Is there anything I can do to smooth future LDAP Integration?

[loomi]

Heyhey,

I know the LDAP Integration is on the Road-Map. Unfortunately it was pushed a Q in the back. But as everywhere we understand there is only such amount of time available.

Anyhow, we like to start using passbolt at our University.

We like to know if you can give already some tips, which would make a later switch to a LDAP based accounting smoothly possible?

Cheers,
Michael

[remy]

Hi @loomi,

There are a few things you can do, which is basically in a nutshell “keep the two in sync” manually:

• Make sure the name of people in LDAP and passbolt are the same
• Make sure the name of groups in LDAP and passbolt are the same
• Make sure you delete the groups/people that are not in LDAP anymore.

Feel free also to comment on the thread discussing the LDAP integration feature. The more detailed the requirements and the clearer the user worflow the easier it is for us to define and implement a solution.

An admin of I can import people and groups from an LDAP directory

Q1. What is the problem that you are trying to solve? I’ve been very happy to find “LDAP integration” on the roadmap, but when I think about it I can find different use cases that need different developments. As a Sysadmin (and CISO) in a university one of my main challenges is to provide my users with exclusive and secured access to resources. An integration with LDAP will help me. Q2 - Who is impacted? System and network administrators. Q3 - Why is it important and/or urgent? This will in…

Thank you for your patience,

[loomi]

Great, we will try to do this.

Not easy to push through as the users will subscribe them selfs. Is it already possible to restrict to a domain name for the email addresses or similar?

We are happy to help with requiring engineering and similar tasks.

[remy]

Not easy to push through as the users will subscribe them selfs.

You should consider turning public registration off and adding them manually yourself in the user workspace.
Otherwise if you have scripting skills you can use the ‘RegisterUser’ console task to import all your users. For example:

 ./app/Console/cake passbolt register_user --username=ada@passbolt.com --first-name=ada --last-name=lovelace --role=user

Is it already possible to restrict to a domain name for the email addresses or similar?

Not at the moment, that’s been on the back of our mind. I created an issue there:

As an admin I can set a domain to be used for validing usernames

Q1. What is the problem that you are trying to solve? Some organizations wants to have a user signup process that is open for everyone in the organization but restrict access to only user that are member of that org, e.g. user that have a @organization.com email address. Q2 - Who is impacted? Larger organizations. Q3 - Why is it important and/or urgent? Larger organizations adoption is strategic for passbolt. Q4 - What is your proposed solution? (optional) Create an addition setting wher…

[loomi]

Thank you for the pointers!

Importing all users is not a good idea in our case, we have +6000 users in our organisation, from which only a small part will use the service.

Okay voted for the issue (-:

Another way to do this properly is if the user can actually himself switch the user to “ldap” finally. The idea would be that the user has a possibility to add a “authentication method” which would be LDAP of the institution. (Others might be SAML/Oauth of lets say GitHub, Twitter, …)