search

spantaleev / matrix-docker-ansible-deploy

🐳 Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker
GNU Affero General Public License v3.0
4.93k stars 1.05k forks source link

[feature-request] Migrate from local user database to openLDAP #836

Closed TheOneWithTheBraid closed 3 years ago

TheOneWithTheBraid commented 3 years ago

Is there any way to migrate locally created (aka inside Synapse's DB) users to an LDAP server like openLDAP ?

In my case, we started a small Matrix service which is now expanding to more and more tools for which we would like to provide unified authentication. Hence, we would like to migrate Synapse's users to an LDAP provider.

Is this somehow possible?

tntclaus commented 3 years ago

I guess it is.

Following steps may get you what you need:

  1. Backup your matrix db :)
  2. Install and setup OpenLDAP (see comment below)
  3. Setup user accounts in OpenLDAP which will have exactly same ids that your users do have in matrix now
  4. Enable LDAP auth in synapse and allow login with ids same as existing users have.
  5. Disable in-matrix registration.

Little advice: check FreeIPA. Any LDAP server by itself is more pain in the ass than advantage. It should work in conjunction with bunch of other software and services. Or you can try KeyCloak / JetBrains Hub (free, project-oriented, but not foss) that are more handy if you need SSO or won't ever need HBAC (host based access control), PAM and other kerberos stuff to controll access to numerous linux-operated vm fleet or employee desktops.

TheOneWithTheBraid commented 3 years ago

I will give FreeIPA a try.

Anyway, if I set up the new user accounts on the LDAP server, there's no way to import the existing passwords, right? All users are forced to re-create their passwords that way, right.

tntclaus commented 3 years ago

Yes, there is no way to do so as passwords are normally hashed.

If you gonna give FreeIPA a try start with CentOS 8 as a host OS for FreeIPA and check very well maintained ansible modules and roles for FreeIPA: https://github.com/freeipa/ansible-freeipa

TheOneWithTheBraid commented 3 years ago

Do you know which password hashing algorithm Synapse uses? Maybe it's possible to manually import them...

pushytoxin commented 3 years ago

bcrypt, and if I read correctly rounds == salt rounds == 12 (default)

3nprob commented 2 years ago

For anyone else coming here, I can recommend checking out glauth. While it probably has the features you'd want from an LDAP server (and other services can take responsibility for other parts of your ID/auth stack), it has way less features then FreeIPA and is orders of magnitude simpler to configure and maintain.

FreeIPA is still a great project and has its use-cases but it may be way more than you're bargaining for.