Documentation: LDAP connector documentation. #690

rithujohn191 · 2016-11-15T23:11:29Z

No description provided.

rithujohn191 · 2016-11-15T23:23:49Z

ericchiang

Thanks for the draft. Lots of comments.

ericchiang · 2016-11-15T23:21:05Z

Documentation/ldap-connector.md

@@ -0,0 +1,86 @@
+# Overview of the `ldap` Connector
+
+The `ldap` connector allows email/password based authentication hosted by dex, backed by a LDAP directory. All the configuration parameters required by the `ldap` connector are held in [Config struct](../connector/ldap/ldap.go).


Don't need hosted by dex

ericchiang · 2016-11-15T23:21:43Z

Documentation/ldap-connector.md

+1. Finding the user based on the end user's credentials.
+2. Searching for groups using the user entry.
+
+User entries are expected to have an email attribute (configurable through "emailAttr"), and a display name attribute (configurable through "nameAttr").


emaliAttr and nameAttr (use a backquote)

ericchiang · 2016-11-15T23:22:16Z

Documentation/ldap-connector.md

@@ -0,0 +1,86 @@
+# Overview of the `ldap` Connector


Title should be something like "Authentication through LDAP"

Then we would have a ## Overview subsection

ericchiang · 2016-11-15T23:23:14Z

Documentation/ldap-connector.md

+
+User entries are expected to have an email attribute (configurable through "emailAttr"), and a display name attribute (configurable through "nameAttr").
+
+### Setting the Configuration


This can just be combined with the next section. Also we can probably just use "Configuration" as the header. Also two "#", not three.

ericchiang · 2016-11-15T23:23:41Z

Documentation/ldap-connector.md

+
+### Example: User authentication
+
+The following is an example config file that can be used by the `ldap` connector to submit a [SearchRequest](https://godoc.org/gopkg.in/ldap.v2#SearchRequest) to authenticate a user.


We don't want to refer to the upstream client. It's an implementation detail that we don't expose.

ericchiang · 2016-11-15T23:24:11Z

Documentation/ldap-connector.md

+       # insecureNoSSL: true
+       # Default: use the host's root CA set.
+       rootCA: /etc/dex/ldap.ca
+       # DN to bind as for search operations.


Note that these are optional and not required if your LDAP server provides sufficient access for anonymous auth.

ericchiang · 2016-11-15T23:24:24Z

Documentation/ldap-connector.md

+         # Required. Attribute to map to Email.
+         emailAttr: mail
+         # Maps to display name of users.
+         nameAttr: name


Why no group search?

ericchiang · 2016-11-15T23:25:21Z

Documentation/ldap-connector.md

+
+```yaml
+
+  connectors:


Un-indent this so users can just copy paste it into their config.

ericchiang · 2016-11-15T23:26:34Z

Documentation/ldap-connector.md

+
+### Setting the Configuration
+
+To set the `ldap` connector configuration in dex, create a config file at `example/config-ldap.yaml`, then use the following command to start an instance of dex:


We don't need to explain this here. This should be something like "in your dex config file" with a link to the getting started guide. https://github.com/coreos/dex/blob/master/Documentation/getting-started.md

ericchiang · 2016-11-15T23:26:58Z

Documentation/ldap-connector.md

+       bindPW: password
+       userSearch:
+         # Would translate to the query "(&(objectClass=person)(uid=<username>))".
+         baseDN: cn=users,dc=example,dc=com


We need to comment these fields waaaay more.

rithujohn191 · 2016-11-16T01:17:10Z

YAML does not allow extra lines between attributes :(

ericchiang

couple more nits. Would you mind addressing those then we can merge it?

ericchiang · 2016-11-16T17:38:52Z

Documentation/ldap-connector.md

+
+## Overview
+
+The LDAP connector allows email/password based authentication, backed by a LDAP directory. All the configuration parameters required by the connector are held in [Config struct](../connector/ldap/ldap.go).


We don't need to link to source code here. Probably just cut the second sentence.

ericchiang · 2016-11-16T17:39:18Z

Documentation/ldap-connector.md

+1. Finding the user based on the end user's credentials.
+2. Searching for groups using the user entry.
+
+## Example: User authentication


Just name this section Configuration

ericchiang · 2016-11-16T17:42:36Z

Documentation/ldap-connector.md

+
+User entries are expected to have an email attribute (configurable through `emailAttr`), and a display name attribute (configurable through `nameAttr`). The following is an example config file that can be used by the LDAP connector to authenticate a user.
+
+```yaml


For inline comments, don't add a newline a the end of every sentence, add it add it at about 80 characters.

For example, don't do this:

# The DN and password for an application service account. # The connector uses these credentials to search for users and groups. # Optional. Not required if the LDAP server provides access for anonymous auth.

Do this:

# The DN and password for an application service account. The connector uses # these credentials to search for users and groups. Not required if the LDAP # server provides access for anonymous auth.

Calpicow · 2016-11-16T23:01:32Z

I've found that the id attribute also needs to be set for it to work at all.

ericchiang · 2016-11-16T23:14:03Z

Ah you're totally right, I think we even check that earlier now that #686 is in.

rithujohn191 · 2016-11-16T23:27:45Z

Thanks @Calpicow

ericchiang · 2016-11-17T00:11:42Z

lgtm

rithujohn191 force-pushed the connector-docs branch from cf561f0 to 2f6a457 Compare November 15, 2016 23:16

ericchiang suggested changes Nov 15, 2016

View reviewed changes

rithujohn191 force-pushed the connector-docs branch from 2f6a457 to 8161cc8 Compare November 16, 2016 01:15

ericchiang suggested changes Nov 16, 2016

View reviewed changes

rithujohn191 force-pushed the connector-docs branch from 8161cc8 to 282f9eb Compare November 16, 2016 18:04

rithujohn191 force-pushed the connector-docs branch from 282f9eb to c057460 Compare November 16, 2016 23:26

Documentation: LDAP connector documentation.

8589650

rithujohn191 force-pushed the connector-docs branch from c057460 to 8589650 Compare November 16, 2016 23:29

ericchiang approved these changes Nov 17, 2016

View reviewed changes

ericchiang merged commit 2e74b48 into dexidp:master Nov 17, 2016

rithujohn191 deleted the connector-docs branch November 17, 2016 01:09

rithujohn191 mentioned this pull request Nov 17, 2016

Documentation: connector documentation #678

Closed

ericchiang mentioned this pull request Nov 18, 2016

LDAP groups can only be queried by full DN #536

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Documentation: LDAP connector documentation. #690

Documentation: LDAP connector documentation. #690

rithujohn191 commented Nov 15, 2016

rithujohn191 commented Nov 15, 2016

ericchiang left a comment

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

ericchiang Nov 15, 2016

rithujohn191 commented Nov 16, 2016

ericchiang left a comment

ericchiang Nov 16, 2016

ericchiang Nov 16, 2016

ericchiang Nov 16, 2016

Calpicow commented Nov 16, 2016

ericchiang commented Nov 16, 2016

rithujohn191 commented Nov 16, 2016

ericchiang commented Nov 17, 2016

		@@ -0,0 +1,86 @@
		# Overview of the `ldap` Connector

		The `ldap` connector allows email/password based authentication hosted by dex, backed by a LDAP directory. All the configuration parameters required by the `ldap` connector are held in [Config struct](../connector/ldap/ldap.go).


		User entries are expected to have an email attribute (configurable through "emailAttr"), and a display name attribute (configurable through "nameAttr").

		### Setting the Configuration


		### Example: User authentication

		The following is an example config file that can be used by the `ldap` connector to submit a [SearchRequest](https://godoc.org/gopkg.in/ldap.v2#SearchRequest) to authenticate a user.


		### Setting the Configuration

		To set the `ldap` connector configuration in dex, create a config file at `example/config-ldap.yaml`, then use the following command to start an instance of dex:


		## Overview

		The LDAP connector allows email/password based authentication, backed by a LDAP directory. All the configuration parameters required by the connector are held in [Config struct](../connector/ldap/ldap.go).


		User entries are expected to have an email attribute (configurable through `emailAttr`), and a display name attribute (configurable through `nameAttr`). The following is an example config file that can be used by the LDAP connector to authenticate a user.

		```yaml

Documentation: LDAP connector documentation. #690

Documentation: LDAP connector documentation. #690

Conversation

rithujohn191 commented Nov 15, 2016

rithujohn191 commented Nov 15, 2016

ericchiang left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rithujohn191 commented Nov 16, 2016

ericchiang left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Calpicow commented Nov 16, 2016

ericchiang commented Nov 16, 2016

rithujohn191 commented Nov 16, 2016

ericchiang commented Nov 17, 2016