You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jun 27, 2024. It is now read-only.
Copy file name to clipboardexpand all lines: use-rocket.chat/authentication/ldap/ldap-setup.md
+34-30
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
-
# LDAP Setup
1
+
# LDAP Setup Example
2
2
3
-
After exploring the comprehensive LDAP settings in Rocket.Chat, it's beneficial to examine practical examples of these configurations. This requires an upandrunning LDAP server, which we'll guide you through how to setup (using Osixia OpenLDAP) in order to build a clearer understanding of how Rocket.Chat's LDAP settings can be applied in real-world scenarios.
3
+
After exploring the comprehensive LDAP settings in Rocket.Chat, it's beneficial to examine practical examples of these configurations. This requires an up-and-running LDAP server, which we'll guide you through how to set up (using [Osixia OpenLDAP](https://github.com/osixia/docker-openldap)) in order to build a clearer understanding of how Rocket.Chat's LDAP settings can be applied in real-world scenarios.
4
4
5
-
## Running a LDAP Server
5
+
## Running an LDAP Server
6
6
7
-
Rocket.Chat allows workspace owners to connect to OpenLDAP or Active Directory LDAP servers to authenticate or retrieve information. In this first step, we'll guide you through how to setup a LDAP server using Docker and OpenLDAP, which is an opensource implementation of the LDAP protocol. For starters, navigate to your preferred directory and create a `docker-compose.yml` file with the following content:
7
+
Rocket.Chat allows workspace owners to connect to OpenLDAP or Active Directory LDAP servers to authenticate or retrieve information. In this first step, we'll guide you through how to set up an LDAP server using Docker and OpenLDAP, which is an open-source implementation of the LDAP protocol. For starters, navigate to your preferred directory and create a `docker-compose.yml` file with the following content:
8
8
9
9
```yaml
10
10
services:
@@ -27,51 +27,55 @@ services:
27
27
28
28
Then, use `docker compose up` to start the container. This will locally deploy an **Osixia OpenLDAP** server running on port 389 (or 636 if the default one is unavailable).
29
29
30
-
Also, for the next steps you'll need to download and install [Apache Directory Studio](https://directory.apache.org/studio/downloads.html) (ADS), but any LDAP data management tool (such as phpLDAPadmin) will do the job. After installing, open your LDAP management tool and create a new connection (in ADS, this can be achieved through the **Connections** section) using the following information:
30
+
Also, for the next steps, you'll need to download and install [Apache Directory Studio](https://directory.apache.org/studio/downloads.html) (ADS), but any LDAP data management tool (such as phpLDAPadmin) will do the job. After installing, open your LDAP management tool and create a new connection (in ADS, this can be achieved through the **Connections** section) using the following information:
After succesfully connecting to the LDAP server through ADS, a LDAP tree structure containing an admin and the standard domain (`dc=rcldap,dc=com,dc=br`) should be displayed:
42
+
After successfully connecting to the LDAP server through ADS, an LDAP tree structure containing an admin and the standard domain (`dc=rcldap,dc=com,dc=br`) should be displayed:
43
43
44
44
45
45
46
46
ADS is now ready to populate the LDAP server with groups and users that can connect to Rocket.Chat.
47
47
48
-
## Adding organizational units, users and groups
48
+
## Add organizational units, users, and groups
49
49
50
50
For this example's use case, all users and organizational units will be added under the default domain already provided after setting up the LDAP server.
51
51
52
52
{% hint style="info" %}
53
-
You can refer to [Oracle LDAP Security Fundamentals Docs](https://docs.oracle.com/cd/E79533\_01/VSMGU/ldap001.htm) for more info about Users, Groups and Organizational Units in LDAP servers.
53
+
Refer to [Oracle LDAP Security Fundamentals Docs](https://docs.oracle.com/cd/E79533\_01/VSMGU/ldap001.htm) for details about Users, Groups, and Organizational Units in LDAP servers.
54
54
{% endhint %}
55
55
56
-
After setting up all organizational units, groups and users as described in the next steps, your LDAP tree structure should look as follows:
56
+
After setting up all organizational units, groups, and users as described in the next steps, your LDAP tree structure should look as follows:
57
57
58
58
59
59
60
60
### Organizational units
61
61
62
-
In order to add new organizational units within the default domain, right-click on its element (`dc=rcldap,dc=com,dc=br`) in the tree structure, then choose **New > New Entry** and follow the steps provided below (for this example, we'll need two organizational units created with the `organizationalUnit` object class: **Users** and **Groups**).
62
+
To add new organizational units within the default domain, right-click on its element (`dc=rcldap,dc=com,dc=br`) in the tree structure, then choose **New > New Entry** and follow the steps provided in the screenshot below.
63
+
64
+
Create two organizational units with the `organizationalUnit` object class: **Users** and **Groups**
63
65
64
66
65
67
66
68
### Users
67
69
68
-
For this example, users must be added under the Users organizational unit. This can be achieved with a right-click on the `ou=Users` element in the tree structure, then choose **New > New Entry** and follow the steps provided below (use the `inetOrgPerson` object class).
70
+
For this example, users must be added under the **Users** organizational unit. Right-click on the `ou=Users` element in the tree structure, then choose **New > New Entry** and follow the steps provided below (use the `inetOrgPerson` object class).
69
71
70
72
71
73
72
74
### Groups
73
75
74
-
For this example, we'll only allow users that are members of a given LDAP group to log in to Rocket.Chat. In order to do that, add a new `RCUsers` group under the Groups organizational unit with a right-click on the `ou=Groups` element in the tree structure, then choose **New > New Entry** and follow the steps provided below (use the `groupOfNames` object class and browse to the user you just created in order to assign it to a `member` property of the group in the last step).
76
+
For this example, we'll only allow users who are members of a given LDAP group to log in to Rocket.Chat. To do that, add a new `RCUsers` group under the **Groups** organizational unit with a right-click on the `ou=Groups` element in the tree structure, then select **New > New Entry** and follow the steps provided in the screenshot below.
77
+
78
+
Use the `groupOfNames` object class and browse to the user you just created in order to assign it to a `member` property of the group in the last step.
75
79
76
80
77
81
@@ -81,31 +85,31 @@ More members can be added to the group later by adding new `member` attributes t
81
85
82
86
Access **Workspace > Settings > LDAP > Connection**, enable LDAP and configure the settings as follows:
83
87
84
-
* **Server Type:** `Other`;
85
-
* **Host:** `localhost`;
86
-
* **Port:** `389`.
88
+
* **Server Type:** `Other`
89
+
* **Host:** `localhost`
90
+
* **Port:** `389`
87
91
88
-
Save the changes and press the **"Test Connection"** button in the upperright side of the screen. A "LDAP Connection Succesful" toast message should be displayed.
92
+
Save the changes and press the **"Test Connection"** button on the upper-right side of the screen. An "LDAP Connection Succesful" toast message should be displayed.
89
93
90
94
## Authentication
91
95
92
96
Access **Workspace > Settings > LDAP > Connection > Authentication** and configure the settings as follows:
93
97
94
-
* **User DN:** `cn=admin,dc=rcldap,dc=com,dc=br`;
95
-
* **Password:** `admin`.
98
+
* **User DN:** `cn=admin,dc=rcldap,dc=com,dc=br`
99
+
* **Password:** `admin`
96
100
97
101
## Search Filter
98
102
99
103
Access **Workspace > Settings > LDAP > User Search > Search Filter** and configure the settings as follows:
100
104
101
-
* **Base DN:** `dc=rcldap,dc=com,dc=br`;
102
-
* **Filter:** `(objectclass=inetOrgPerson)`;
103
-
* **Scope:** `sub`;
104
-
* **Search Field:** `uid`;
105
-
* **Search Page Size:** `250`;
106
-
* **Search Size Limit:** `1000`.
105
+
* **Base DN:** `dc=rcldap,dc=com,dc=br`
106
+
* **Filter:** `(objectclass=inetOrgPerson)`
107
+
* **Scope:** `sub`
108
+
* **Search Field:** `uid`
109
+
* **Search Page Size:** `250`
110
+
* **Search Size Limit:** `1000`
107
111
108
-
After this step, you should be able to successfully search LDAP users in your workspace using the connection that has been setup. Try it with the "Test LDAP Search" button on the upper right side of the screen, specify an LDAP user's `uid` field and a successful toast message should be displayed.
112
+
After this step, you should be able to successfully search LDAP users in your workspace using the connection that has been set up. Try it with the "Test LDAP Search" button on the upper right side of the screen. Specify an LDAP user's `uid` field, and a successful toast message should be displayed.
0 commit comments