--On Sunday, May 07, 2017 5:49 PM +0200 Xaar xaar@linux.pl wrote:

Hello,

I want to authenticate users via OpenLDAP to Gitlab. In Gitlab configuration there is a gitlab.rb file, where I can write some special user (let it be gitlabuser) with credentials who will be bind to ldap server. Now my question is, what acl should I provide to this user on OpenLDAP server to allow other users authenticate to Gitlab ?

Now my DIT looks like this:

dc=company,dc=com | |

• cn=admin
• cn=gitlabuser

| |

• ou=Groups
• ou=Users -> here are users which I want to give access to Gitlab

Is this entry is fair enough ?

dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0} to attrs=userPassword by anonymous auth by dn=„cn=admin,dc=company,dc=com" write by * none olcAccess: {1} to dn.base=„" by * read olcAccess: {2} to * by * read

It would allow anyone (anonymous or authenticated) to read all your entries, minus the userPassword attribute. Depending on your security requirements, this may or may not be desirable.

--Quanah

--

Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com