AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update LDAP documentation

Browse Source
This commit is contained in:
Frederic Guillot
2015-12-06 10:53:33 -05:00
parent 28c8af70f4
commit 6d4286ec66
5 changed files with 173 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
doc/ldap-group-sync.markdown
View File

@@ -7,30 +7,51 @@ Requirements
- Have LDAP authentication properly configured
- Use a LDAP server that supports `memberOf`
Automatically define Kanboard groups based on LDAP groups
---------------------------------------------------------
Define automatically user roles based on LDAP groups
----------------------------------------------------
In your config file, define the constants `LDAP_GROUP_ADMIN_DN` and `LDAP_GROUP_PROJECT_ADMIN_DN`. Here an example, replace the values according to your own LDAP configuration:
Use these constants in your config file:
- `LDAP_GROUP_ADMIN_DN`: Distinguished names for application administrators
- `LDAP_GROUP_MANAGER_DN`: Distinguished names for application managers
Example:
```php
define('LDAP_GROUP_ADMIN_DN', 'CN=Kanboard Admins,CN=Users,DC=kanboard,DC=local');
define('LDAP_GROUP_PROJECT_ADMIN_DN', 'CN=Kanboard Project Admins,CN=Users,DC=kanboard,DC=local');
define('LDAP_GROUP_MANAGER_DN', 'CN=Kanboard Managers,CN=Users,DC=kanboard,DC=local');
```
- People member of "Kanboard Admins" will be "Kanboard Administrators"
- People member of "Kanboard Project Admins" will be "Kanboard Project Administrators"
- Everybody else will be Kanboard Standard Users
- People member of "Kanboard Admins" will have the role "Administrator"
- People member of "Kanboard Managers" will have the role "Managers"
- Everybody else will have the role "User"
Note: At the moment, that works only at account creation.
Automatically load LDAP groups for project permissions
------------------------------------------------------
Filter Kanboard access based on the LDAP group
----------------------------------------------
This feature allow you to sync automatically LDAP groups with Kanboard groups.
Each group can have a different project role assigned.
To allow only some users to use Kanboard, use the existing `LDAP_USER_PATTERN` constant:
On the project permissions page, people can enter groups in the auto-complete field and Kanboard can search for groups with any provider enabled.
If the group doesn't exists in the local database, it will be automatically synced.
- `LDAP_GROUP_PROVIDER`: Enable the LDAP group provider
- `LDAP_GROUP_BASE_DN`: Distinguished names to find groups in LDAP directory
- `LDAP_GROUP_FILTER`: LDAP filter used to perform the query
- `LDAP_GROUP_ATTRIBUTE_NAME`: LDAP attribute used to fetch the group name
Example:
```php
define('LDAP_USER_PATTERN', '(&(objectClass=user)(sAMAccountName=%s)(memberOf=CN=Kanboard Users,CN=Users,DC=kanboard,DC=local))');
define('LDAP_GROUP_PROVIDER', true);
define('LDAP_GROUP_BASE_DN', 'CN=Groups,DC=kanboard,DC=local');
define('LDAP_GROUP_FILTER', '(&(objectClass=group)(sAMAccountName=%s*))');
```
This example allow only people member of the group "Kanboard Users" to connect to Kanboard.
With the filter given as example above, Kanboard will search for groups that match the query.
If the end-user type the text "My group" in the auto-complete box, Kanboard will return all groups that match the pattern: `(&(objectClass=group)(sAMAccountName=My group*))`.
Note that the special characters ***** is import here, otherwise an exact match will be done.
[More examples of LDAP filters for Active Directory](http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx)