LDAP
Manage directories in Administration → LDAP, or declare LdapServer and
LdapGroupMapping resources and run relic apply.
Sign-in
- An unknown user is checked against each enabled directory, in key order.
- With Create users on first sign-in, a successful check creates the account in the
ldaprealm. Without it, only LDAP accounts an administrator created can sign in. - Local users are never checked against a directory, so a directory entry cannot take over a
local account such as
admin. - Directory users authenticate every way local users can.
- An email that is not a single address, such as
alice@example.com, is ignored and logged: a new account gets no email, and an existing one keeps its own.
Finding users
Set either a user DN pattern relative to the URL's base DN, such as uid={0},ou=people, or a
search filter, such as uid={0}, under a search base. A search needs a manager DN and
password. Relic reads groups with the manager account.
TLS
Use an ldaps:// URL, or Use StartTLS with ldap://. Relic verifies the server against
the system roots and RELIC_LDAP_CA_CERTIFICATE_FILE (Helm: ldap.caCertificate).
Groups
| Strategy | Groups come from |
|---|---|
| Static | groups listing members (groupOfUniqueNames, uniqueMember) |
| Dynamic | users listing groups (memberOf) |
| Hierarchy | the units in the user's DN, by the mapping's unit attribute (default ou) |
On every sign-in, the user joins the Relic groups matching their directory groups, ignoring case, and leaves those no longer listed. Memberships an administrator set stay. Create the groups in Administration → Groups and give them permissions.
When a directory is down
Its users cannot sign in; local users can. Relic reuses a successful check for up to five minutes, so a password changed in the directory can work that long.
The manager password
With RELIC_ENCRYPTION_KEY set, Relic encrypts the manager password; otherwise it stores it in
plain text. It is never returned. An empty field keeps it while the manager DN and the URL's scheme, host and port
stay the same; after changing them, enter it again.
Test before you save
Enter a directory user's credentials in the form and choose Test to see the DN, email and groups Relic found.