Repository navigation
Environment specific: Can't anthenticate with user in LDAP_SYNC_ADMIN_GROUPS and not in LDAP_GROUP_FILTER_GROUP_NAME #4036
Description
Hi there,
We are using Wekan since months now, and it works like we want. Thanks for this amazing work. Our production is in v5.31 and our preproduction in v5.62.
We use docker, and mongo 4.4 in production and 5.0.3 in preproduction;
We use our AD to authenticate users.
LDAP Parameters in docker-compose :
- LDAP_AUTHENTIFICATION=true
- LDAP_AUTHENTIFICATION_PASSWORD=password
- LDAP_AUTHENTIFICATION_USERDN=myuser
- LDAP_BACKGROUND_SYNC=true
- LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false
- LDAP_BACKGROUND_SYNC_INTERVAL='every 1 hour'
- LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=true
- LDAP_BASEDN=DC=mipih,DC=net
- LDAP_CONNECT_TIMEOUT=10000
- LDAP_DEFAULT_DOMAIN=mydefaultdomain
- LDAP_EMAIL_FIELD=mail
- LDAP_ENABLE=true
- LDAP_ENCRYPTION=ssl
- LDAP_FULLNAME_FIELD=cn
- LDAP_GROUP_FILTER_ENABLE=true
- LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE=cn
- LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE=member
- LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=dn
- LDAP_GROUP_FILTER_GROUP_NAME=MY_USER_GROUP_WITHOUT_ADMINS
- LDAP_GROUP_FILTER_OBJECTCLASS=group
- LDAP_HOST=mipih.net
- LDAP_IDLE_TIMEOUT=10000
- LDAP_LOGIN_FALLBACK=false
- LDAP_LOG_ENABLED=true
- LDAP_MERGE_EXISTING_USERS=true
- LDAP_PORT=636
- LDAP_RECONNECT=true
- LDAP_SEARCH_PAGE_SIZE=0
- LDAP_SEARCH_SIZE_LIMIT=0
- LDAP_SYNC_ADMIN_GROUPS=MY_USER_GROUP_WITH_ONLY_ADMINS
- LDAP_SYNC_ADMIN_STATUS=true
- LDAP_TIMEOUT=10000
- LDAP_UNIQUE_IDENTIFIER_FIELD=guid
- LDAP_USERNAME_FIELD=sAMAccountName
- LDAP_USER_SEARCH_FIELD=sAMAccountName
- LDAP_USER_AUTHENTICATION=false
- LDAP_USER_SEARCH_SCOPE=sub
The problem we have is : adminuser is in MY_USER_GROUP_WITH_ONLY_ADMINS and not in MY_USER_GROUP_WITHOUT_ADMINS. So he can't authenticate on Wekan. user1 is in MY_USER_GROUP_WITHOUT_ADMINS, and he can authentificate.
I tried a metagroup "MY_BIG_GROUP" with groups MY_USER_GROUP_WITH_ONLY_ADMINS and MY_USER_GROUP_WITHOUT_ADMINS, but nobody can't authenticate.
I don't want to create a new MS AD Group with everybody in this group, because new users could be forgotten.
Is it possible to declare 2 groups in LDAP_GROUP_FILTER_GROUP_NAME ? (I tried, but nothing works).
Thanks for your help.
Nath
Activity
[-]Can't anthenticate with user in LDAP_SYNC_ADMIN_GROUPS and not in LDAP_GROUP_FILTER_GROUP_NAME[/-][+]Environment specific: Can't anthenticate with user in LDAP_SYNC_ADMIN_GROUPS and not in LDAP_GROUP_FILTER_GROUP_NAME[/+]Startup schema upgrade, self-healing attachments, migration speed; fix
Changelog for #4036 #4043 #4023 #4593; finish #4043 hardening.
Document hardened LDAP admin-group login