Connecting LDAP or Active Directory

Adding a directory

Administration, Users and groups, Directories, Add directory. Choose the kind, Active Directory or LDAP (OpenLDAP, FreeIPA, Samba and others); the kind only sets sensible defaults for the fields below.

• Connection: server, port and connection security: LDAPS (default), StartTLS or Plain. Use Plain only on a network you own
• Reading account: the bind DN (a DN or user@domain) and its password; empty means anonymous reading. Also the base DN and an optional additional user DN (for example OU=People)
• Synchronisation: read every N minutes (default 60) and what new people get: Licensed users, Customers (Help Desk portal only) or Without access; a mapped group can give more. Also Leave out expired accounts (on by default) and the connection, read and search timeouts
• Groups: Nested groups (on by default: a group inside a group counts its people too), an optional additional group DN and the group filter
• Advanced: the user filter and the attributes for username, e-mail, names, stable id, department, manager, expiry date and more; for groups, the group name and member attributes and the person's groups attribute (memberOf in Active Directory)

Save first, then press Test connection: the test uses the saved settings and shows what it found.

Synchronisation

Synchronisation runs on its schedule and on demand with Synchronise now. Each run adds, updates, deactivates and reactivates accounts and group memberships, and the Synchronisation log shows the counts per run and the last error. People removed from the directory, or past their expiry date, are deactivated, never deleted.

Group mapping

Directory groups appear under Users and groups, Groups. For each one, Also fills names a system group: its people become members there too, and leave when they leave the directory group. Memberships an administrator added by hand stay. System groups carry access, system administration and project roles, so a directory change reaches permissions on the next run.

Signing in

People from a directory sign in with their directory password: the password is checked by binding to the directory as them, and GoProject never stores a hash of it. Their name, address and password are changed in the directory. A switched-off directory lets none of its people in. Local accounts keep working alongside, so a directory outage never locks the administrators out.

Removing a directory

Its people stay as deactivated local accounts without a password; its groups and what they gave are removed.