diff options
Diffstat (limited to 'doc/ldap-group-sync.markdown')
-rw-r--r-- | doc/ldap-group-sync.markdown | 28 |
1 files changed, 24 insertions, 4 deletions
diff --git a/doc/ldap-group-sync.markdown b/doc/ldap-group-sync.markdown index 69678a8a..b519146b 100644 --- a/doc/ldap-group-sync.markdown +++ b/doc/ldap-group-sync.markdown @@ -5,7 +5,7 @@ Requirements ------------ - Have LDAP authentication properly configured -- Use a LDAP server that supports `memberOf` +- Use a LDAP server that supports `memberOf` or `memberUid` (PosixGroups) Define automatically user roles based on LDAP groups ---------------------------------------------------- @@ -15,7 +15,7 @@ Use these constants in your config file: - `LDAP_GROUP_ADMIN_DN`: Distinguished names for application administrators - `LDAP_GROUP_MANAGER_DN`: Distinguished names for application managers -Example: +### Example for Active Directory: ```php define('LDAP_GROUP_ADMIN_DN', 'CN=Kanboard Admins,CN=Users,DC=kanboard,DC=local'); @@ -26,6 +26,18 @@ define('LDAP_GROUP_MANAGER_DN', 'CN=Kanboard Managers,CN=Users,DC=kanboard,DC=lo - People member of "Kanboard Managers" will have the role "Managers" - Everybody else will have the role "User" +### Example for OpenLDAP with Posix Groups: + +```php +define('LDAP_GROUP_BASE_DN', 'ou=Groups,dc=kanboard,dc=local'); +define('LDAP_GROUP_USER_FILTER', '(&(objectClass=posixGroup)(memberUid=%s))'); +define('LDAP_GROUP_ADMIN_DN', 'cn=Kanboard Admins,ou=Groups,dc=kanboard,dc=local'); +define('LDAP_GROUP_MANAGER_DN', 'cn=Kanboard Managers,ou=Groups,dc=kanboard,dc=local'); +``` + +You **must define the parameter** `LDAP_GROUP_USER_FILTER` if your LDAP server use `memberUid` instead of `memberOf`. +All parameters of this example are mandatory. + Automatically load LDAP groups for project permissions ------------------------------------------------------ @@ -41,7 +53,7 @@ If the group doesn't exist in the local database, it will be automatically synce - `LDAP_GROUP_FILTER`: LDAP filter used to perform the query - `LDAP_GROUP_ATTRIBUTE_NAME`: LDAP attribute used to fetch the group name -Example: +### Example for Active Directory: ```php define('LDAP_GROUP_PROVIDER', true); @@ -52,7 +64,15 @@ define('LDAP_GROUP_FILTER', '(&(objectClass=group)(sAMAccountName=%s*))'); With the filter given as example above, Kanboard will search for groups that match the query. If the end-user enter the text "My group" in the auto-complete box, Kanboard will return all groups that match the pattern: `(&(objectClass=group)(sAMAccountName=My group*))`. -- Note 1: The special characters `*` is important here, otherwise an exact match will be done. +- Note 1: The special characters `*` is important here, **otherwise an exact match will be done**. - Note 2: This feature is only compatible with LDAP authentication configured in "proxy" or "anonymous" mode [More examples of LDAP filters for Active Directory](http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx) + +### Example for OpenLDAP with Posix Groups: + +```php +define('LDAP_GROUP_PROVIDER', true); +define('LDAP_GROUP_BASE_DN', 'ou=Groups,dc=kanboard,dc=local'); +define('LDAP_GROUP_FILTER', '(&(objectClass=posixGroup)(cn=%s*))'); +``` |