Log in with LDAP

Before you start

• An LDAP directory with the users and the groups.
• A service account that can read the users and the groups.
• Two groups, for example shellgraph-admins and shellgraph-viewers. To know what each role can do, see Roles.

Configure the server

1. Set the variables of the server. Use TLS (ldaps:// or StartTLS) in production. Without TLS, the passwords go through the network as clear text.

   SHELLGRAPH_ADMIN_GROUP=shellgraph-admins
   SHELLGRAPH_VIEWER_GROUP=shellgraph-viewers
   SHELLGRAPH_LDAP_URL=ldaps://ldap.example.net
   SHELLGRAPH_LDAP_BIND_DN=cn=shellgraph,ou=services,dc=example,dc=net
   SHELLGRAPH_LDAP_BIND_PASSWORD=<password>
   SHELLGRAPH_LDAP_USER_BASE=ou=people,dc=example,dc=net
   SHELLGRAPH_LDAP_GROUP_BASE=ou=groups,dc=example,dc=net
   

2. If your users or groups use other object classes, set SHELLGRAPH_LDAP_USER_FILTER and SHELLGRAPH_LDAP_GROUP_FILTER. See Environment variables.

3. Restart the server.

Let the service account read the directory

With OpenLDAP, add an ACL like this one:

access to *
	by dn.exact="cn=shellgraph,ou=services,dc=example,dc=net" read
	by self read
	by * none

Test the login

1. Open the server UI.
2. Type the login and the password of a user in one of the two groups.
3. Select Log in.

If the login fails, see Login messages. To know what the server does during the login, see Authentication and roles.