docs(LLDAP): Revamp docs with Authelia guide (#8015)
**Description** <!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. --> Wrote a guide integrating upstream specific values for Authelia and mapping them to the SCALE UI. Also included a note about the read only user group to promote good security practices. ⚒️ Fixes # <!--(issue)--> **⚙️ Type of change** - [ ] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> Personally tested the guide to spin up Authelia and successfully authenticated my test LLDAP user. Also been sense checked by users on Discord (thanks guys). **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [ ] ⚖️ My code follows the style guidelines of this project - [ ] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [X] 📄 I have made corresponding changes to the documentation - [ ] ⚠️ My changes generate no new warnings - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [ ] ⬆️ I increased versions for any altered app according to semantic versioning **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🪞 I have opened a PR on [truecharts/containers](https://github.com/truecharts/containers) adding the container to TrueCharts mirror repo. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._
This commit is contained in:
MaverickD650
GitHub
parent
8f3ca2e1ba
commit
93c080d729
|
|
@ -0,0 +1,56 @@
|
|||
# Authelia Setup
|
||||
|
||||
Authelia which is available in the Enterprise train can act as the authentication provider for your apps and services either through OAuth or forward authentication. LLDAP can be used to manage your Authelia users and groups. To enable this as an option follow the steps outlined below. References to the specific questions as they appear in the TrueNAS SCALE UI are included in the guide and highlighted along with the answers you should use. Authelia is the recommended authentication provider for TrueCharts however you can use any other provider you wish for Authentik is available in the Stable train.
|
||||
|
||||
This guide has been written as LLDAP has specific requirements for the LDAP setup of Authelia. If you are using another LDAP provider you will need to follow the setup instructions for that provider.
|
||||
|
||||
> **Disclaimer:** This guide only covers the LDAP setup of Authelia. Refer to other guides for the remaining setup of Authelia.
|
||||
|
||||
## Setup instructions
|
||||
|
||||
1. Tick the box for `LDAP backend configuration` a further set of questions will then appear.
|
||||
2. The dropdown `Implementation` should be set as `custom`
|
||||
3. URL should be set to internally link back to your LLDAP instance for the default configuration it should look something like this, `ldap://lldap-ldap.ix-lldap.svc.cluster.local:3890`. This will need to be adapted if you have named LLDAP differently or used a different port for LDAP.
|
||||
4. Next, set the `Base DN`. This is one of the configurable options you set when installing LLDAP, which by default is `dc=example,dc=com` and should be adapted to your domain if set.
|
||||
5. The `Username Attribute` should be set to `uid`.
|
||||
6. The `Additional Users DN` should be set to `ou=people`, as this is where all your users are stored.
|
||||
7. The users filter can be set to one of two options depending on whether you want to allow sign-in with a username or both username and email. Both options are outlined below.
|
||||
|
||||
**Username only**
|
||||
|
||||
```
|
||||
(&({username_attribute}={input})(objectClass=person))
|
||||
```
|
||||
|
||||
**Username and email**
|
||||
|
||||
```
|
||||
(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
||||
```
|
||||
|
||||
8. The next option that needs setting is `Additional Groups DN`. It must be set to `ou=groups`, as this is where all your groups are stored.
|
||||
9. LLDAP only supports only one filter, which should be set in `Groups Filter` and set to `(member={dn})`.
|
||||
10. The `Group name Attribute` should be set to `cn`.
|
||||
11. The `Mail Attribute` should simply be set to `mail`.
|
||||
12. The `Display Name Attribute` should be set to `displayName`. This is the attribute that Authelia will use to greet users when they log in.
|
||||
13. `Admin user` is the default admin user used when setting up LLDAP initially and is auto-generated for you. The entry you input into this box should look something like the one below. Change `dc=example,dc=com` to match the `Base DN` you set earlier.
|
||||
|
||||
**Admin user**
|
||||
|
||||
```
|
||||
uid=admin,ou=people,dc=example,dc=com
|
||||
```
|
||||
|
||||
14. Enter the admin user password into the `Password` field. As stated earlier, **DO NOT** use the default password.
|
||||
|
||||
## References
|
||||
|
||||
The origin material for this guide is available on the [LLDAP Github](https://github.com/lldap/lldap). While further information on Authelia can be found on their [Github](https://github.com/authelia/authelia) and [website](https://www.authelia.com/).
|
||||
|
||||
## Support
|
||||
|
||||
If you have any issues with following this guide, we can be reached using [Discord](https://discord.gg/tVsPTHWTtr) for real-time feedback and support.
|
||||
|
||||
---
|
||||
|
||||
All Rights Reserved - The TrueCharts Project
|
||||
|
|
@ -10,12 +10,15 @@ By default, LLDAP will use the following options:
|
|||
- Admin password: password
|
||||
- Base DN for LDAP: dc=example,dc=org
|
||||
- LDAP port: 3890
|
||||
- JWT secret: random (generated on first run)
|
||||
|
||||
> ⚠️ **WARNING**: The default configuration is not secure and should not be used in production. Please change the admin password for LDAP before using LLDAP in production. ⚠️
|
||||
|
||||
## Usage
|
||||
|
||||
LLDAP can be used as the user backend for Authelia and Authentik as well as any other application that supports LDAP e.g. Jellyfin and Nextcloud.
|
||||
LLDAP can be used as the user backend for Authelia and Authentik as well as any other application that supports LDAP e.g. Jellyfin and Nextcloud. A specific guide for Authelia is available in this documentation but other authentication applications can be configured in a similar way.
|
||||
|
||||
When setting your bind user you should avoid using the admin user as this is a security risk. Instead, create a new user with the minimum permissions required for your application. LLDAP has a user group `lldap_strict_readonly` which can be used for this purpose. This group has read-only access to the LDAP database and can be used to create a new user with the minimum permissions required for your application. However, if you want to provide password reset then create a user in the `lldap_password_manager` group.
|
||||
|
||||
## Support
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue