6155c1fad2
- Add search_bind_enabled/search_bind_dn/search_bind_password to allow using a dedicated LDAP account for user and group searches. This is needed when regular LDAP users lack search permissions (common with restrictive ACLs on OpenLDAP). - Support both group_indentifier (original) and group_identifier config keys, falling back to 'cn' if neither is set. - Skip the gidNumber-based primary group query when the attribute is empty, avoiding broken LDAP filters on non-posixAccount setups.
30 lines
668 B
YAML
30 lines
668 B
YAML
enabled: true
|
|
host:
|
|
port: 389
|
|
version: 3
|
|
ssl: false
|
|
start_tls: false
|
|
opt_referrals: false
|
|
search_bind_enabled: false
|
|
search_bind_dn:
|
|
search_bind_password:
|
|
user_dn: 'uid=[username],dc=company,dc=com'
|
|
search_dn:
|
|
group_dn:
|
|
group_query: '(&(cn=*)(memberUid=[username]))'
|
|
group_indentifier: cn
|
|
map_username: uid
|
|
map_fullname: givenName lastName
|
|
map_email: mail
|
|
map_dn: distinguishedName
|
|
|
|
save_grav_user: false
|
|
store_ldap_data: false
|
|
default_access_levels:
|
|
groups:
|
|
- ldap_users
|
|
access:
|
|
site:
|
|
login: 'true'
|
|
groups: "admin:\r\n admin:\r\n login: true\r\n super: true\r\n site:\r\n login: true\r\nuser:\r\n site:\r\n login: true"
|