Etherpad lite LDAP authentication and authorization

Install

In your etherpad-lite dir:

npm install ep_ldapauth_ng

Add to settings.json:

"users": {
"ldapauth": {
"url": "ldaps://ldap.example.com",
"accountBase": "ou=Users,dc=example,dc=com",
"accountPattern": "(&(objectClass=*)(uid={{username}}))",
"displayNameAttribute": "cn",
"searchDN": "uid=searchuser,dc=example,dc=com",
"searchPWD": "supersecretpassword",
"groupSearchBase": "ou=Groups,dc=example,dc=com",
"groupAttribute": "member",
"groupAttributeIsDN": true,
"searchScope": "sub",
"groupSearch": "(&(cn=admin)(objectClass=groupOfNames))",
"anonymousReadonly": false
}
},

Users who are in the matches group have admin access to
etherpad-lite.

Using with FreeIPA

First setup a read-only LDAP proxy user as described
here. Then adapt this settings.json
to match your IPA server URL, domain, LDAP proxy user and preferred admin group.

"users": {
"ldapauth": {
"url": "ldap://ipa.example.org:389",
"accountBase": "cn=users,cn=accounts,dc=example,dc=org",
"accountPattern": "(&(objectClass=posixaccount)(uid={{username}}))",
"displayNameAttribute": "displayname",
"searchDN": "uid=ldapproxy,cn=sysaccounts,cn=etc,dc=example,dc=org",
"searchPWD": "ldapproxy_password",
"searchScope": "sub",
"groupSearchBase": "cn=groups,cn=accounts,dc=example,dc=org",
"groupAttribute": "member",
"groupAttributeIsDN": true,
"groupSearch": "(&(cn=sysadmins)(objectClass=posixgroup))",
}
},

License

GPL-2.0