Ralf HaferkampandRalf Haferkamp
05eee32a03
For Active Directory we need: OCIS_LDAP_DISABLE_USER_MECHANISM=none. Until we add support for evaluating the "userAccountControl" bitmask, we don't supported display the account enable/disable state for Active Directory users.
1.4 KiB
1.4 KiB
title, date, weight, geekdocRepo, geekdocEditPath, geekdocFilePath, geekdocCollapseSection
| title | date | weight | geekdocRepo | geekdocEditPath | geekdocFilePath | geekdocCollapseSection |
|---|---|---|---|---|---|---|
| LDAP - Active Directory | 2023-05-03T00:00:00+00:00 | 20 | https://github.com/owncloud/ocis | edit/master/docs/ocis/identity-provider | ldap-active-directory.md | true |
Overview
oCIS can be configured using Active Directory as identity provider.
Configuration Example
This configuration is an example for using Samba4 AD as well as a Windows Server 2022 as the LDAP backend for oCIS. It is intended as guideline and first starting point.
OCIS_LDAP_URI=ldaps://xxxxxxxxx
OCIS_LDAP_INSECURE="true"
OCIS_LDAP_BIND_DN="cn=administrator,cn=users,xxxxxxxxxx"
OCIS_LDAP_BIND_PASSWORD=xxxxxxx
OCIS_LDAP_DISABLE_USER_MECHANISM="none"
OCIS_LDAP_GROUP_BASE_DN="dc=owncloud,dc=test"
OCIS_LDAP_GROUP_OBJECTCLASS="group"
OCIS_LDAP_GROUP_SCHEMA_ID="objectGUID"
OCIS_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING="true"
OCIS_LDAP_GROUP_SCHEMA_GROUPNAME="cn"
OCIS_LDAP_USER_BASE_DN="dc=owncloud,dc=test"
OCIS_LDAP_USER_OBJECTCLASS="user"
OCIS_LDAP_USER_SCHEMA_ID="objectGUID"
OCIS_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING="true"
OCIS_LDAP_USER_SCHEMA_USERNAME="sAMAccountName"
OCIS_LDAP_LOGIN_ATTRIBUTES="sAMAccountName"
IDP_LDAP_LOGIN_ATTRIBUTE="sAMAccountName"
IDP_LDAP_UUID_ATTRIBUTE="objectGUID"
IDP_LDAP_UUID_ATTRIBUTE_TYPE=binary
GRAPH_LDAP_SERVER_WRITE_ENABLED="false"
OCIS_EXCLUDE_RUN_SERVICES=idm
OCIS_ADMIN_USER_ID="<objectGUID-value-of-the-default-admin-user>"