aboutsummaryrefslogtreecommitdiff
path: root/pkg/auth/ldap/README.md
diff options
context:
space:
mode:
Diffstat (limited to 'pkg/auth/ldap/README.md')
-rw-r--r--pkg/auth/ldap/README.md119
1 files changed, 0 insertions, 119 deletions
diff --git a/pkg/auth/ldap/README.md b/pkg/auth/ldap/README.md
deleted file mode 100644
index bc357e96..00000000
--- a/pkg/auth/ldap/README.md
+++ /dev/null
@@ -1,119 +0,0 @@
-Gogs LDAP Authentication Module
-===============================
-
-## About
-
-This authentication module attempts to authorize and authenticate a user
-against an LDAP server. It provides two methods of authentication: LDAP via
-BindDN, and LDAP simple authentication.
-
-LDAP via BindDN functions like most LDAP authentication systems. First, it
-queries the LDAP server using a Bind DN and searches for the user that is
-attempting to sign in. If the user is found, the module attempts to bind to the
-server using the user's supplied credentials. If this succeeds, the user has
-been authenticated, and their account information is retrieved and passed to the
-Gogs login infrastructure.
-
-LDAP simple authentication does not utilize a Bind DN. Instead, it binds
-directly with the LDAP server using the user's supplied credentials. If the bind
-succeeds and no filter rules out the user, the user is authenticated.
-
-LDAP via BindDN is recommended for most users. By using a Bind DN, the server
-can perform authorization by restricting which entries the Bind DN account can
-read. Furthermore, using a Bind DN with reduced permissions can reduce security risk
-in the face of application bugs.
-
-## Usage
-
-To use this module, add an LDAP authentication source via the Authentications
-section in the admin panel. Both the LDAP via BindDN and the simple auth LDAP
-share the following fields:
-
-* Authorization Name **(required)**
- * A name to assign to the new method of authorization.
-
-* Host **(required)**
- * The address where the LDAP server can be reached.
- * Example: mydomain.com
-
-* Port **(required)**
- * The port to use when connecting to the server.
- * Example: 636
-
-* Enable TLS Encryption (optional)
- * Whether to use TLS when connecting to the LDAP server.
-
-* Admin Filter (optional)
- * An LDAP filter specifying if a user should be given administrator
- privileges. If a user accounts passes the filter, the user will be
- privileged as an administrator.
- * Example: (objectClass=adminAccount)
-
-* First name attribute (optional)
- * The attribute of the user's LDAP record containing the user's first name.
- This will be used to populate their account information.
- * Example: givenName
-
-* Surname attribute (optional)
- * The attribute of the user's LDAP record containing the user's surname This
- will be used to populate their account information.
- * Example: sn
-
-* E-mail attribute **(required)**
- * The attribute of the user's LDAP record containing the user's email
- address. This will be used to populate their account information.
- * Example: mail
-
-**LDAP via BindDN** adds the following fields:
-
-* Bind DN (optional)
- * The DN to bind to the LDAP server with when searching for the user. This
- may be left blank to perform an anonymous search.
- * Example: cn=Search,dc=mydomain,dc=com
-
-* Bind Password (optional)
- * The password for the Bind DN specified above, if any. _Note: The password
- is stored in plaintext at the server. As such, ensure that your Bind DN
- has as few privileges as possible._
-
-* User Search Base **(required)**
- * The LDAP base at which user accounts will be searched for.
- * Example: ou=Users,dc=mydomain,dc=com
-
-* User Filter **(required)**
- * An LDAP filter declaring how to find the user record that is attempting to
- authenticate. The '%s' matching parameter will be substituted with the
- user's username.
- * Example: (&(objectClass=posixAccount)(uid=%s))
-
-**LDAP using simple auth** adds the following fields:
-
-* User DN **(required)**
- * A template to use as the user's DN. The `%s` matching parameter will be
- substituted with the user's username.
- * Example: cn=%s,ou=Users,dc=mydomain,dc=com
- * Example: uid=%s,ou=Users,dc=mydomain,dc=com
-
-* User Filter **(required)**
- * An LDAP filter declaring when a user should be allowed to log in. The `%s`
- matching parameter will be substituted with the user's username.
- * Example: (&(objectClass=posixAccount)(cn=%s))
- * Example: (&(objectClass=posixAccount)(uid=%s))
-
-**Verify group membership in LDAP** uses the following fields:
-
-* Group Search Base (optional)
- * The LDAP DN used for groups.
- * Example: ou=group,dc=mydomain,dc=com
-
-* Group Name Filter (optional)
- * An LDAP filter declaring how to find valid groups in the above DN.
- * Example: (|(cn=gogs_users)(cn=admins))
-
-* User Attribute in Group (optional)
- * Which user LDAP attribute is listed in the group.
- * Example: uid
-
-* Group Attribute for User (optional)
- * Which group LDAP attribute contains an array above user attribute names.
- * Example: memberUid