[GH-ISSUE #341 ] LDAP integration question #93

Author

Owner

@kseniiaguzeeva commented on GitHub (Apr 8, 2021):

Thank you for the idea. We will think what can be done.

@kseniiaguzeeva commented on GitHub (Apr 8, 2021): Thank you for the idea. We will think what can be done.

kerem commented

Author

Owner

@simonpinnow commented on GitHub (May 3, 2021):

Hi,
this would be an important feature for us, too. Without it is hard to handle. We want to use it inside of a kubernetes.

Thank you.
Best regards.
Simon

@simonpinnow commented on GitHub (May 3, 2021): Hi, this would be an important feature for us, too. Without it is hard to handle. We want to use it inside of a kubernetes. Thank you. Best regards. Simon

kerem commented

Author

Owner

@Geronium commented on GitHub (Jun 21, 2021):

hello,

some news of the ldap integration ?

Thank you

@Geronium commented on GitHub (Jun 21, 2021): hello, some news of the ldap integration ? Thank you

kerem commented

Author

Owner

@kseniiaguzeeva commented on GitHub (Jul 7, 2021):

Could you please give more details and examples how do you use LDAP? Do you use it for Active Directory only?
As I see different cases exist and we should understand what way will be the best to integrate it.
Thank you in advance for your help.

@kseniiaguzeeva commented on GitHub (Jul 7, 2021): Could you please give more details and examples how do you use LDAP? Do you use it for Active Directory only? As I see different cases exist and we should understand what way will be the best to integrate it. Thank you in advance for your help.

kerem commented

Author

Owner

@Geronium commented on GitHub (Jul 7, 2021):

hello,

in my case, we use openldap to authenticate on the applications. Either directly or through the system (which allows it to authenticate via openldap).

you can see an exemple of the entry inside the ldap

dn: uid=test,ou=users,idPF=prod,ou=enterprise,c=com
cn: test
gidnumber: 1000
givenname: test
homedirectory: /home/test
loginshell: /bin/bash
mail: test@test.com
objectclass: top
objectclass: person
objectclass: inetOrgPerson
objectclass: posixAccount
sn: test
uid: test
uidnumber: 1000
userpassword: test

and an exemple of application configuration directly

import ldap
import django_auth_ldap.config
from django_auth_ldap.config import LDAPSearch

AUTH_LDAP_SERVER_URI = "ldap://172.222.1.254:389"
AUTH_LDAP_BIND_DN = "cn=Manager,ou=enteprise,c=com"
AUTH_LDAP_BIND_PASSWORD = "***"
AUTH_LDAP_USER_SEARCH = django_auth_ldap.config.LDAPSearch(
"ou=users,idPF=prod,ou=enterprise,c=com", ldap.SCOPE_SUBTREE, "uid=%(user)s"
)

if we pass by the system, we need to authorize the system to authenticate with the ldap, for that i use nslcd and i add the rights in the pam.d configuration for this application

-(mer. juil. 07 10:22:47)--(myserver:/etc/pam.d)-
[root] # cat application
#%PAM-1.0
auth sufficient pam_ldap.so
auth requisite pam_succeed_if.so quiet
auth required pam_unix.so nodelay
account required pam_unix.so

i don't know what is better, to authenticate by the system (if it's possible) or directly with the ldap, but it's what we need, in my case.

Thank you.

@Geronium commented on GitHub (Jul 7, 2021): hello, in my case, we use openldap to authenticate on the applications. Either directly or through the system (which allows it to authenticate via openldap). you can see an exemple of the entry inside the ldap dn: uid=test,ou=users,idPF=prod,ou=enterprise,c=com cn: test gidnumber: 1000 givenname: test homedirectory: /home/test loginshell: /bin/bash mail: test@test.com objectclass: top objectclass: person objectclass: inetOrgPerson objectclass: posixAccount sn: test uid: test uidnumber: 1000 userpassword: test and an exemple of application configuration directly import ldap import django_auth_ldap.config from django_auth_ldap.config import LDAPSearch AUTH_LDAP_SERVER_URI = "ldap://172.222.1.254:389" AUTH_LDAP_BIND_DN = "cn=Manager,ou=enteprise,c=com" AUTH_LDAP_BIND_PASSWORD = "***" AUTH_LDAP_USER_SEARCH = django_auth_ldap.config.LDAPSearch( "ou=users,idPF=prod,ou=enterprise,c=com", ldap.SCOPE_SUBTREE, "uid=%(user)s" ) if we pass by the system, we need to authorize the system to authenticate with the ldap, for that i use nslcd and i add the rights in the pam.d configuration for this application -(mer. juil. 07 10:22:47)--(myserver:/etc/pam.d)- [root] # cat application #%PAM-1.0 auth sufficient pam_ldap.so auth requisite pam_succeed_if.so quiet auth required pam_unix.so nodelay account required pam_unix.so i don't know what is better, to authenticate by the system (if it's possible) or directly with the ldap, but it's what we need, in my case. Thank you.

kerem commented

Author

Owner

@dawsongzhao commented on GitHub (Jul 26, 2021):

we aslo need ldap to countrol develper access connections

@dawsongzhao commented on GitHub (Jul 26, 2021): we aslo need ldap to countrol develper access connections

kerem commented

Author

Owner

@kseniiaguzeeva commented on GitHub (Aug 2, 2021):

@dawsongzhao thank you for voting. Could you please also give more details and examples how do you use LDAP?

@kseniiaguzeeva commented on GitHub (Aug 2, 2021): @dawsongzhao thank you for voting. Could you please also give more details and examples how do you use LDAP?

kerem commented

Author

Owner

@simonpinnow commented on GitHub (Aug 2, 2021):

Hey, sorry for delay because of holiday.

For us it would be nice to have:

a simple ldap bind with the user credentials given during authentication
a configured ldap group of which the user must be a member of

configuration:

ldap-server-hostname
ldap port
ssl certificate (optional)
ldap group

best regards
Simon

@simonpinnow commented on GitHub (Aug 2, 2021): Hey, sorry for delay because of holiday. For us it would be nice to have: 1. a simple ldap bind with the user credentials given during authentication 2. a configured ldap group of which the user must be a member of configuration: - ldap-server-hostname - ldap port - ssl certificate (optional) - ldap group best regards Simon

kerem commented

Author

Owner

@ThePrez commented on GitHub (Mar 31, 2022):

piling on (for better or for worse). I'd like to use an IBM i server for LDAP authentication (so people can log into DBeaver with their IBM i username/pw).

^^ The above is probably non-useful feedback, but I can say that the LDAP support/design in the gitbucket project works great for this use case.

@ThePrez commented on GitHub (Mar 31, 2022): piling on (for better or for worse). I'd like to use an IBM i server for LDAP authentication (so people can log into DBeaver with their IBM i username/pw). ^^ The above is probably non-useful feedback, but I can say that the LDAP support/design in the [gitbucket project](https://github.com/gitbucket/gitbucket) works great for this use case.

kerem commented

Author

Owner

@kseniiaguzeeva commented on GitHub (Apr 20, 2022):

It's quite difficult to implement the feature, because different cases exist how LDAP can be used. Thank you for the provided link, we are going to investigate it.
An implimentation is going to be after 21.1 release.

@kseniiaguzeeva commented on GitHub (Apr 20, 2022): It's quite difficult to implement the feature, because different cases exist how LDAP can be used. Thank you for the provided link, we are going to investigate it. An implimentation is going to be after 21.1 release.

kerem commented

https://github.com/dbeaver/cloudbeaver/milestones

Author

Owner

@Geronium commented on GitHub (Jun 12, 2022):

Hello,

we are at the 22.1.0 version, we have exceeded the 21.1 release and i don't see the ldap fonctionnality. In the millestone

the ldap fonctionnality is not planned.

I noticed that in the last release there was the addition of "authentication via nginx" ?

"Users can login to the application via Nginx."

can we use it to connect via ldap ?

Thank you

@Geronium commented on GitHub (Jun 12, 2022): Hello, we are at the 22.1.0 version, we have exceeded the 21.1 release and i don't see the ldap fonctionnality. In the millestone https://github.com/dbeaver/cloudbeaver/milestones the ldap fonctionnality is not planned. I noticed that in the last release there was the addition of "authentication via nginx" ? "Users can login to the application via Nginx." can we use it to connect via ldap ? Thank you

kerem commented

Author

Owner

@alexander-skoblikov commented on GitHub (Jul 6, 2022):

@Geronium Hello,
yes, it is potentially possible if you can integrate nginx with ldap and send the correct authorization headers when opening Cloudbeaver. You can read more about required headers and how to set it up on the Cloudbever side on our wiki page - Reverse proxy authentication

@alexander-skoblikov commented on GitHub (Jul 6, 2022): @Geronium Hello, yes, it is potentially possible if you can integrate nginx with ldap and send the correct authorization headers when opening Cloudbeaver. You can read more about required headers and how to set it up on the Cloudbever side on our wiki page - [Reverse proxy authentication ](https://github.com/dbeaver/cloudbeaver/wiki/Reverse-proxy-header-authentication)

kerem commented

Author

Owner

@bsteinweg commented on GitHub (Sep 12, 2022):

We use LDAP as a way to connect to Oracle databases, without needing to distribute TNS Names file to all users. LDAP simply allows easier administration of Oracle DB connections. Seems like that would be a simple and helpful addition to DBeaver...!

@bsteinweg commented on GitHub (Sep 12, 2022): We use LDAP as a way to connect to Oracle databases, _without_ needing to distribute TNS Names file to all users. LDAP simply allows easier administration of Oracle DB connections. Seems like that would be a simple and helpful addition to DBeaver...!

kerem commented

Author

Owner

@jonsbun commented on GitHub (Apr 5, 2024):

Would be great to know if this feature planned only for EE or also in Community edition?

@jonsbun commented on GitHub (Apr 5, 2024): Would be great to know if this feature planned only for EE or also in Community edition?

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Apr 8, 2024):

@jonsbun
We plan to add this functionality to all versions.

@EvgeniaBzzz commented on GitHub (Apr 8, 2024): @jonsbun We plan to add this functionality to all versions.

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 3, 2024):

Thanks everyone for waiting, it's finally done!
LDAP auth is available in CloudBeaver Community edition v.24.1.0 (PRO versions will be released in a week).
Wiki page with configuration will be created soon.

We would appreciate your feedback, any improvements are welcome! 🦫

Configuring LDAP in Community edition:

open workspace/.data/.cloudbeaver.runtime.conf and add configuration to app.authConfigurations
(you can also add it to cloudbeaver/deploy/cloudbeaver/.cloudbeaver.conf if you prefer to have LDAP in all new workspaces)

    "authConfigurations": [
      {
        "id": "ldap",
        "provider": "ldap",
        "displayName": "LDAP",
        "disabled": false,
        "iconURL": "",
        "description": "",
        "parameters": {
          "ldap-host": "your_host",
          "ldap-port": "389",
          "ldap-dn": "ou\your_ou,dc\your_dc1,dc\your_dc2"
        }
      }
    ]

do not forget to restart a server
enable LDAP in Administration - Server configuration
you will see a new LDAP tab on the auth window

@EvgeniaBzzz commented on GitHub (Jun 3, 2024): Thanks everyone for waiting, it's finally done! LDAP auth is available in CloudBeaver Community edition v.24.1.0 (PRO versions will be released in a week). Wiki page with configuration will be created soon. We would appreciate your feedback, any improvements are welcome! 🦫 ----- **Configuring LDAP in Community edition:** - open `workspace/.data/.cloudbeaver.runtime.conf` and add configuration to `app.authConfigurations` (you can also add it to `cloudbeaver/deploy/cloudbeaver/.cloudbeaver.conf` if you prefer to have LDAP in all new workspaces) ``` "authConfigurations": [ { "id": "ldap", "provider": "ldap", "displayName": "LDAP", "disabled": false, "iconURL": "", "description": "", "parameters": { "ldap-host": "your_host", "ldap-port": "389", "ldap-dn": "ou\your_ou,dc\your_dc1,dc\your_dc2" } } ] ``` - do not forget to restart a server - enable LDAP in Administration - Server configuration - you will see a new LDAP tab on the auth window

kerem commented

Author

Owner

@jonsbun commented on GitHub (Jun 7, 2024):

Thank you for this integration. I have a few additional questions:

What is the correct way to provide LDAP binding account credentials?
Is it possible to map LDAP users with the CloudBeaver Teams automatically?

@jonsbun commented on GitHub (Jun 7, 2024): Thank you for this integration. I have a few additional questions: * What is the correct way to provide LDAP binding account credentials? * Is it possible to map LDAP users with the CloudBeaver Teams automatically?

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 7, 2024):

@jonsbun

It depends on your LDAP structure.
If you have 1-2 organization units then you can specify them in config (in ldap-dn). So you will have to login only with you common name and password.
If you have many organization units then you can specify in config only dc's and login with ou + cn + password.
LDAP users are created automatically after the first login. There is no user provisioning. So you can't map teams.

@EvgeniaBzzz commented on GitHub (Jun 7, 2024): @jonsbun 1. It depends on your LDAP structure. If you have 1-2 organization units then you can specify them in config (in `ldap-dn`). So you will have to login only with you common name and password. If you have many organization units then you can specify in config only dc's and login with ou + cn + password. ![image](https://github.com/dbeaver/cloudbeaver/assets/139753579/2b3ecbfa-81fd-4d99-ae72-f84ec094dfc0) 2. LDAP users are created automatically after the first login. There is no user provisioning. So you can't map teams.

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 7, 2024):

Also wiki page is ready, you can find some extra information there.
LDAP Authentication

@EvgeniaBzzz commented on GitHub (Jun 7, 2024): Also wiki page is ready, you can find some extra information there. [LDAP Authentication](https://github.com/dbeaver/cloudbeaver/wiki/LDAP-Authentication)

kerem commented

Author

Owner

@jonsbun commented on GitHub (Jun 7, 2024):

LDAP users are created automatically after the first login. There is no user provisioning. So you can't map teams.

Well, then I think LDAP users mapping with the teams would be very useful. Now the LDAP user first must login and only after that mapping is possible. For example, if a Local users are used, mapping can be achieved in one iteration.

@jonsbun commented on GitHub (Jun 7, 2024): > 2. LDAP users are created automatically after the first login. There is no user provisioning. So you can't map teams. Well, then I think LDAP users mapping with the teams would be very useful. Now the LDAP user first must login and only after that mapping is possible. For example, if a Local users are used, mapping can be achieved in one iteration.

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 11, 2024):

@jonsbun could you, please, create a new issue for that feature?

@EvgeniaBzzz commented on GitHub (Jun 11, 2024): @jonsbun could you, please, create a new issue for that feature?

kerem commented

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 11, 2024):

All pro-versions 24.1.0 with LDAP provider are also released.
I'm closing this issue, but you are always welcome to leave a comment here or to create a new one 🦫

@EvgeniaBzzz commented on GitHub (Jun 11, 2024): All pro-versions 24.1.0 with LDAP provider are also released. I'm closing this issue, but you are always welcome to leave a comment here or to create a new one 🦫

kerem commented

Author

Owner

@iegurbide commented on GitHub (Jun 11, 2024):

I have been giving this a go but I don't think enough information is available to try to integrate with our LDAP system.

Some questions that arise:

What user is being used to bind to the LDAP server (as ours requires authentication). It is the same user logging in to the specific application i.e no service user is being used? Normally this would be done with a placeholder.
What field is user name? Generally this should be a configurable unique identifier for the user. Depending on the ldap this attribute could be uid, sAMAccountName, mail, etc. No clue what is being used in this case.

In general, an ldap query looks something like this:

ldapsearch -x -D "<bind-user>" -w "<bind-password>"-b "<base-dn>" "<filter>" -H "<ldap-host>:<ldap-port>"

I'm assuming mapping from the configuration file is something like this:

<base-dn> --> ldap-dn
<ldap-host> --> ldap-host
<ldap-port> --> ldap-port

It would be really helpful to know how the rest of the elements are mapped or if they have even been considered.

@iegurbide commented on GitHub (Jun 11, 2024): I have been giving this a go but I don't think enough information is available to try to integrate with our LDAP system. Some questions that arise: - What user is being used to bind to the LDAP server (as ours requires authentication). It is the same user logging in to the specific application i.e no service user is being used? Normally this would be done with a placeholder. - What field is user name? Generally this should be a configurable unique identifier for the user. Depending on the ldap this attribute could be uid, sAMAccountName, mail, etc. No clue what is being used in this case. In general, an ldap query looks something like this: ldapsearch -x -D "\<bind-user\>" -w "\<bind-password\>"-b "\<base-dn\>" "\<filter\>" -H "\<ldap-host\>:\<ldap-port\>" I'm assuming mapping from the configuration file is something like this: - \<base-dn\> --> ldap-dn - \<ldap-host\> --> ldap-host - \<ldap-port\> --> ldap-port It would be really helpful to know how the rest of the elements are mapped or if they have even been considered.

kerem commented

Author

Owner

@jwetzell commented on GitHub (Jun 11, 2024):

I am in the same boat as @iegurbide it seems there is not enough configurability to support the LDAP setups I see. Gotten numerous other products successfully integrated with LDAP (Harbor, Grafana, Gitea, etc.) without issue.

@jwetzell commented on GitHub (Jun 11, 2024): I am in the same boat as @iegurbide it seems there is not enough configurability to support the LDAP setups I see. Gotten numerous other products successfully integrated with LDAP (Harbor, Grafana, Gitea, etc.) without issue.

kerem commented