LLDAP/example_configs/gogs.md

Gogs LDAP configuration

Via Simple Auth (easier)

Go to the Administration settings, then go to Authentication. There, you have to add an authentication source.

For type, select "LDAP (Simple Auth)". Name your authentication source however you'd like. It is up to you to select your security protocol, but the only two compatible options are "LDAPS" and "Unencrypted". As your host, put in the IP or FQDN (if you have DNS). As your port, check your configuration. It will generally be 3890 for unencrypted (once again check your config/docker compose files), and 6360 for LDAPS (once again check your config/docker compose files). Your User DN should follow this pattern: uid=%s,ou=people,<your_base_dn> (for example, uid=%s,ou=people,dc=example,dc=com). Replace <your_base_dn> with your actual base DN. It is recommended to have your user filter to be (&(objectClass=person)(uid=%s)). Set username attribute to uid, Given Name to givenName, surname to sn, and email to mail

You can (and should if you don't know LDAP) leave the rest empty.

Via Bind DN (more complicated)

The following configuration is adapted from the example configuration at their repository. The example is a container configuration - the file should live within conf/auth.d/some_name.conf:

$ cat /srv/git/gogs/conf/auth.d/ldap_bind_dn.conf
id           = 101
type         = ldap_bind_dn
name         = LDAP BindDN
is_activated = true
is_default   = true

[config]
host               = ldap.example.com
port               = 6360
# 0 - Unencrypted, 1 - LDAPS, 2 - StartTLS
security_protocol  = 1
# You either need to install the LDAPS certificate into your trust store -
# Or skip verification altogether - for a restricted container deployment a sane default.
skip_verify        = true
bind_dn            = uid=<binduser>,ou=people,dc=example,dc=com
bind_password      = `yourPasswordInBackticks`
user_base          = dc=example,dc=com
attribute_username = uid
attribute_name     = givenName
attribute_surname  = sn
attribute_mail     = mail
attributes_in_bind = false
# restricts on the `user_base`.
filter             = (&(objectClass=person)(uid=%s))
# The initial administrator has to enable admin privileges.
# This is only possible for users who were logged in once.
# This renders the following filter obsolete; Though its response is accepted by Gogs.
admin_filter       = (memberOf=cn=<yourAdminGroup>,ou=groups,dc=example,dc=com)

The binduser shall be a member of lldap_strict_readonly. The group yourAdminGroup should be adapted to your requirement - Otherwise the entire line can be omitted. The diamond brackets are for readability and are not required.

Tested on Gogs

v0.14+dev via podman 4.3.1