Support for LDAP and AD Group sync #1395

mbuchner · 2017-03-27T22:26:01Z

Description

Add support for LDAP and Active Directory Groups:

Other good example is the Jenkins LDAP plugin:
https://wiki.jenkins-ci.org/display/JENKINS/LDAP+Plugin

tboerger · 2017-03-28T21:35:14Z

I'm missing exactly this feature now. Difficult to add users to orgs or groups if they have not been signed in at any time

stale · 2019-02-16T07:52:39Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

divansantana · 2020-02-11T08:12:33Z

https://github.com/tws-inc/gitea-group-sync exists.

Would be nice if it was merged upstream.

pbodnar · 2020-02-29T16:58:15Z

@divansantana, yes, the gitea-group-sync looks like a promising and logical approach until something better gets implemented. I. e. a cron job needs to be setup that does the following:

Iterate over existing Organizations and Teams.
For every Team, lookup matching Users via a LDAP query.
Add / remove corresponding Users in the Team.

For steps 1 and 3, Gitea API (RESTful services) can be used. Not sure if direct access Gitea database would be safe as well. Anyway, for bigger structures the queries to LDAP could be possibly optimized...

Any more ideas?

Elias481 · 2020-04-08T19:46:34Z

We are also wanting this feature.
Optimally there would be a field on a team to link it to an explicit ldap group or userfilter.

Otherwise the gitea-group-sync is a quite usefull approach and would be sufficent for at least something. It should include a separate placeholder for organisation and team-name then at least.
And possibly consolidate the list of resulting queries first because I think it wil be quite common to have some same teams in different organisations.

pgollor · 2020-05-01T07:11:58Z

We are also wanting this feature.

eummitu · 2020-06-12T09:33:00Z

We also want this feature

n-st · 2020-06-16T07:36:44Z

To express interest, please use the "+1" reaction feature on the first post (as several users have done already). Comments should be preferred for on-topic suggestions and discussions, to avoid unnecessary clutter and notifications for everyone subscribed to this issue.

husnusenturk · 2020-06-22T10:46:13Z

This feaute will be very usefull.

EmrahKK · 2020-08-18T13:32:22Z

+1

zeripath · 2020-11-08T17:56:51Z

There is: https://github.com/tws-inc/gitea-group-sync

pgollor · 2020-11-08T18:38:35Z

I know this project but it didd't work very well for my gitea server and a native integration in gitea itself would be better.

zeripath · 2020-11-08T19:22:35Z

OK - suggest a workable UI and how it could work then it could potentially be implemented.

localleon · 2020-12-16T19:09:46Z

It's semms like Gitea Group-Sync is currently the only project that provides this kind of functionality for the Gitea Project.

We are currently looking for maintainers, because tws-inc can't provide ressources for the project. We are discussing in tws-inc/gitea-group-sync#9

Is this still a feature that the community would like to see in the official Gitea Project?

lachnerd · 2021-01-14T09:36:23Z

With 1.13.0 there was a "check for LDAP group membership (#10869)" added - how does this relate to this feature request ?

pgollor · 2021-01-18T12:41:08Z

With 1.13.0 there was a "check for LDAP group membership (#10869)" added - how does this relate to this feature request ?

I think this is only for the login and not to check the rights for a organisation, or not?

svenseeberg · 2021-01-19T16:11:33Z

How should this work in general? Some programs have a mapping field, where for example internal attributes are mapped to LDAP attributes. Mapping LDAP groups to Gitea organizations could work the same way. We would then require an input field in the LDAP settings, which for example contains a JSON with the following information: {"My_Gitea_Org": {"team": "my_Org_team", "ldap-group": "cn=MyGroup,cn=groups,dc=example,dc=org"}}. This does not sound overly complicated to implement. Alternatively, organizations would need a field in their settings where one could enter LDAP group names?

Morriz · 2021-04-19T16:57:27Z

Why is this still open after 4 years ;(

lunny · 2021-04-19T23:53:01Z

PRs are welcome!

Elias481 · 2021-04-26T20:06:28Z

@lunn

PRs are welcome!

but would that have meant, after another 3 years it's still not merged because of whatever?

jolheiser · 2021-04-26T20:15:21Z

but would that have meant, after another 3 years it's still not merged because of whatever?

This is an incredibly unhelpful comment.

None of us are paid to work on this project, and we try to accommodate PRs as much as we can when they come in.

I suggest putting a bounty on the issue if you would like to incentivize someone to pick it up.

Elias481 · 2021-04-30T22:16:46Z

but would that have meant, after another 3 years it's still not merged because of whatever?

This is an incredibly unhelpful comment.

None of us are paid to work on this project, and we try to accommodate PRs as much as we can when they come in.

I suggest putting a bounty on the issue if you would like to incentivize someone to pick it up.

You are completely right. I did not really meant this project, on the other hand you also see it here, that kind of slowing things in regards to very helpful ERs.
But definitely, much to many enterprises just leech open source and but it, but not invest even some time the last year's. Horrible wronglyness. On the other hand we have perfect IT above, so for me personally same same is.

svenseeberg · 2021-05-30T12:06:49Z

I started working on this. Feel free to provide feedback or contribute. netzbegruenung#1. No guarantees if and when this will ever be finished.

svenseeberg · 2021-06-16T17:36:35Z

I think I got the main parts figured out. The rest should be just filling out the missing pieces, which will still take some time to accomplish. As I'm totally new to Go and the Gitea code base, I'm accepting advice unconditionally. Feel free to comment in the WiP PR.

* Add setting for a JSON that maps LDAP groups to Org Teams. * Sync is being run on login and periodically. * Existing group filter settings are reused. Co-authored-by: Giuliano Mele <[email protected]> Co-authored-by: Sven Seeberg <[email protected]>

* Add setting for a JSON that maps LDAP groups to Org Teams. * Add log trace when removing or adding team members. * Sync is being run on login and periodically. * Existing group filter settings are reused. Co-authored-by: Giuliano Mele <[email protected]> Co-authored-by: Sven Seeberg <[email protected]>

* Add setting for a JSON that maps LDAP groups to Org Teams. * Add log when removing or adding team members. * Sync is being run on login and periodically. * Existing group filter settings are reused. * Adding and removing team members. * Sync not existing LDAP group. * Login with broken group map JSON.

* giteaofficial/main: Send mail to issue/pr assignee/reviewer also when OnMention is set (go-gitea#18707) Reduce CI go module downloads, add make targets (go-gitea#18708) Add number in queue status to monitor page (go-gitea#18712) Fix source code line highlighting (go-gitea#18729) Fix forked repositories missed tags (go-gitea#18719) [skip ci] Updated translations via Crowdin Fix release typo (go-gitea#18728) Display template path of current page in dev mode (go-gitea#18717) Separate the details links of commit-statuses in headers (go-gitea#18661) Add LDAP group sync to Teams, fixes go-gitea#1395 (go-gitea#16299) Change git.cmd to RunWithContext (go-gitea#18693)

janosmiko · 2022-03-17T18:23:27Z

If anyone's interested, I forked the gitea-group-sync and added additional functionality:

https://github.com/janosmiko/gitea-ldap-sync

Now it's able to do the following:

sync all groups (as organizations) and subgroups (as teams) from LDAP to Gitea
check if the Gitea organizations and teams exist in LDAP and delete them if not
add Gitea users to groups, based on LDAP group membership

* Add setting for a JSON that maps LDAP groups to Org Teams. * Add log when removing or adding team members. * Sync is being run on login and periodically. * Existing group filter settings are reused. * Adding and removing team members. * Sync not existing LDAP group. * Login with broken group map JSON.

lunny added this to the 1.x.x milestone Mar 28, 2017

lunny added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Mar 28, 2017

stale bot added the issue/stale label Feb 16, 2019

lunny added issue/confirmed Issue has been reviewed and confirmed to be present or accepted to be implemented and removed issue/stale labels Feb 28, 2019

divansantana mentioned this issue Feb 11, 2020

merge upstream? gitea-group-sync/gitea-group-sync#1

Closed

This was referenced Feb 29, 2020

Organization/Team membership for new users #7194

Closed

Add user to organization based on LDAP group membership #2121

Closed

Possibility to have Global Teams/Groups #3642

Open

svenseeberg mentioned this issue May 30, 2021

Add LDAP group sync to Org teams netzbegruenung/gitea#1

Closed

6 tasks

6543 mentioned this issue Jun 29, 2021

Add LDAP group sync to Teams, fixes #1395 #16299

Merged

wxiaoguang closed this as completed in #16299 Feb 11, 2022

lunny modified the milestones: 1.x.x, 1.17.0 Feb 11, 2022

go-gitea locked and limited conversation to collaborators Apr 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for LDAP and AD Group sync #1395

Support for LDAP and AD Group sync #1395

mbuchner commented Mar 27, 2017

tboerger commented Mar 28, 2017

stale bot commented Feb 16, 2019

divansantana commented Feb 11, 2020

pbodnar commented Feb 29, 2020

Elias481 commented Apr 8, 2020

pgollor commented May 1, 2020

eummitu commented Jun 12, 2020

n-st commented Jun 16, 2020

husnusenturk commented Jun 22, 2020

EmrahKK commented Aug 18, 2020

zeripath commented Nov 8, 2020

pgollor commented Nov 8, 2020

zeripath commented Nov 8, 2020

localleon commented Dec 16, 2020

lachnerd commented Jan 14, 2021

pgollor commented Jan 18, 2021

svenseeberg commented Jan 19, 2021 •

edited

Loading

Morriz commented Apr 19, 2021

lunny commented Apr 19, 2021

Elias481 commented Apr 26, 2021

jolheiser commented Apr 26, 2021

Elias481 commented Apr 30, 2021

svenseeberg commented May 30, 2021

svenseeberg commented Jun 16, 2021 •

edited

Loading

janosmiko commented Mar 17, 2022 •

edited

Loading

Support for LDAP and AD Group sync #1395

Support for LDAP and AD Group sync #1395

Comments

mbuchner commented Mar 27, 2017

Description

tboerger commented Mar 28, 2017

stale bot commented Feb 16, 2019

divansantana commented Feb 11, 2020

pbodnar commented Feb 29, 2020

Elias481 commented Apr 8, 2020

pgollor commented May 1, 2020

eummitu commented Jun 12, 2020

n-st commented Jun 16, 2020

husnusenturk commented Jun 22, 2020

EmrahKK commented Aug 18, 2020

zeripath commented Nov 8, 2020

pgollor commented Nov 8, 2020

zeripath commented Nov 8, 2020

localleon commented Dec 16, 2020

lachnerd commented Jan 14, 2021

pgollor commented Jan 18, 2021

svenseeberg commented Jan 19, 2021 • edited Loading

Morriz commented Apr 19, 2021

lunny commented Apr 19, 2021

Elias481 commented Apr 26, 2021

jolheiser commented Apr 26, 2021

Elias481 commented Apr 30, 2021

svenseeberg commented May 30, 2021

svenseeberg commented Jun 16, 2021 • edited Loading

janosmiko commented Mar 17, 2022 • edited Loading

svenseeberg commented Jan 19, 2021 •

edited

Loading

svenseeberg commented Jun 16, 2021 •

edited

Loading

janosmiko commented Mar 17, 2022 •

edited

Loading