dp-salad-docs/.vitepress/dist/configuration/lldap-config.html
2025-01-04 22:46:09 -07:00

156 lines
No EOL
40 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html>
<html lang="en-US" dir="ltr">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>LLDAP Configuration | DP-Salad</title>
<meta name="description" content="A guide to fully deploy the DP-Salad Stack">
<meta name="generator" content="VitePress v1.5.0">
<link rel="preload stylesheet" href="/assets/style.CpK5ZA6m.css" as="style">
<link rel="preload stylesheet" href="/vp-icons.css" as="style">
<script type="module" src="/assets/app.D2AcNbxn.js"></script>
<link rel="preload" href="/assets/inter-roman-latin.Di8DUHzh.woff2" as="font" type="font/woff2" crossorigin="">
<link rel="modulepreload" href="/assets/chunks/theme.Chl5AtGS.js">
<link rel="modulepreload" href="/assets/chunks/framework.DtMx7FFi.js">
<link rel="modulepreload" href="/assets/configuration_lldap-config.md.r20NA1Ia.lean.js">
<link rel="icon" type="image/x-icon" href="/asset/favicon.ico">
<script id="check-dark-mode">(()=>{const e=localStorage.getItem("vitepress-theme-appearance")||"dark",a=window.matchMedia("(prefers-color-scheme: dark)").matches;(!e||e==="auto"?a:e==="dark")&&document.documentElement.classList.add("dark")})();</script>
<script id="check-mac-os">document.documentElement.classList.toggle("mac",/Mac|iPhone|iPod|iPad/i.test(navigator.platform));</script>
</head>
<body>
<div id="app"><div class="Layout" data-v-39b851b6><!--[--><!--]--><!--[--><span tabindex="-1" data-v-a06310ac></span><a href="#VPContent" class="VPSkipLink visually-hidden" data-v-a06310ac> Skip to content </a><!--]--><!----><header class="VPNav" data-v-39b851b6 data-v-1125fe0e><div class="VPNavBar" data-v-1125fe0e data-v-8c74a6bf><div class="wrapper" data-v-8c74a6bf><div class="container" data-v-8c74a6bf><div class="title" data-v-8c74a6bf><div class="VPNavBarTitle has-sidebar" data-v-8c74a6bf data-v-91ea8bb2><a class="title" href="/" data-v-91ea8bb2><!--[--><!--]--><!--[--><img class="VPImage logo" src="/saladicon.png" alt data-v-e838cdb3><!--]--><span data-v-91ea8bb2>DP-Salad</span><!--[--><!--]--></a></div></div><div class="content" data-v-8c74a6bf><div class="content-body" data-v-8c74a6bf><!--[--><!--]--><div class="VPNavBarSearch search" data-v-8c74a6bf><!--[--><!----><div id="local-search"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><span class="vp-icon DocSearch-Search-Icon"></span><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"><kbd class="DocSearch-Button-Key"></kbd><kbd class="DocSearch-Button-Key">K</kbd></span></button></div><!--]--></div><nav aria-labelledby="main-nav-aria-label" class="VPNavBarMenu menu" data-v-8c74a6bf data-v-d62dda7e><span id="main-nav-aria-label" class="visually-hidden" data-v-d62dda7e> Main Navigation </span><!--[--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Home</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/faq" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>FAQ</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/docker-compose" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Docker Compose</span><!--]--></a><!--]--><!--[--><a class="VPLink link VPNavBarMenuLink" href="/maintenance/maintain-guide" tabindex="0" data-v-d62dda7e data-v-f334ebb6><!--[--><span data-v-f334ebb6>Maintenance</span><!--]--></a><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Install</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/requirements" data-v-15160b25><!--[--><span data-v-15160b25>DP-Salad Requirements</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/dp-setup" data-v-15160b25><!--[--><span data-v-15160b25>Installing Debian and Portainer</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/dp-config" data-v-15160b25><!--[--><span data-v-15160b25>Configuration</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/install/salad-setup" data-v-15160b25><!--[--><span data-v-15160b25>DP-Salad Setup</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup active" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Config</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/swag-config" data-v-15160b25><!--[--><span data-v-15160b25>Swag Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/auth-config" data-v-15160b25><!--[--><span data-v-15160b25>Authelia Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link active" href="/configuration/lldap-config" data-v-15160b25><!--[--><span data-v-15160b25>LLDAP Config</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/configuration/authy-duo-config" data-v-15160b25><!--[--><span data-v-15160b25>Authy/Duo Config</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup" data-v-d62dda7e data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-f1cced18><span class="text" data-v-f1cced18><!----><span data-v-f1cced18>Misc</span><span class="vpi-chevron-down text-icon" data-v-f1cced18></span></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><div class="items" data-v-b71e5dd0><!--[--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/x11-guide" data-v-15160b25><!--[--><span data-v-15160b25>X11 Guide</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-b71e5dd0 data-v-15160b25><a class="VPLink link" href="/cf-tunnel" data-v-15160b25><!--[--><span data-v-15160b25>Cloudflare Tunneling</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--]--></nav><!----><div class="VPNavBarAppearance appearance" data-v-8c74a6bf data-v-407d5c63><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="true" data-v-407d5c63 data-v-2994eab3 data-v-2ed556eb><span class="check" data-v-2ed556eb><span class="icon" data-v-2ed556eb><!--[--><span class="vpi-sun sun" data-v-2994eab3></span><span class="vpi-moon moon" data-v-2994eab3></span><!--]--></span></span></button></div><!----><div class="VPFlyout VPNavBarExtra extra" data-v-8c74a6bf data-v-d10923a3 data-v-f1cced18><button type="button" class="button" aria-haspopup="true" aria-expanded="false" aria-label="extra navigation" data-v-f1cced18><span class="vpi-more-horizontal icon" data-v-f1cced18></span></button><div class="menu" data-v-f1cced18><div class="VPMenu" data-v-f1cced18 data-v-b71e5dd0><!----><!--[--><!--[--><!----><div class="group" data-v-d10923a3><div class="item appearance" data-v-d10923a3><p class="label" data-v-d10923a3>Appearance</p><div class="appearance-action" data-v-d10923a3><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="true" data-v-d10923a3 data-v-2994eab3 data-v-2ed556eb><span class="check" data-v-2ed556eb><span class="icon" data-v-2ed556eb><!--[--><span class="vpi-sun sun" data-v-2994eab3></span><span class="vpi-moon moon" data-v-2994eab3></span><!--]--></span></span></button></div></div></div><!----><!--]--><!--]--></div></div></div><!--[--><!--]--><button type="button" class="VPNavBarHamburger hamburger" aria-label="mobile navigation" aria-expanded="false" aria-controls="VPNavScreen" data-v-8c74a6bf data-v-661d4f1a><span class="container" data-v-661d4f1a><span class="top" data-v-661d4f1a></span><span class="middle" data-v-661d4f1a></span><span class="bottom" data-v-661d4f1a></span></span></button></div></div></div></div><div class="divider" data-v-8c74a6bf><div class="divider-line" data-v-8c74a6bf></div></div></div><!----></header><div class="VPLocalNav has-sidebar empty" data-v-39b851b6 data-v-e758e1b7><div class="container" data-v-e758e1b7><button class="menu" aria-expanded="false" aria-controls="VPSidebarNav" data-v-e758e1b7><span class="vpi-align-left menu-icon" data-v-e758e1b7></span><span class="menu-text" data-v-e758e1b7>Menu</span></button><div class="VPLocalNavOutlineDropdown" style="--vp-vh:0px;" data-v-e758e1b7 data-v-ebf966df><button data-v-ebf966df>Return to top</button><!----></div></div></div><aside class="VPSidebar" data-v-39b851b6 data-v-6b9869d7><div class="curtain" data-v-6b9869d7></div><nav class="nav" id="VPSidebarNav" aria-labelledby="sidebar-aria-label" tabindex="-1" data-v-6b9869d7><span class="visually-hidden" id="sidebar-aria-label" data-v-6b9869d7> Sidebar Navigation </span><!--[--><!--]--><!--[--><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0" data-v-71286ee5 data-v-877bfe94><!----><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/home" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Legacy Instructions</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible has-active" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Configuration</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/auth-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Authelia Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/authy-duo-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/lldap-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>LLDAP Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/configuration/swag-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Swag Config</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Install</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/dp-config" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Configuration</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/dp-setup" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Setup</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/requirements" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>DP-Salad Minimum Requirements</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/install/salad-setup" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Salad Setup</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-71286ee5><section class="VPSidebarItem level-0 collapsible" data-v-71286ee5 data-v-877bfe94><div class="item" role="button" tabindex="0" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><h2 class="text" data-v-877bfe94>Maintenance</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-877bfe94><span class="vpi-chevron-right caret-icon" data-v-877bfe94></span></div></div><div class="items" data-v-877bfe94><!--[--><div class="VPSidebarItem level-1 is-link" data-v-877bfe94 data-v-877bfe94><div class="item" data-v-877bfe94><div class="indicator" data-v-877bfe94></div><a class="VPLink link link" href="/maintenance/maintain-guide" data-v-877bfe94><!--[--><p class="text" data-v-877bfe94>Maintenance of the DP-SALA/D Stack</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><!--]--><!--[--><!--]--></nav></aside><div class="VPContent has-sidebar" id="VPContent" data-v-39b851b6 data-v-cc09d6e0><div class="VPDoc has-sidebar has-aside" data-v-cc09d6e0 data-v-f87ade32><!--[--><!--]--><div class="container" data-v-f87ade32><div class="aside" data-v-f87ade32><div class="aside-curtain" data-v-f87ade32></div><div class="aside-container" data-v-f87ade32><div class="aside-content" data-v-f87ade32><div class="VPDocAside" data-v-f87ade32 data-v-c0d770e2><!--[--><!--]--><!--[--><!--]--><nav aria-labelledby="doc-outline-aria-label" class="VPDocAsideOutline" data-v-c0d770e2 data-v-154faa32><div class="content" data-v-154faa32><div class="outline-marker" data-v-154faa32></div><div aria-level="2" class="outline-title" id="doc-outline-aria-label" role="heading" data-v-154faa32>On this page</div><ul class="VPDocOutlineItem root" data-v-154faa32 data-v-a993366b><!--[--><!--]--></ul></div></nav><!--[--><!--]--><div class="spacer" data-v-c0d770e2></div><!--[--><!--]--><!----><!--[--><!--]--><!--[--><!--]--></div></div></div></div><div class="content" data-v-f87ade32><div class="content-container" data-v-f87ade32><!--[--><!--]--><main class="main" data-v-f87ade32><div style="position:relative;" class="vp-doc _configuration_lldap-config" data-v-f87ade32><div><h1 id="lldap-configuration" tabindex="-1">LLDAP Configuration <span class="i-material-symbols-lock"></span> <a class="header-anchor" href="#lldap-configuration" aria-label="Permalink to &quot;LLDAP Configuration :material-symbols-lock:&quot;">​</a></h1><p>LLDAP <span class="i-material-symbols-lock"></span> is the <em>Light Lightweight Directory Access Protocol</em>, and for our purposes, it will store all the information that we have on our users, like usernames, emails, and hashed passwords. These are the typical values, and only a few more exist in this light implementation of LDAP. I include a sample config file if you don&#39;t want to set values in the Docker Compose file.</p><p>As with the Authelia <span class="i-simple-icons-authelia"></span> Configuration, please change things in square brackets to your relevant values. This file uses <strong>REPLACE_WITH</strong> to tell you where to replace other such values like secrets/tokens.</p><div class="language-yaml vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Default configuration for Docker.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## All the values can be overridden through environment variables, prefixed</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## with &quot;LLDAP_&quot;. For instance, &quot;ldap_port&quot; can be overridden with the</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## &quot;LLDAP_LDAP_PORT&quot; variable.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Tune the logging to be more verbose by setting this to be true.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can set it with the LLDAP_VERBOSE environment variable.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># verbose=false</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The host address that the LDAP server will be bound to.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To enable IPv6 support, simply switch &quot;ldap_host&quot; to &quot;::&quot;:</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To only allow connections from localhost (if you want to restrict to local self-hosted services),</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## change it to &quot;127.0.0.1&quot; (&quot;::1&quot; in case of IPv6)&quot;.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_host = &quot;0.0.0.0&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The port on which to have the LDAP server.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_port = 3890</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The host address that the HTTP server will be bound to.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To enable IPv6 support, simply switch &quot;http_host&quot; to &quot;::&quot;.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To only allow connections from localhost (if you want to restrict to local self-hosted services),</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## change it to &quot;127.0.0.1&quot; (&quot;::1&quot; in case of IPv6)&quot;.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">http_host = &quot;0.0.0.0&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The port on which to have the HTTP server, for user login and</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## administration.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">http_port = 17170</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The public URL of the server, for password reset links.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#http_url = &quot;http://localhost&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Random secret for JWT signature.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This secret should be random, and should be shared with application</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## servers that need to consume the JWTs.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Changing this secret will invalidate all user sessions and require</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## them to re-login.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You should probably set it through the LLDAP_JWT_SECRET environment</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## variable from a secret &quot;.env&quot; file.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can also be set from a file&#39;s contents by specifying the file path</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## in the LLDAP_JWT_SECRET_FILE environment variable</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can generate it with (on linux):</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## LC_ALL=C tr -dc &#39;A-Za-z0-9!#%&amp;&#39;\&#39;&#39;()*+,-./:;&lt;=&gt;?@[\]^_{|}~&#39; &lt;/dev/urandom | head -c 32; echo &#39;&#39;</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">jwt_secret = &quot;REPLACE_WITH_RANDOM&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Base DN for LDAP.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This is usually your domain name, and is used as a</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## namespace for your users. The choice is arbitrary, but will be needed</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## to configure the LDAP integration with other services.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The sample value is for &quot;example.com&quot;, but you can extend it with as</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## many &quot;dc&quot; as you want, and you don&#39;t actually need to own the domain</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## name.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_base_dn = &quot;dc=[DOMAIN],dc=[TLD]&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin username.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## For the LDAP interface, a value of &quot;admin&quot; here will create the LDAP</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## user &quot;cn=admin,ou=people,dc=example,dc=com&quot; (with the base DN above).</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## For the administration interface, this is the username.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_dn = &quot;admin&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin email.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Email for the admin account. It is only used when initially creating</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## the admin user, and can safely be omitted.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_email = &quot;admin@[DOMAIN.TLD]&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Admin password.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Password for the admin account, both for the LDAP bind and for the</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## administration interface. It is only used when initially creating</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## the admin user.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## It should be minimum 8 characters long.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## You can set it with the LLDAP_LDAP_USER_PASS environment variable.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can also be set from a file&#39;s contents by specifying the file path</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## in the LLDAP_LDAP_USER_PASS_FILE environment variable</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note: you can create another admin user for user administration, this</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is just the default one.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldap_user_pass = &quot;REPLACE_WITH_PASSWORD&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Database URL.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This encodes the type of database (SQlite, MySQL, or PostgreSQL)</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## , the path, the user, password, and sometimes the mode (when</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## relevant).</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note: SQlite should come with &quot;?mode=rwc&quot; to create the DB</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## if not present.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Example URLs:</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## - &quot;postgres://postgres-user:password@postgres-server/my-database&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## - &quot;mysql://mysql-user:password@mysql-server/my-database&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">##</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can be overridden with the LLDAP_DATABASE_URL env variable.</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">database_url = &quot;sqlite:///data/users.db?mode=rwc&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Private key file.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Contains the secret private key used to store the passwords safely.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Note that even with a database dump and the private key, an attacker</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## would still have to perform an (expensive) brute force attack to find</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## each password.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Randomly generated on first run if it doesn&#39;t exist.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Alternatively, you can use key_seed to override this instead of relying on</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## a file.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Env variable: LLDAP_KEY_FILE</span></span>
<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">key_file = &quot;/data/private_key&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Seed to generate the server private key, see key_file above.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## This can be any random string, the recommendation is that it&#39;s at least 12</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## characters long.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Env variable: LLDAP_KEY_SEED</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#key_seed = &quot;RanD0m STR1ng&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Ignored attributes.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Some services will request attributes that are not present in LLDAP. When it</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is the case, LLDAP will warn about the attribute being unknown. If you want</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## to ignore the attribute and the service works without, you can add it to this</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## list to silence the warning.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#ignored_user_attributes = [ &quot;sAMAccountName&quot; ]</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#ignored_group_attributes = [ &quot;mail&quot;, &quot;userPrincipalName&quot; ]</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Options to configure SMTP parameters, to send password reset emails.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To set these options from environment variables, use the following format</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## (example with &quot;password&quot;): LLDAP_SMTP_OPTIONS__PASSWORD</span></span>
<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">smtp_options</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">]</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Whether to enabled password reset via email, from LLDAP.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#enable_password_reset=true</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP server.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#server=&quot;smtp.gmail.com&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP port.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#port=587</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## How the connection is encrypted, either &quot;NONE&quot; (no encryption), &quot;TLS&quot; or &quot;STARTTLS&quot;.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#smtp_encryption = &quot;TLS&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP user, usually your email address.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#user=&quot;sender@gmail.com&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The SMTP password.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#password=&quot;password&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## The header field, optional: how the sender appears in the email. The first</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## is a free-form name, followed by an email between &lt;&gt;.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#from=&quot;LLDAP Admin &lt;sender@gmail.com&gt;&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Same for reply-to, optional.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#reply_to=&quot;Do not reply &lt;noreply@localhost&gt;&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Options to configure LDAPS.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## To set these options from environment variables, use the following format</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## (example with &quot;port&quot;): LLDAP_LDAPS_OPTIONS__PORT</span></span>
<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">ldaps_options</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">]</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Whether to enable LDAPS.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#enabled=true</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Port on which to listen.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#port=6360</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Certificate file.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#cert_file=&quot;/data/cert.pem&quot;</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">## Certificate key file.</span></span>
<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">#key_file=&quot;/data/key.pem&quot;</span></span></code></pre></div></div></div></main><footer class="VPDocFooter" data-v-f87ade32 data-v-a287ad5f><!--[--><!--]--><!----><nav class="prev-next" aria-labelledby="doc-footer-aria-label" data-v-a287ad5f><span class="visually-hidden" id="doc-footer-aria-label" data-v-a287ad5f>Pager</span><div class="pager" data-v-a287ad5f><a class="VPLink link pager-link prev" href="/configuration/authy-duo-config" data-v-a287ad5f><!--[--><span class="desc" data-v-a287ad5f>Previous page</span><span class="title" data-v-a287ad5f>DP-Salad Configuration</span><!--]--></a></div><div class="pager" data-v-a287ad5f><a class="VPLink link pager-link next" href="/configuration/swag-config" data-v-a287ad5f><!--[--><span class="desc" data-v-a287ad5f>Next page</span><span class="title" data-v-a287ad5f>Swag Config</span><!--]--></a></div></nav></footer><!--[--><!--]--></div></div></div><!--[--><!--]--></div></div><footer class="VPFooter has-sidebar" data-v-39b851b6 data-v-ed47955f><div class="container" data-v-ed47955f><p class="message" data-v-ed47955f>Docs created by @ldez</p><p class="copyright" data-v-ed47955f>Copyright © 2024-present @Cdez</p></div></footer><!--[--><!--]--></div></div>
<script>window.__VP_HASH_MAP__=JSON.parse("{\"cf-tunnel.md\":\"DCFtN7s5\",\"changelog.md\":\"DF8BSN3_\",\"configuration_auth-config.md\":\"CWCNki4x\",\"configuration_authy-duo-config.md\":\"Czz1BBMP\",\"configuration_lldap-config.md\":\"r20NA1Ia\",\"configuration_swag-config.md\":\"DsoCqRQq\",\"docker-compose.md\":\"CiAGvlkZ\",\"faq.md\":\"By3ovNs1\",\"home.md\":\"DWjC1jWa\",\"index.md\":\"DDpI40D1\",\"install_dp-config.md\":\"Cllv2ZYA\",\"install_dp-setup.md\":\"Bx00pjFf\",\"install_requirements.md\":\"DnNTxVlB\",\"install_salad-setup.md\":\"uqD3xfuF\",\"maintenance_maintain-guide.md\":\"DC42-hYW\",\"x11-guide.md\":\"BPhK1sNP\"}");window.__VP_SITE_DATA__=JSON.parse("{\"lang\":\"en-US\",\"dir\":\"ltr\",\"title\":\"DP-Salad\",\"description\":\"A guide to fully deploy the DP-Salad Stack\",\"base\":\"/\",\"head\":[],\"router\":{\"prefetchLinks\":true},\"appearance\":\"dark\",\"themeConfig\":{\"logo\":\"/saladicon.png\",\"nav\":[{\"text\":\"Home\",\"link\":\"/\"},{\"text\":\"FAQ\",\"link\":\"/faq\"},{\"text\":\"Docker Compose\",\"link\":\"/docker-compose\"},{\"text\":\"Maintenance\",\"link\":\"/maintenance/maintain-guide\"},{\"text\":\"Install\",\"items\":[{\"text\":\"DP-Salad Requirements\",\"link\":\"/install/requirements\"},{\"text\":\"Installing Debian and Portainer\",\"link\":\"/install/dp-setup\"},{\"text\":\"Configuration\",\"link\":\"/install/dp-config\"},{\"text\":\"DP-Salad Setup\",\"link\":\"/install/salad-setup\"}]},{\"text\":\"Config\",\"items\":[{\"text\":\"Swag Config\",\"link\":\"/configuration/swag-config\"},{\"text\":\"Authelia Config\",\"link\":\"/configuration/auth-config\"},{\"text\":\"LLDAP Config\",\"link\":\"/configuration/lldap-config\"},{\"text\":\"Authy/Duo Config\",\"link\":\"/configuration/authy-duo-config\"}]},{\"text\":\"Misc\",\"items\":[{\"text\":\"X11 Guide\",\"link\":\"/x11-guide\"},{\"text\":\"Cloudflare Tunneling\",\"link\":\"/cf-tunnel\"}]}],\"sidebar\":[{\"text\":\"Legacy Instructions\",\"link\":\"/home\"},{\"text\":\"Configuration\",\"items\":[{\"text\":\"Authelia Configuration\",\"link\":\"/configuration/auth-config\"},{\"text\":\"DP-Salad Configuration\",\"link\":\"/configuration/authy-duo-config\"},{\"text\":\"LLDAP Configuration\",\"link\":\"/configuration/lldap-config\"},{\"text\":\"Swag Config\",\"link\":\"/configuration/swag-config\"}],\"collapsed\":false},{\"text\":\"Install\",\"items\":[{\"text\":\"DP-Salad Configuration\",\"link\":\"/install/dp-config\"},{\"text\":\"DP-Salad Setup\",\"link\":\"/install/dp-setup\"},{\"text\":\"DP-Salad Minimum Requirements\",\"link\":\"/install/requirements\"},{\"text\":\"Salad Setup\",\"link\":\"/install/salad-setup\"}],\"collapsed\":false},{\"text\":\"Maintenance\",\"items\":[{\"text\":\"Maintenance of the DP-SALA/D Stack\",\"link\":\"/maintenance/maintain-guide\"}],\"collapsed\":false}],\"search\":{\"provider\":\"local\"},\"footer\":{\"message\":\"Docs created by @ldez\",\"copyright\":\"Copyright © 2024-present @Cdez\"}},\"locales\":{},\"scrollOffset\":134,\"cleanUrls\":true}");</script>
</body>
</html>