Support LDAP/Active Directory Syncing or Passthrough with External Provider #237
Labels
No labels
bug
chore
documentation
enhancement
help
in-progress
question
ready-for-release
released
translation
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
adam/gate#237
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Describe your idea for an enhancement:
Support generic LDAP and Active Directory source for users. Application access should be granted based on group ownership.
Whenever password login is performed with a LDAP user, a simple bind or hash verification can be done. Additional user properties like email and full name could be synced with custom time or manually refresh
Describe alternatives you've considered:
Currently using authentik and authelia, but authelia lacks passkey-only login and authentik is a resource hog and extremely complex.
Additional context:
This is for home lab use
Might add RADIUS support too for VPNs or 802.1x network authentication
With passkey login or multi factor auth you can't use LDAP correctly and would need to compromise security.
You can still do 2FA, you'll have to do a trick such as adding 2FA at end of password or using app passwords if implemented correctly.
Is it possible to atleast integrate voidauth with lldap ?
Basically sync voidauth with a external ldap server
Also interested in some kind of LDAP integration. There are still some use cases lacking proper OpenID support (Emby, SSSD), and having some kind of legacy support for LDAP would be great.
IMHO this could be restricted to a very basic support (only validate user and password for the calling application).
For 2FA just do password+TOTP in the password field
Something like
https://github.com/please-openit/LDAP-Bind-Proxy
https://github.com/alan-turing-institute/apricot
working for VoidAuth would be great.
Hi,
I can see some different comments but wanted for firm up what I believe @ybizeul is requesting (As I think we are asking the same thing).
The primary enhancement is not to enable VoidAuth to do both OIDC and LDAP functionality, but rather to introduce the capability for VoidAuth to import users, passwords, and groups directly from an LDAP server (such as LLADP or Active Directory). This would enable a scheduled synchronisation between the LDAP server and VoidAuth, while allowing VoidAuth to continue performing its core functions of authentication and verification.
The functionality (similar to PocketIDs import and sync) if it could be replicated in VoidAuth, providing it with a crucial feature that In my opinion would solidify VoidAuth as the go-to authentication solution, without necessitating significant changes to its core functionality.
OK, my usecase would be different: Provide VoidAuth with some rudimentary LDAP implementation in order to use clients which do only legacy LDAP to authenticate against it. No additional LDAP server needed. Something like Authentik does with a "LDAP outpost". Basically, VoidAuth would simply check user name, password and groups when contacted by some LDAP client.
It sounds like there are two different enhancement ideas here, this issue should be for adding an LDAP client/consumer to VoidAuth, connecting to an existing LDAP provider like lldap.
Another issue will be opened for adding basic LDAP endpoints in order to support auth for applications that do not support OIDC or Trusted-Header ProxyAuth.
@notquitenothing Something very important to keep in mind is using LDAPS instead of LDAP when possible. LDAP is plain text, LDAPS is over SSL.
I think the implementation of this may end up related to issues like #144 , many of the decisions that need to be made for that issue will also apply to using an ldap source as an identity provider