nuokh
commented
3 years ago Okay here is my take on it using an online ldap test server as an example. I guess there is still some mistake in this approach because I won't get it to work, but maybe it helps as a starting point:
Install and run a fresh Taiga6 docker installation according to this guide. Then go into the backend container:
sudo docker exec -it taiga-docker_taiga-back_1 /bin/bash
Get an editor:
apt update
apt install vim
Edit the common.py config file:
vim settings/common.py
Paste the following configuration between the "#TELEMETRY" and "# NOTE: DON'T INSERT ANYTHING AFTER THIS BLOCK"-block:
INSTALLED_APPS += ["taiga_contrib_ldap_auth_ext"]
# TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/16
LDAP_SERVER = 'ldap://ldap.forumsys.com'
LDAP_PORT = 389
# Flag to enable LDAP with STARTTLS before bind
LDAP_START_TLS = False
# Support of alternative LDAP ciphersuites
#from ldap3 import Tls
#import ssl
#LDAP_TLS_CERTS = Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1, ciphers='RSA+3DES')
# Full DN of the service account use to connect to LDAP server and search for login user's account entry
# If LDAP_BIND_DN is not specified, or is blank, then an anonymous bind is attempated
LDAP_BIND_DN = 'cn=read-only-admin,dc=example,dc=com'
LDAP_BIND_PASSWORD = 'password'
# Starting point within LDAP structure to search for login user
LDAP_SEARCH_BASE = 'ou=mathematicians,dc=example,dc=com'
# Additional search criteria to the filter (will be ANDed)
#LDAP_SEARCH_FILTER_ADDITIONAL = '(mail=*)'
# Names of attributes to get username, e-mail and full name values from
# These fields need to have a value in LDAP
LDAP_USERNAME_ATTRIBUTE = 'uid'
LDAP_EMAIL_ATTRIBUTE = 'mail'
LDAP_FULL_NAME_ATTRIBUTE = 'displayName'
# Option to not store the passwords in the local db
#LDAP_SAVE_LOGIN_PASSWORD = False
# TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/15
# Group search filter where $1 is the project slug and $2 is the role slug
#LDAP_GROUP_SEARCH_FILTER = 'CN=$2,OU=$1,OU=Groups,DC=example,DC=net'
# TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/15
# Use an attribute in the user entry for membership
#LDAP_USER_MEMBER_ATTRIBUTE = 'memberof,primaryGroupID'
# TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/15
# Starting point within LDAP structure to search for login group
#LDAP_GROUP_SEARCH_BASE = 'OU=Groups,DC=example,DC=net'
# Group classes filter
#LDAP_GROUP_FILTER = '(|(objectclass=group)(objectclass=groupofnames)(objectclass=groupofuniquenames))'
# Group member attribute
#LDAP_GROUP_MEMBER_ATTRIBUTE = 'memberof,primaryGroupID'
# TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/17
# Taiga super users group id
#LDAP_GROUP_ADMIN = 'OU=TaigaAdmin,DC=example,DC=net'
# Fallback on normal authentication method if LDAP auth fails. Uncomment to disable and only allow LDAP login.
#LDAP_FALLBACK = ""
# Function to map LDAP username to local DB user unique identifier.
# Upon successful LDAP bind, will override returned username attribute
# value. May result in unexpected failures if changed after the database
# has been populated.
#
def _ldap_slugify(uid: str) -> str:
# example: force lower-case
#uid = uid.lower()
return uid
# To enable the function above, uncomment the line below to store the function in the variable
#LDAP_MAP_USERNAME_TO_UID = _ldap_slugify
# Similarly, you can apply filters to the email and name by defining functions and specifying them here in the same way
#LDAP_MAP_EMAIL = _ldap_map_email
#LDAP_MAP_NAME = _ldap_map_nameSave and quit common.py.
Install the plugin:
source /opt/venv/bin/activate
(venv) pip install taiga-contrib-ldap-auth-ext
Leave the Python venv by typing:
deactivate
Exit the taiga-back container:
exit
Enter the taiga-front container:
sudo docker exec -it taiga-docker_taiga-front_1 /bin/bash
Open conf.json:
vi usr/share/nginx/html/conf.json
Add
"loginFormType": "ldap" and a , to the end of the line above.
The final conf.json should look like this
{
"api": "http://yourhost.com:9000/api/v1/",
"eventsUrl": "ws://yourhost.com:9000/events",
"eventsMaxMissedHeartbeats": 5,
"eventsHeartbeatIntervalTime": 60000,
"eventsReconnectTryInterval": 10000,
"debug": false,
"debugInfo": false,
"defaultLanguage": "en",
"themes": ["taiga"],
"defaultTheme": "taiga",
"defaultLoginEnabled": true,
"publicRegisterEnabled": false,
"feedbackEnabled": true,
"supportUrl": "https://resources.taiga.io",
"privacyPolicyUrl": null,
"termsOfServiceUrl": null,
"maxUploadFileSize": null,
"contribPlugins": [],
"gitHubClientId": "",
"gitLabClientId": "",
"gitLabUrl": "",
"tagManager": { "accountId": null },
"tribeHost": null,
"enableAsanaImporter": false,
"enableGithubImporter": false,
"enableJiraImporter": false,
"enableTrelloImporter": false,
"gravatar": false,
"rtlLanguages": ["fa"],
"loginFormType": "ldap"
}Save and quit. Exit the taiga-front container.
exit
Restart the containers to apply the changes:
docker-compose restart
Now, ldap login using the username "euler" and password "password" should work. Sadly, it doesn't and I am a little bit lost on why. Hope this helps creating a step by step guide.
DraakBZH
ZheniaSteger
karezza
evandroteixeira1710
stale[bot]
I am pretty sure most of us on premise folks have tons of experience with virtualization solutions like VMWare but are total docker noobs.
I am struggling to install this plugin to Taiga6 recommended docker deployment. I know that I am struggling through a lot of problems that are basically solved with basic docker knowledge and installing the community plugin in your docker installation is probably easy for a dev with a lot of Docker experience but for us old and gnarly sysadmins it's just super confusing and we have to make sure every deployment checks certain boxes like “can we test backups, updates, restores” and “can we plug it into our LDAP to manage our 300 users that constantly forget passwords”.
Thanks for the great work overall!