Project

General

Profile

RedmineLDAP » History » Version 14

Alexander Menk, 2013-05-07 15:15

1 1 Jean-Philippe Lang
h1. LDAP Authentication
2
3
Redmine natively supports LDAP authentication using one or multiple LDAP directories.
4
5
h2. Declaring the LDAP
6
7 10 Etienne Massip
Go to Administration and click *LDAP authentication* in the menu.
8 5 Eric Davis
9 1 Jean-Philippe Lang
10
Enter the following:
11
12
* *Name*: an arbitrary name for the directory
13
* *Host*: the LDAP host name
14
* *Port*: the LDAP port (default is 389)
15
* *LDAPS*: check this if you want or need to use LDAPS to access the directory
16 9 T. Hauptman
* *Account*: enter a username that has read access to the LDAP , otherwise leave this field empty if your LDAP can be read anonymously (Active Directory servers generally do not allow anonymous access)
17 1 Jean-Philippe Lang
* *Password*: password for the account
18
* *Base DN*: the top level DN of your LDAP directory tree
19
* *Login attribute*: enter the name of the LDAP attribute that will be used as the Redmine username
20
21 2 Jean-Philippe Lang
Redmine users should now be able to authenticate using their LDAP username and password if their accounts are set to use the LDAP for authentication.
22 3 Jean-Philippe Lang
23
To test this, create a Redmine user with a login that matches his LDAP account, select the newly created LDAP in the *Authentication mode* drop-down list (this field is visible on the account screen only if a LDAP is declared) and leave his password empty. Try to log in into Redmine using the LDAP username and password.
24 1 Jean-Philippe Lang
25
h2. On the fly user creation
26
27
By checking *on-the-fly user creation*, any LDAP user will have his Redmine account automatically created the first time he logs into Redmine.
28
For that, you have to specify the LDAP attributes name (firstname, lastname, email) that will be used to create their Redmine accounts.
29
30
Here is an typical example using Active Directory:
31
32
<pre>
33
Name     = My Directory
34
Host     = host.domain.org
35
Port     = 389
36
LDAPS    = no
37 7 John Dell
Account  = MyDomain\UserName (or UserName@MyDomain depending on AD server)
38 1 Jean-Philippe Lang
Password = <password>
39
Base DN  = CN=users,DC=host,DC=domain,DC=org
40 9 T. Hauptman
41
On-the-fly user creation = yes
42
Attributes
43
  Login     = sAMAccountName
44
  Firstname = givenName
45
  Lastname  = sN
46
  Email     = mail
47
</pre>
48
49
Here is another example for Active Directory with a compartmentalized intranet:
50
51
<pre>
52
Name     = Just a description for the auth modes page
53
Host     = DepartmentName.OrganizationName.local
54
Port     = 389
55
LDAPS    = no
56 13 mouson chen
Account  = DepartmentName\UserName (or UserName@MyDomain depending on AD server or bind DN uid=Manager,cn=users,dc=MyDomain,dc=com)
57 9 T. Hauptman
Password = <password>
58
Base DN  = DC=DepartmentName,DC=OrganizationName,DC=local
59 1 Jean-Philippe Lang
60
On-the-fly user creation = yes
61
Attributes
62
  Login     = sAMAccountName
63
  Firstname = givenName
64
  Lastname  = sN
65
  Email     = mail
66
</pre>
67
68
Note that LDAP attribute names are *case sensitive*.
69
70 14 Alexander Menk
h3. Dynamic Bind Account 
71
72
The above setup would need a special account on the directory server which Redmine uses to pre-authenticate.
73
It is possible to use the code @$login$@ in the account field which then would be replaced by the current login.
74
The password can be left empty in this case.
75
76
Issue: http://www.redmine.org/issues/1913
77
Example Test: http://www.redmine.org/projects/redmine/repository/revisions/9241/diff/
78
79 6 Chris Rose
h3. Base DN variants
80
81
Although it's quite possible that the Base DN above is standard for Active Directory, the Active Directory at my employer's site does not use the Users container for standard users, so those instructions sent me down a long and painful path.  I recommend also trying just "DC=host,DC=domain,DC=org" if login fail swith the settings there.
82 14 Alexander Menk
83 6 Chris Rose
84 1 Jean-Philippe Lang
h2. Troubleshooting
85
86 4 Jean-Philippe Lang
If you want to use on-the-fly user creation, make sure that Redmine can fetch from your LDAP all the required information to create a valid user.
87
For example, on-the-fly user creation won't work if you don't have valid email adresses in your directory (you will get an 'Invalid username/password' error message when trying to log in).
88 6 Chris Rose
(This is not true with newer Redmine versions; the user creation dialog is populated with everything it can find from the LDAP server, and asks the new user to fill in the rest.)
89 4 Jean-Philippe Lang
90
Also, make sure you don't have any custom field marked as *required* for user accounts. These custom fields would prevent user accounts from being created on the fly.
91 6 Chris Rose
92 12 Etienne Massip
93
Errors in the login system are not reported with any real information in the Redmine logs, which makes troubleshooting difficult.  However, you can found most of the information you need using ??Wireshark?? between your Redmine host and the LDAP server. Note that this only works if you have permissions to read network traffic between those two hosts.
94
95
96
h3. ??Account?? value format
97
98
The username for the bind credentials might need to be specified as a DN(i.e. CN=user,OU=optional,DC=domain,DC=com) rather than as a UPN(user@domain.com) or as ??domain\user??, as pointed out by this comment in source:trunk/vendor/plugins/ruby-net-ldap-0.0.4/lib/net/ldap.rb:
99 11 John Lewin
<pre>
100
  # As described under #bind, most LDAP servers require that you supply a complete DN
101
  # as a binding-credential, along with an authenticator such as a password.
102 6 Chris Rose
</pre>
103 8 Oli Kessler
104
h3. OpenDS 
105
106
If you are using the OpenDS server, you might have issues with the request control "Paged results" sent with the initial query searching for the user by the specified login attribute. This request control 1.2.840.113556.1.4.319 is not allowed for anonymous users by default, thus preventing redmine from finding the user in the directory even before the binding takes place.
107
108
Add a global ACI like this
109
<pre>
110
./dsconfig -h SERVER_IP -p 4444 -D cn="Directory Manager" -w PASSWORD -n set-access-control-handler-prop --trustAll 
111
--add global-aci:\(targetcontrol=\"1.2.840.113556.1.4.319\"\)\ \(version\ 3.0\;\ acl\ 
112
\"Anonymous\ control\ access\ to\ 1.2.840.113556.1.4.319\"\;\ allow\ \(read\)\ userdn=\"ldap:///anyone\"\;\)
113
</pre>Note: Enter the command on one line, use the escaping exactly as indicated (the \ after "acl" is meant to be "\ " for a space).