docs: add code blocks to LDAP auth method docs (#3437)
* docs: add code blocks to LDAP auth method docs The code blocks make it much clearer what is and isn't an example. * adds user_filter parameter code syntax style --------- Co-authored-by: stellarsquall <stellarsquall@protonmail.ch>
This commit is contained in:
1 parent
ed7bc7cc4d
commit
5ea25ccf2a
1 file changed
+31
-30
@@ -35,61 +35,62 @@ The password auth method has the following additional attributes:
|
||||
|
||||
The ldap auth method has the following additional attributes:
|
||||
|
||||
- `state` - The state of the auth method; either inactive, active-private, or
|
||||
active-public.
|
||||
- `state` - The state of the auth method; either `inactive`, `active-private`, or
|
||||
`active-public`.
|
||||
|
||||
- `start_tls` - (optional) If true, issues a StartTLS command after establishing
|
||||
an unencrypted connection. Defaults to false.
|
||||
- `start_tls` - (optional) If `true`, issues a StartTLS command after establishing
|
||||
an unencrypted connection. Defaults to `false`.
|
||||
|
||||
- `insecure_tls` - (optional) If true, skips LDAP server SSL certificate
|
||||
- `insecure_tls` - (optional) If `true`, skips LDAP server SSL certificate
|
||||
validation, which is insecure and should be used with caution. Defaults to
|
||||
false.
|
||||
`false`.
|
||||
|
||||
- `discover_dn` - (optional) If true, use anon bind to discover the bind DN
|
||||
(Distinguished Name) of a user. Defaults to false.
|
||||
- `discover_dn` - (optional) If `true`, use anon bind to discover the bind DN
|
||||
(Distinguished Name) of a user. Defaults to `false`.
|
||||
|
||||
- `anon_group_search` - (optional) If true, use anon bind when performing LDAP
|
||||
group searches. Defaults to false.
|
||||
- `anon_group_search` - (optional) If `true`, use anon bind when performing LDAP
|
||||
group searches. Defaults to `false`.
|
||||
|
||||
- `upn_domain` - (optional) If set, the userPrincipalDomain is used to construct
|
||||
- `upn_domain` - (optional) If set, the `userPrincipalDomain` is used to construct
|
||||
the UPN string for the authenticating user. The constructed UPN appears as
|
||||
[username]@UPNDomain Example: example.com, which causes Boundary to
|
||||
bind as username@example.com when it authenticates the user.
|
||||
`[username]@UPNDomain`. Example: `example.com`, which causes Boundary to
|
||||
bind as `username@example.com` when it authenticates the user.
|
||||
|
||||
- `urls` - (required) The LDAP URLS that specify LDAP servers to connect to.
|
||||
There must be at least one URL for each LDAP auth method. When attempting to
|
||||
connect, the URLs are tried in the order specified.
|
||||
|
||||
- `user_dn` - (optional) If set, the base DN under which to perform user
|
||||
search. Example: ou=Users,dc=example,dc=com
|
||||
search. Example: `ou=Users,dc=example,dc=com`.
|
||||
|
||||
- `user_attr` - (optional) If set, defines the attribute on a user's entry
|
||||
matching the login-name passed when the user authenticates. Examples: cn, uid
|
||||
|
||||
- `user_filter` - (optional) If set, the Go template used to construct an LDAP
|
||||
user search filter. The template can access the following context variables:
|
||||
[UserAttr, Username]. The default user_filter is ({{.UserAttr}}={{.Username}})
|
||||
or (userPrincipalName={{.Username}}@UPNDomain) if the upn-domain parameter is
|
||||
[UserAttr, Username]. The default `user_filter` is
|
||||
`({{.UserAttr}}={{.Username}})` or
|
||||
`(userPrincipalName={{.Username}}@UPNDomain)` if the `upn-domain` parameter is
|
||||
set.
|
||||
|
||||
- `enable_groups` - (optional) If true, an authenticated user's groups are
|
||||
found during authentication. Defaults to false.
|
||||
- `enable_groups` - (optional) If `true`, an authenticated user's groups are
|
||||
found during authentication. Defaults to `false`.
|
||||
|
||||
- `group_dn` - (optional) If set, the base DN under which to perform a group
|
||||
search. Example: ou=Groups,dc=example,dc=com
|
||||
search. Example: `ou=Groups,dc=example,dc=com`.
|
||||
|
||||
Note: There is no default, so no base DN is used for group searches, if
|
||||
it's not specified.
|
||||
|
||||
- `group_attr` - (optional) If set, the LDAP attribute to follow on objects
|
||||
returned by group_filter in order to enumerate user group membership.
|
||||
Examples: for group_filter queries returning group objects, use: cn. For
|
||||
queries returning user objects, use: memberOf. The default is cn.
|
||||
returned by `group_filter` in order to enumerate user group membership.
|
||||
Examples: for `group_filter` queries returning group objects, use: `cn`. For
|
||||
queries returning user objects, use: `memberOf`. The default is `cn`.
|
||||
|
||||
- `group_filter` - (optional) If set, the Go template used when constructing the
|
||||
group membership query. The template can access the following context
|
||||
variables: [UserDN, Username]. The default is
|
||||
(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}})),
|
||||
variables: `UserDN`, `Username`. The default is
|
||||
`(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`,
|
||||
which is compatible with several common directory schemas.
|
||||
|
||||
- `certificates` - (optional) If set, PEM encoded x509 certificates in ASN.1
|
||||
@@ -106,20 +107,20 @@ The ldap auth method has the following additional attributes:
|
||||
|
||||
- `bind_dn` - (optional) If set, the distinguished name of entry to bind when
|
||||
performing user and group searches. Example:
|
||||
cn=vault,ou=Users,dc=example,dc=com
|
||||
`cn=vault,ou=Users,dc=example,dc=com`.
|
||||
|
||||
- `bind_password` - (optional) If set, the password to use along with bind_dn
|
||||
- `bind_password` - (optional) If set, the password to use along with `bind_dn`
|
||||
when performing user search. It must be set, if you specify the optional
|
||||
bind_dn.
|
||||
`bind_dn`.
|
||||
|
||||
- `use_token_groups` - (optional) If true, use the Active Directory tokenGroups
|
||||
- `use_token_groups` - (optional) If `true`, use the Active Directory `tokenGroups`
|
||||
constructed attribute of the user to find the group memberships. This
|
||||
finds all security groups, including nested ones.
|
||||
|
||||
- `account_attribute_maps` - (optional) If set, the attribute maps from custom
|
||||
attributes to the standard fullname and email account attributes. These
|
||||
maps are represented as key=value where the key equals the from_attribute, and
|
||||
the value equals the to_attribute. For example, "preferredName=fullName". All
|
||||
maps are represented as `key=value` where the key equals the `from_attribute`, and
|
||||
the value equals the `to_attribute`. For example, `preferredName=fullName`. All
|
||||
attribute names are case insensitive.
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user