docs/content/integration/ldap/introduction.md
When it comes to LDAP there are several considerations for deciding how to bind to the LDAP server.
The most insecure method is unauthenticated binds. They are generally considered insecure due to the fact allowing them at all ensures anyone with any level of network access can easily obtain objects and their attributes.
Authelia does support unauthenticated binds but it is not by default, you must configure the permit_unauthenticated_bind configuration option.
One method to bind to the server that is favored by a lot of people is binding to the LDAP server as the end user. While this is more secure than methods such as Unauthenticated Binding the drawback is that it can only be used securely at the time the user enters their credentials. Storing a password in memory in general is not very secure and prone to breakage due to outside influences (i.e. the user changes their password).
In addition, this method is not compatible with the password reset / forgot password flow at all (not to be confused with a change password flow).
Authelia doesn't currently support such a binding method excluding for checking user passwords.
This is the most common method of binding to LDAP. This involves setting up a special service user with a complex password which has the minimum permissions required to do the tasks required.
Authelia primarily supports this method.
The following implementations exist:
custom:
activedirectory:
rfc2307bis:
freeipa:
lldap:
glauth:
There are currently two group search modes that exist.
The filter search mode is the default search mode. Generally this is recommended.
The memberof search mode is a special search mode. Generally this is discouraged and is currently experimental.
Some systems provide a memberOf attribute which may include additional groups that the user is a member of. This
search mode allows using this attribute as a method to determine their groups. How it works is the search is performed
against the base with the subtree scope and the groups filter must include one of the {memberof:*} replacements, and
the distinguished names of the results from the search are compared (case-insensitive) against the users memberOf
attribute to determine if they are members.
This means:
memberOf attribute MUST include the distinguished name of the group.{memberof:dn} replacement is used:
Various replacements occur in the user and groups filter. The replacements either occur at startup or upon an LDAP search which is indicated by the phase column.
The phases exist to optimize performance. The replacements in the startup phase are replaced once before the connection is ever established. In addition to this, during the startup phase we purposefully check the filters for which search phase replacements exist so we only have to check if the replacement is necessary once, and we don't needlessly perform every possible replacement on every search regardless of if it's needed or not.
| Placeholder | Phase | Replacement |
|---|---|---|
| {distinguished_name_attribute} | startup | The configured distinguished name attribute |
| {username_attribute} | startup | The configured username attribute |
| {mail_attribute} | startup | The configured mail attribute |
| {display_name_attribute} | startup | The configured display name attribute |
| {member_of_attribute} | startup | The configured member of attribute |
| {input} | search | The input into the username field |
| Placeholder | Phase | Replacement |
|---|---|---|
| {date-time:generalized} | search | The current UTC time formatted as a LDAP generalized time in the format of 20060102150405.0Z |
| {date-time:unix} | search | The current time formatted as a Unix epoch |
| {date-time:microsoft-nt} | search | The current time formatted as a Microsoft NT epoch which is used by some Microsoft Active Directory attributes |
| Placeholder | Phase | Replacement |
|---|---|---|
| {username} | search | The username from the profile lookup obtained from the username attribute |
| {dn} | search | The distinguished name from the profile lookup |
| {memberof:dn} | search | See the detailed section below |
| {memberof:rdn} | search | Only allowed with the memberof search method and contains the first relative distinguished name of every memberOf entry a use has in parenthesis |
Requirements:
memberof search mode.Requirements:
memberof search mode.Splits every memberOf value to obtain the first relative distinguished name and joins all of those after surrounding
them in parentheses. This makes the general suggested filter pattern for this particular replacement
(|{memberof:rdn}). The format of this value is as follows:
(<RDN>)
For example if the user has the following distinguished names in their object:
CN=abc,OU=groups,DC=example,DC=comCN=xyz,OU=groups,DC=example,DC=comThe value will be replaced with (CN=abc)(CN=xyz) which using the suggested pattern for the filter becomes
(|(CN=abc)(CN=xyz)) which will then return any user that as a CN of abc or xyz.