156 lines
No EOL
40 KiB
HTML
156 lines
No EOL
40 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en-US" dir="ltr">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||
<title>LLDAP Configuration | DP-Salad</title>
|
||
<meta name="description" content="A guide to fully deploy the DP-Salad Stack">
|
||
<meta name="generator" content="VitePress v1.5.0">
|
||
<link rel="preload stylesheet" href="/assets/style.CpK5ZA6m.css" as="style">
|
||
<link rel="preload stylesheet" href="/vp-icons.css" as="style">
|
||
|
||
<script type="module" src="/assets/app.D2AcNbxn.js"></script>
|
||
<link rel="preload" href="/assets/inter-roman-latin.Di8DUHzh.woff2" as="font" type="font/woff2" crossorigin="">
|
||
<link rel="modulepreload" href="/assets/chunks/theme.Chl5AtGS.js">
|
||
<link rel="modulepreload" href="/assets/chunks/framework.DtMx7FFi.js">
|
||
<link rel="modulepreload" href="/assets/configuration_lldap-config.md.r20NA1Ia.lean.js">
|
||
<link rel="icon" type="image/x-icon" href="/asset/favicon.ico">
|
||
<script id="check-dark-mode">(()=>{const e=localStorage.getItem("vitepress-theme-appearance")||"dark",a=window.matchMedia("(prefers-color-scheme: dark)").matches;(!e||e==="auto"?a:e==="dark")&&document.documentElement.classList.add("dark")})();</script>
|
||
<script id="check-mac-os">document.documentElement.classList.toggle("mac",/Mac|iPhone|iPod|iPad/i.test(navigator.platform));</script>
|
||
</head>
|
||
<body>
|
||
<div id="app"><div class="Layout" data-v-39b851b6><!--[--><!--]--><!--[--><span tabindex="-1" data-v-a06310ac></span><a href="#VPContent" class="VPSkipLink visually-hidden" data-v-a06310ac> Skip to content </a><!--]--><!----><header class="VPNav" data-v-39b851b6 data-v-1125fe0e><div class="VPNavBar" data-v-1125fe0e data-v-8c74a6bf><div class="wrapper" data-v-8c74a6bf><div class="container" data-v-8c74a6bf><div class="title" data-v-8c74a6bf><div class="VPNavBarTitle has-sidebar" data-v-8c74a6bf data-v-91ea8bb2><a class="title" href="/" data-v-91ea8bb2><!--[--><!--]--><!--[--><img class="VPImage logo" src="/saladicon.png" alt data-v-e838cdb3><!--]--><span data-v-91ea8bb2>DP-Salad</span><!--[--><!--]--></a></div></div><div class="content" data-v-8c74a6bf><div class="content-body" data-v-8c74a6bf><!--[--><!--]--><div class="VPNavBarSearch search" data-v-8c74a6bf><!--[--><!----><div id="local-search"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><span class="vp-icon DocSearch-Search-Icon"></span><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"><kbd class="DocSearch-Button-Key"></kbd><kbd class="DocSearch-Button-Key">K</kbd></span></button></div><!--]--></div><nav aria-labelledby="main-nav-aria-label" class="VPNavBarMenu menu" data-v-8c74a6bf data-v-d62dda7e><span id="main-nav-aria-label" class="visually-hidden" data-v-d62dda7e> Main Navigation </span><!--[--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Home</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/faq" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>FAQ</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/docker-compose" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Docker Compose</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/maintenance/maintain-guide" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Maintenance</span><!--]--></a><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Install</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/requirements" data-v-15160b25><!--[--><span data-v-15160b25>DP-Salad Requirements</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/dp-setup" data-v-15160b25><!--[--><span data-v-15160b25>Installing Debian and Portainer</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/dp-config" data-v-15160b25><!--[--><span data-v-15160b25>Configuration</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/salad-setup" data-v-15160b25><!--[--><span data-v-15160b25>DP-Salad Setup</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup active" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Config</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/swag-config" data-v-15160b25><!--[--><span data-v-15160b25>Swag Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/auth-config" data-v-15160b25><!--[--><span data-v-15160b25>Authelia Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link active" href="/configuration/lldap-config" data-v-15160b25><!--[--><span data-v-15160b25>LLDAP Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/authy-duo-config" data-v-15160b25><!--[--><span data-v-15160b25>Authy/Duo Config</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Misc</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/x11-guide" data-v-15160b25><!--[--><span data-v-15160b25>X11 Guide</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/cf-tunnel" data-v-15160b25><!--[--><span data-v-15160b25>Cloudflare Tunneling</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--]--></nav><!----><div class="VPNavBarAppearance appearance" data-v-8c74a6bf data-v-407d5c63><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="true" data-v-407d5c63 data-v-2994eab3 data-v-2ed556eb><span class="check" data-v-2ed556eb><span class="icon" data-v-2ed556eb><!--[--><span class="vpi-sun sun" data-v-2994eab3></span><span class="vpi-moon moon" data-v-2994eab3></span><!--]--></span></span></button></div><!----><div class="VPFlyout VPNavBarExtra extra" data-v-8c74a6bf data-v-d10923a3 data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" aria-label="extra navigation" data-v-f1cced18><span class="vpi-more-horizontal icon" data-v-f1cced18></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><!----><!--[--><!--[--><!----><div class="group" data-v-d10923a3><div class="item appearance" data-v-d10923a3><p class="label" data-v-d10923a3>Appearance</p><div class="appearance-action" data-v-d10923a3><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="true" data-v-d10923a3 data-v-2994eab3 data-v-2ed556eb><span class="check" data-v-2ed556eb><span class="icon" data-v-2ed556eb><!--[--><span class="vpi-sun sun" data-v-2994eab3></span><span class="vpi-moon moon" data-v-2994eab3></span><!--]--></span></span></button></div></div></div><!----><!--]--><!--]--></div></div></div><!--[--><!--]--><button type="button" class="VPNavBarHamburger hamburger" aria-label="mobile navigation" aria-expanded="false" aria-controls="VPNavScreen" data-v-8c74a6bf data-v-661d4f1a><span class="container" data-v-661d4f1a><span class="top" data-v-661d4f1a></span><span class="middle" data-v-661d4f1a></span><span class="bottom" data-v-661d4f1a></span></span></button></div></div></div></div><div class="divider" data-v-8c74a6bf><div class="divider-line" data-v-8c74a6bf></div></div></div><!----></header><div class="VPLocalNav has-sidebar empty" data-v-39b851b6 data-v-e758e1b7><div class="container" data-v-e758e1b7><button class="menu" aria-expanded="false" aria-controls="VPSidebarNav" data-v-e758e1b7><span class="vpi-align-left menu-icon" data-v-e758e1b7></span><span class="menu-text" data-v-e758e1b7>Menu</span></button><div class="VPLocalNavOutlineDropdown" style="--vp-vh:0px;" data-v-e758e1b7 data-v-ebf966df><button data-v-ebf966df>Return to top</button><!----></div></div></div><aside class="VPSidebar" data-v-39b851b6 data-v-6b9869d7><div class="curtain" data-v-6b9869d7></div><nav class="nav" id="VPSidebarNav" aria-labelledby="sidebar-aria-label" tabindex="-1" data-v-6b9869d7><span class="visually-hidden" id="sidebar-aria-label" data-v-6b9869d7> Sidebar Navigation </span><!--[--><!--]--><!--[--><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0" data-v-71286ee5 data-v-877bfe94><!----><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/home" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Legacy Instructions</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible has-active" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Configuration</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/auth-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Authelia Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/authy-duo-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/lldap-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>LLDAP Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/swag-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Swag Config</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Install</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/dp-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/dp-setup" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Setup</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/requirements" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Minimum Requirements</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/salad-setup" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Salad Setup</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Maintenance</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/maintenance/maintain-guide" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Maintenance of the DP-SALA/D Stack</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><!--]--><!--[--><!--]--></nav></aside><div class="VPContent has-sidebar" id="VPContent" data-v-39b851b6 data-v-cc09d6e0><div class="VPDoc has-sidebar has-aside" data-v-cc09d6e0 data-v-f87ade32><!--[--><!--]--><div class="container" data-v-f87ade32><div class="aside" data-v-f87ade32><div class="aside-curtain" data-v-f87ade32></div><div class="aside-container" data-v-f87ade32><div class="aside-content" data-v-f87ade32><div class="VPDocAside" data-v-f87ade32 data-v-c0d770e2><!--[--><!--]--><!--[--><!--]--><nav aria-labelledby="doc-outline-aria-label" class="VPDocAsideOutline" data-v-c0d770e2 data-v-154faa32><div class="content" data-v-154faa32><div class="outline-marker" data-v-154faa32></div><div aria-level="2" class="outline-title" id="doc-outline-aria-label" role="heading" data-v-154faa32>On this page</div><ul class="VPDocOutlineItem root" data-v-154faa32 data-v-a993366b><!--[--><!--]--></ul></div></nav><!--[--><!--]--><div class="spacer" data-v-c0d770e2></div><!--[--><!--]--><!----><!--[--><!--]--><!--[--><!--]--></div></div></div></div><div class="content" data-v-f87ade32><div class="content-container" data-v-f87ade32><!--[--><!--]--><main class="main" data-v-f87ade32><div style="position:relative;" class="vp-doc _configuration_lldap-config" data-v-f87ade32><div><h1 id="lldap-configuration" tabindex="-1">LLDAP Configuration <span class="i-material-symbols-lock"></span> <a class="header-anchor" href="#lldap-configuration" aria-label="Permalink to "LLDAP Configuration :material-symbols-lock:""></a></h1><p>LLDAP <span class="i-material-symbols-lock"></span> is the <em>Light Lightweight Directory Access Protocol</em>, and for our purposes, it will store all the information that we have on our users, like usernames, emails, and hashed passwords. These are the typical values, and only a few more exist in this light implementation of LDAP. I include a sample config file if you don't want to set values in the Docker Compose file.</p><p>As with the Authelia <span class="i-simple-icons-authelia"></span> Configuration, please change things in square brackets to your relevant values. This file uses <strong>REPLACE_WITH</strong> to tell you where to replace other such values like secrets/tokens.</p><div class="language-yaml vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Default configuration for Docker.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## All the values can be overridden through environment variables, prefixed</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## with "LLDAP_". For instance, "ldap_port" can be overridden with the</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## "LLDAP_LDAP_PORT" variable.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Tune the logging to be more verbose by setting this to be true.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can set it with the LLDAP_VERBOSE environment variable.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># verbose=false</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The host address that the LDAP server will be bound to.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To enable IPv6 support, simply switch "ldap_host" to "::":</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To only allow connections from localhost (if you want to restrict to local self-hosted services),</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## change it to "127.0.0.1" ("::1" in case of IPv6)".</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_host = "0.0.0.0"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The port on which to have the LDAP server.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_port = 3890</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The host address that the HTTP server will be bound to.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To enable IPv6 support, simply switch "http_host" to "::".</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To only allow connections from localhost (if you want to restrict to local self-hosted services),</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## change it to "127.0.0.1" ("::1" in case of IPv6)".</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">http_host = "0.0.0.0"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The port on which to have the HTTP server, for user login and</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## administration.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">http_port = 17170</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The public URL of the server, for password reset links.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#http_url = "http://localhost"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Random secret for JWT signature.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This secret should be random, and should be shared with application</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## servers that need to consume the JWTs.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Changing this secret will invalidate all user sessions and require</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## them to re-login.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You should probably set it through the LLDAP_JWT_SECRET environment</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## variable from a secret ".env" file.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can also be set from a file's contents by specifying the file path</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## in the LLDAP_JWT_SECRET_FILE environment variable</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can generate it with (on linux):</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">jwt_secret = "REPLACE_WITH_RANDOM"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Base DN for LDAP.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This is usually your domain name, and is used as a</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## namespace for your users. The choice is arbitrary, but will be needed</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## to configure the LDAP integration with other services.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The sample value is for "example.com", but you can extend it with as</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## many "dc" as you want, and you don't actually need to own the domain</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## name.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_base_dn = "dc=[DOMAIN],dc=[TLD]"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin username.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## For the LDAP interface, a value of "admin" here will create the LDAP</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## For the administration interface, this is the username.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_dn = "admin"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin email.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Email for the admin account. It is only used when initially creating</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## the admin user, and can safely be omitted.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_email = "admin@[DOMAIN.TLD]"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin password.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Password for the admin account, both for the LDAP bind and for the</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## administration interface. It is only used when initially creating</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## the admin user.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## It should be minimum 8 characters long.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can set it with the LLDAP_LDAP_USER_PASS environment variable.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can also be set from a file's contents by specifying the file path</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## in the LLDAP_LDAP_USER_PASS_FILE environment variable</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note: you can create another admin user for user administration, this</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is just the default one.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_pass = "REPLACE_WITH_PASSWORD"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Database URL.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This encodes the type of database (SQlite, MySQL, or PostgreSQL)</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## , the path, the user, password, and sometimes the mode (when</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## relevant).</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note: SQlite should come with "?mode=rwc" to create the DB</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## if not present.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Example URLs:</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## - "postgres://postgres-user:password@postgres-server/my-database"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## - "mysql://mysql-user:password@mysql-server/my-database"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">##</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can be overridden with the LLDAP_DATABASE_URL env variable.</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">database_url = "sqlite:///data/users.db?mode=rwc"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Private key file.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Contains the secret private key used to store the passwords safely.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note that even with a database dump and the private key, an attacker</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## would still have to perform an (expensive) brute force attack to find</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## each password.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Randomly generated on first run if it doesn't exist.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Alternatively, you can use key_seed to override this instead of relying on</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## a file.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Env variable: LLDAP_KEY_FILE</span></span>
|
||
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">key_file = "/data/private_key"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Seed to generate the server private key, see key_file above.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can be any random string, the recommendation is that it's at least 12</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## characters long.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Env variable: LLDAP_KEY_SEED</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#key_seed = "RanD0m STR1ng"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Ignored attributes.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Some services will request attributes that are not present in LLDAP. When it</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is the case, LLDAP will warn about the attribute being unknown. If you want</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## to ignore the attribute and the service works without, you can add it to this</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## list to silence the warning.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#ignored_user_attributes = [ "sAMAccountName" ]</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#ignored_group_attributes = [ "mail", "userPrincipalName" ]</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Options to configure SMTP parameters, to send password reset emails.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To set these options from environment variables, use the following format</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD</span></span>
|
||
<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">smtp_options</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">]</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Whether to enabled password reset via email, from LLDAP.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#enable_password_reset=true</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP server.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#server="smtp.gmail.com"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP port.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#port=587</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#smtp_encryption = "TLS"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP user, usually your email address.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#user="sender@gmail.com"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP password.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#password="password"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The header field, optional: how the sender appears in the email. The first</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is a free-form name, followed by an email between <>.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#from="LLDAP Admin <sender@gmail.com>"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Same for reply-to, optional.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#reply_to="Do not reply <noreply@localhost>"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Options to configure LDAPS.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To set these options from environment variables, use the following format</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT</span></span>
|
||
<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldaps_options</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">]</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Whether to enable LDAPS.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#enabled=true</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Port on which to listen.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#port=6360</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Certificate file.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#cert_file="/data/cert.pem"</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Certificate key file.</span></span>
|
||
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#key_file="/data/key.pem"</span></span></code></pre></div></div></div></main><footer class="VPDocFooter" data-v-f87ade32 data-v-a287ad5f><!--[--><!--]--><!----><nav class="prev-next" aria-labelledby="doc-footer-aria-label" data-v-a287ad5f><span class="visually-hidden" id="doc-footer-aria-label" data-v-a287ad5f>Pager</span><div class="pager" data-v-a287ad5f><a class="VPLink link pager-link prev" href="/configuration/authy-duo-config" data-v-a287ad5f><!--[--><span class="desc" data-v-a287ad5f>Previous page</span><span class="title" data-v-a287ad5f>DP-Salad Configuration</span><!--]--></a></div><div class="pager" data-v-a287ad5f><a class="VPLink link pager-link next" href="/configuration/swag-config" data-v-a287ad5f><!--[--><span class="desc" data-v-a287ad5f>Next page</span><span class="title" data-v-a287ad5f>Swag Config</span><!--]--></a></div></nav></footer><!--[--><!--]--></div></div></div><!--[--><!--]--></div></div><footer class="VPFooter has-sidebar" data-v-39b851b6 data-v-ed47955f><div class="container" data-v-ed47955f><p class="message" data-v-ed47955f>Docs created by @ldez</p><p class="copyright" data-v-ed47955f>Copyright © 2024-present @Cdez</p></div></footer><!--[--><!--]--></div></div>
|
||
<script>window.__VP_HASH_MAP__=JSON.parse("{\"cf-tunnel.md\":\"DCFtN7s5\",\"changelog.md\":\"DF8BSN3_\",\"configuration_auth-config.md\":\"CWCNki4x\",\"configuration_authy-duo-config.md\":\"Czz1BBMP\",\"configuration_lldap-config.md\":\"r20NA1Ia\",\"configuration_swag-config.md\":\"DsoCqRQq\",\"docker-compose.md\":\"CiAGvlkZ\",\"faq.md\":\"By3ovNs1\",\"home.md\":\"DWjC1jWa\",\"index.md\":\"DDpI40D1\",\"install_dp-config.md\":\"Cllv2ZYA\",\"install_dp-setup.md\":\"Bx00pjFf\",\"install_requirements.md\":\"DnNTxVlB\",\"install_salad-setup.md\":\"uqD3xfuF\",\"maintenance_maintain-guide.md\":\"DC42-hYW\",\"x11-guide.md\":\"BPhK1sNP\"}");window.__VP_SITE_DATA__=JSON.parse("{\"lang\":\"en-US\",\"dir\":\"ltr\",\"title\":\"DP-Salad\",\"description\":\"A guide to fully deploy the DP-Salad Stack\",\"base\":\"/\",\"head\":[],\"router\":{\"prefetchLinks\":true},\"appearance\":\"dark\",\"themeConfig\":{\"logo\":\"/saladicon.png\",\"nav\":[{\"text\":\"Home\",\"link\":\"/\"},{\"text\":\"FAQ\",\"link\":\"/faq\"},{\"text\":\"Docker Compose\",\"link\":\"/docker-compose\"},{\"text\":\"Maintenance\",\"link\":\"/maintenance/maintain-guide\"},{\"text\":\"Install\",\"items\":[{\"text\":\"DP-Salad Requirements\",\"link\":\"/install/requirements\"},{\"text\":\"Installing Debian and Portainer\",\"link\":\"/install/dp-setup\"},{\"text\":\"Configuration\",\"link\":\"/install/dp-config\"},{\"text\":\"DP-Salad Setup\",\"link\":\"/install/salad-setup\"}]},{\"text\":\"Config\",\"items\":[{\"text\":\"Swag Config\",\"link\":\"/configuration/swag-config\"},{\"text\":\"Authelia Config\",\"link\":\"/configuration/auth-config\"},{\"text\":\"LLDAP Config\",\"link\":\"/configuration/lldap-config\"},{\"text\":\"Authy/Duo Config\",\"link\":\"/configuration/authy-duo-config\"}]},{\"text\":\"Misc\",\"items\":[{\"text\":\"X11 Guide\",\"link\":\"/x11-guide\"},{\"text\":\"Cloudflare Tunneling\",\"link\":\"/cf-tunnel\"}]}],\"sidebar\":[{\"text\":\"Legacy Instructions\",\"link\":\"/home\"},{\"text\":\"Configuration\",\"items\":[{\"text\":\"Authelia Configuration\",\"link\":\"/configuration/auth-config\"},{\"text\":\"DP-Salad Configuration\",\"link\":\"/configuration/authy-duo-config\"},{\"text\":\"LLDAP Configuration\",\"link\":\"/configuration/lldap-config\"},{\"text\":\"Swag Config\",\"link\":\"/configuration/swag-config\"}],\"collapsed\":false},{\"text\":\"Install\",\"items\":[{\"text\":\"DP-Salad Configuration\",\"link\":\"/install/dp-config\"},{\"text\":\"DP-Salad Setup\",\"link\":\"/install/dp-setup\"},{\"text\":\"DP-Salad Minimum Requirements\",\"link\":\"/install/requirements\"},{\"text\":\"Salad Setup\",\"link\":\"/install/salad-setup\"}],\"collapsed\":false},{\"text\":\"Maintenance\",\"items\":[{\"text\":\"Maintenance of the DP-SALA/D Stack\",\"link\":\"/maintenance/maintain-guide\"}],\"collapsed\":false}],\"search\":{\"provider\":\"local\"},\"footer\":{\"message\":\"Docs created by @ldez\",\"copyright\":\"Copyright © 2024-present @Cdez\"}},\"locales\":{},\"scrollOffset\":134,\"cleanUrls\":true}");</script>
|
||
|
||
</body>
|
||
</html> |