Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Updated LDAP Documentation #1988

Merged
merged 3 commits into from
Feb 23, 2023
Merged

docs: Updated LDAP Documentation #1988

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e717a4
Updated LDAP Documentation
a-gerhard Jan 31, 2023
967d66e
fixed a typo
a-gerhard Feb 15, 2023
d7f5c42
Merge branch 'master' into update_ldap_docs
dpgaspar Feb 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions docs/config.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,12 @@ Use config.py to configure the following parameters. By default it will use SQLL
| | AUTH_TYPE = 2 | |
| | | |
| | AUTH_LDAP_SERVER = "ldap://ldapserver.new" | |
| | | |
| | For using LDAP over TLS, set the protocol | |
| | scheme to "ldaps" and set | |
| | "AUTH_LDAP_USE_TLS = False" | |
+----------------------------------------+--------------------------------------------+-----------+
| AUTH_LDAP_USE_TLS | Require the use of STARTTLS | |
+----------------------------------------+--------------------------------------------+-----------+
| AUTH_LDAP_BIND_USER | Define the DN for the user that will be | No |
| | used for the initial LDAP BIND. | |
Expand All @@ -72,10 +78,11 @@ Use config.py to configure the following parameters. By default it will use SQLL
| | (Bool) | |
+----------------------------------------+--------------------------------------------+-----------+
| AUTH_LDAP_TLS_CACERTDIR | CA Certificate directory to check peer | No |
| | certificate | |
| | certificate. Certificate files must be | |
| | PEM-encoded | |
+----------------------------------------+--------------------------------------------+-----------+
| AUTH_LDAP_TLS_CACERTFILE | CA Certificate file to check peer | No |
| | certificate | |
| | certificate. File must be PEM-encoded | |
+----------------------------------------+--------------------------------------------+-----------+
| AUTH_LDAP_TLS_CERTFILE | Certificate file for client auth | No |
| | use with AUTH_LDAP_TLS_KEYFILE | |
Expand Down Expand Up @@ -344,4 +351,4 @@ causes users 1 and 2 to be registered with role ``Admin`` and rest with the role
JMESPath expression allow more groups to be evaluated:
``email == '[email protected]' && 'Admin' || (email == '[email protected]' && 'Op' || 'Viewer')``

For more example, see `specification <https://jmespath.org/specification.html>`_.
For more example, see `specification <https://jmespath.org/specification.html>`_.
15 changes: 15 additions & 0 deletions docs/security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,21 @@ You can give FlaskAppBuilder roles based on LDAP roles (note, this requires AUTH
# force users to re-auth after 30min of inactivity (to keep roles in sync)
PERMANENT_SESSION_LIFETIME = 1800

TLS
~~~

For STARTTLS, configure an `ldap://` server and set `AUTH_LDAP_USE_TLS` to `True`::

AUTH_LDAP_SERVER = "ldap://ldap.example.com"
AUTH_LDAP_USE_TLS = True

For LDAP over TLS (ldaps), configure the server with the `ldaps://` scheme and set `AUTH_LDAP_USE_TLS` to `False`::

AUTH_LDAP_SERVER = "ldaps://ldap.example.com"
AUTH_LDAP_USE_TLS = False

Additional LDAP/TLS Options, including CA certificate settings and client authentication, can be found in the :doc:`config`.

Authentication: OAuth
---------------------

Expand Down