I am more than willing to put together a PR that adds a "LDAP_USER_AUTHENTICATION_BINDDN" variable, used only to execute the login bind, and that will default to the same value as "LDAP_BASEDN".
An alternative could be to add a different (and optional) group filtering to retrieve groups info from the "memberOf" attribute of the user, instead of searching for the user in the groups.
Can you confirm that all the LDAP handling is done in packages/wekan-ldap?
I'm testing out wekan to see if its features match our needs.
I have installed the latest version via docker compose, with an apache httpd reverse proxy, and configured it to use LDAP with our assigned directory.
The only issue I have is that wekan's LDAP integration does not allow authenticating with LDAP users if the users are in a different "ou" than the groups, in the LDAP directory I have been assigned users and groups are in different branches :
ou=users,dc=example,dc=org,ou=groups,dc=example,dc=orgAs far as I understand, the way wekan's LDAP integration is thought does not allow binding to the directory with the userusing a "Bind DN" different from the "Base DN", so I cannot retrieve groups info if I'm binding with the user.
I am more than willing to put together a PR that adds a "LDAP_USER_AUTHENTICATION_BINDDN" variable, used only to execute the login bind, and that will default to the same value as "LDAP_BASEDN".
An alternative could be to add a different (and optional) group filtering to retrieve groups info from the "memberOf" attribute of the user, instead of searching for the user in the groups.
Can you confirm that all the LDAP handling is done in
packages/wekan-ldap?