ldap commit_1

2026-07-25 20:35:39 +02:00
parent ccde496e55
commit fcf7910f28
16 changed files with 608 additions and 13 deletions
@@ -157,3 +157,81 @@ docker compose --profile s3 up -d --build
 ```

 Garage runs as a separate Compose service. Existing PostgreSQL and MySQL profiles remain unchanged. The included single-node setup is intended for local or self-hosted development without redundancy. Production Garage deployments should use a properly designed multi-node configuration.
+
+## Authentication: local, LDAP, LDAPS, or Active Directory
+
+Choose exactly one authentication backend:
+
+```env
+AUTHORIZATION_TYPE=local
+```
+
+Supported values:
+
+- `local` - built-in registration and password login
+- `ldap` - OpenLDAP-compatible directory
+- `ad` - Microsoft Active Directory defaults
+
+For `ldap` and `ad`, RustPad searches the directory with the service account, validates the password by binding as the user, and automatically provisions a local account. Existing sessions, ownership, sharing, and other account functions continue to use the existing `users` table. Local registration and guest nickname access are disabled.
+
+The nickname is generated as `LDAP_ORGANIZATION/displayName`, for example `example/Mateusz Testowy`. The directory e-mail is the stable local account identifier.
+
+### OpenLDAP
+
+```env
+AUTHORIZATION_TYPE=ldap
+LDAP_URL=ldap://10.87.2.6:389
+LDAP_STARTTLS=false
+LDAP_BIND_DN=cn=admin,dc=example,dc=org
+LDAP_BIND_PASSWORD=admin
+LDAP_BASE_DN=ou=people,dc=example,dc=org
+LDAP_ORGANIZATION=example
+```
+
+In `ldap` mode the defaults are:
+
+```env
+LDAP_USER_FILTER=(uid={username})
+LDAP_USERNAME_ATTRIBUTE=uid
+LDAP_EMAIL_ATTRIBUTE=mail
+LDAP_DISPLAY_NAME_ATTRIBUTE=displayName
+```
+
+### Active Directory
+
+```env
+AUTHORIZATION_TYPE=ad
+LDAP_URL=ldaps://ad.example.org:636
+LDAP_STARTTLS=false
+LDAP_BASE_DN=DC=example,DC=org
+LDAP_BIND_DN=CN=rustpad-bind,OU=Service Accounts,DC=example,DC=org
+LDAP_BIND_PASSWORD=secret
+LDAP_ORGANIZATION=example
+```
+
+In `ad` mode the defaults are:
+
+```env
+LDAP_USER_FILTER=(|(sAMAccountName={username})(userPrincipalName={username}))
+LDAP_USERNAME_ATTRIBUTE=sAMAccountName
+LDAP_EMAIL_ATTRIBUTE=mail
+LDAP_DISPLAY_NAME_ATTRIBUTE=displayName
+```
+
+All LDAP attributes and filters can still be overridden explicitly. The LDAP/LDAPS server certificate must be trusted by the RustPad container.
+
+### Test LDAP on 10.87.2.6
+
+```bash
+cd docker/ldap
+docker compose up -d
+```
+
+Test users:
+
+- `mateusz` / `test1234`
+- `anna` / `test1234`
+
+phpLDAPadmin: `http://10.87.2.6:8088`
+
+Administrator: `cn=admin,dc=example,dc=org` / `admin`