LDAP and Tandoor reddit / selfhosted ---------------------------------------------------------------------- SeaPowerMax · 2023-11-22 04:33 I recently set up a tandoor docker container and am looking around to see if anyone has experience or a walkthrough using it with LDAP authentication. I don't have a tremendous amount of docker experience but am able to verify that I can perform LDAP queries and make connections from my docker server to my LDAP server. Yet whenever I try to log it as an LDAP user I get a generic bad username or password message. How can I verify the tandoor container is able to contact the LDAP server? How can I configure tandoor to use LDAP? TIA ---------------------------------------------------------------------- doweactuallycare · 2023-11-22 05:14 Oooooookay. >``` LDAP_AUTH=1 AUTH_LDAP_SERVER_URI=LDAP://FQDN:389 The FQDN is your 'LDAP server'. >AUTH_LDAP_BIND_DN=CN=TandoorSA,OU=ServiceAccounts,DC=domain,DC=com Its authenticating with an account called 'TandoorSA' which it expects to find in the OU ServiceAccounts. You'll obviously need to create that first. You'll also need to fill in the DC=domain with your actual domain, which you should know if you have setup ldap. >AUTH_LDAP_BIND_PASSWORD=SuperCoolPassword Its using password 'SuperCoolPassword' when it logs into the 'TandoorSA' account. >AUTH_LDAP_USER_SEARCH_BASE_DN=OU=People,DC=domain,DC=com It expects to find users in here in general. In the 'People' OU. You'll need to fill in the domain part again. >AUTH_LDAP_USER_SEARCH_FILTER_STR=(memberof=CN=Group of Users,OU=People,DC=domain,DC=com) This is its search filter for user searching. Maybe i'm just rewording what its saying but theres not much more to it. Fill in domain. Thats 'bout it. How did you setup LDAP without recognizing this stuff? ---------------------------------------------------------------------- SeaPowerMax · 2023-11-22 05:42 > The FQDN is your 'LDAP server' Correct. > You'll obviously need to create that first. Yes, it is created and active, and i can successfully test with it. > You'll also need to fill in the DC=domain with your actual domain Correct. This is done. > It expects to find users in here in general. In the 'People' OU. This is where the accounts exist. > Fill in domain. This is done. > Thats 'bout it. Except it isnt working for this instance, which is why I am posting about it :) ---------------------------------------------------------------------- doweactuallycare · 2023-11-22 06:01 > Edit: here are the ldap settings i have in my .env file: So those were not the ldap settings in your .env file. AD logs got anything on the attempts? ---------------------------------------------------------------------- SeaPowerMax · 2023-11-22 06:10 do folks on this forum not anonymize their posts? ​ directory logs show the account successfully querying the server. In parallel I am looking for where tandoor does its logging so i can see if it is recording some issue somewhere. ---------------------------------------------------------------------- doweactuallycare · 2023-11-22 06:20 > do folks on this forum not anonymize their posts? Sure, they usually don't allude to it being their config without mentioning it though. Since you're asking about a early-step account authentication with LDAP and general 'walkthrough' language I figured its very possible you somehow imported the default config and were using it. I've seen much much much worse. >directory logs show the account successfully querying the server. Is it saying its a successful login on directory logs but failing on Tandoor? Or just the queries that you already said worked? >In parallel I am looking for where tandoor does its logging so i can see if it is recording some issue somewhere. This is why sometimes people will answer really basic things that you were not actually asking, or assume its a much simpler question... I feel like 'checking logs' is a way way way sooner step than 'post to reddit'. I literally, and wrongly, assumed you already did that to verify the error you were receiving.