mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-11 17:46:29 -05:00
[LDAP] Can't map LDAP groups to Gitea Orgs/Teams #9561
Closed
opened 2025-11-02 08:42:59 -06:00 by GiteaMirror
·
16 comments
No Branch/Tag Specified
main
release/v1.25
release/v1.24
release/v1.23
release/v1.22
release/v1.21
release/v1.20
release/v1.19
release/v1.18
release/v1.17
release/v1.16
release/v1.15
release/v1.14
release/v1.13
release/v1.12
release/v1.11
release/v1.10
release/v1.9
release/v1.8
v1.25.3
v1.25.2
v1.25.1
v1.25.0
v1.24.7
v1.25.0-rc0
v1.26.0-dev
v1.24.6
v1.24.5
v1.24.4
v1.24.3
v1.24.2
v1.24.1
v1.24.0
v1.23.8
v1.24.0-rc0
v1.25.0-dev
v1.23.7
v1.23.6
v1.23.5
v1.23.4
v1.23.3
v1.23.2
v1.23.1
v1.23.0
v1.23.0-rc0
v1.24.0-dev
v1.22.6
v1.22.5
v1.22.4
v1.22.3
v1.22.2
v1.22.1
v1.22.0
v1.23.0-dev
v1.22.0-rc1
v1.21.11
v1.22.0-rc0
v1.21.10
v1.21.9
v1.21.8
v1.21.7
v1.21.6
v1.21.5
v1.21.4
v1.21.3
v1.21.2
v1.20.6
v1.21.1
v1.21.0
v1.21.0-rc2
v1.21.0-rc1
v1.20.5
v1.22.0-dev
v1.21.0-rc0
v1.20.4
v1.20.3
v1.20.2
v1.20.1
v1.20.0
v1.19.4
v1.21.0-dev
v1.20.0-rc2
v1.20.0-rc1
v1.20.0-rc0
v1.19.3
v1.19.2
v1.19.1
v1.19.0
v1.19.0-rc1
v1.20.0-dev
v1.19.0-rc0
v1.18.5
v1.18.4
v1.18.3
v1.18.2
v1.18.1
v1.18.0
v1.17.4
v1.18.0-rc1
v1.19.0-dev
v1.18.0-rc0
v1.17.3
v1.17.2
v1.17.1
v1.17.0
v1.17.0-rc2
v1.16.9
v1.17.0-rc1
v1.18.0-dev
v1.16.8
v1.16.7
v1.16.6
v1.16.5
v1.16.4
v1.16.3
v1.16.2
v1.16.1
v1.16.0
v1.15.11
v1.17.0-dev
v1.16.0-rc1
v1.15.10
v1.15.9
v1.15.8
v1.15.7
v1.15.6
v1.15.5
v1.15.4
v1.15.3
v1.15.2
v1.15.1
v1.14.7
v1.15.0
v1.15.0-rc3
v1.14.6
v1.15.0-rc2
v1.14.5
v1.16.0-dev
v1.15.0-rc1
v1.14.4
v1.14.3
v1.14.2
v1.14.1
v1.14.0
v1.13.7
v1.14.0-rc2
v1.13.6
v1.13.5
v1.14.0-rc1
v1.15.0-dev
v1.13.4
v1.13.3
v1.13.2
v1.13.1
v1.13.0
v1.12.6
v1.13.0-rc2
v1.14.0-dev
v1.13.0-rc1
v1.12.5
v1.12.4
v1.12.3
v1.12.2
v1.12.1
v1.11.8
v1.12.0
v1.11.7
v1.12.0-rc2
v1.11.6
v1.12.0-rc1
v1.13.0-dev
v1.11.5
v1.11.4
v1.11.3
v1.10.6
v1.12.0-dev
v1.11.2
v1.10.5
v1.11.1
v1.10.4
v1.11.0
v1.11.0-rc2
v1.10.3
v1.11.0-rc1
v1.10.2
v1.10.1
v1.10.0
v1.9.6
v1.9.5
v1.10.0-rc2
v1.11.0-dev
v1.10.0-rc1
v1.9.4
v1.9.3
v1.9.2
v1.9.1
v1.9.0
v1.9.0-rc2
v1.10.0-dev
v1.9.0-rc1
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.8.0-rc3
v1.7.6
v1.8.0-rc2
v1.7.5
v1.8.0-rc1
v1.9.0-dev
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.7.0-rc3
v1.6.4
v1.7.0-rc2
v1.6.3
v1.7.0-rc1
v1.7.0-dev
v1.6.2
v1.6.1
v1.6.0
v1.6.0-rc2
v1.5.3
v1.6.0-rc1
v1.6.0-dev
v1.5.2
v1.5.1
v1.5.0
v1.5.0-rc2
v1.5.0-rc1
v1.5.0-dev
v1.4.3
v1.4.2
v1.4.1
v1.4.0
v1.4.0-rc3
v1.4.0-rc2
v1.3.3
v1.4.0-rc1
v1.3.2
v1.3.1
v1.3.0
v1.3.0-rc2
v1.3.0-rc1
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.2.0-rc3
v1.2.0-rc2
v1.1.4
v1.2.0-rc1
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.2
v1.0.1
v1.0.0
v0.9.99
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
Mirrored from GitHub Pull Request
No Label
type/docs
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/gitea#9561
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @drequivalent on GitHub (Sep 13, 2022).
Description
Trying to join Gitea into FreeIPA's LDAP.
Users work fine, but then I need to map the LDAP user groups to Gitea teams in order to manage access in a more centralized way.
The settings are as follows:

Organization is present:

Teams as well:

Updating external user information, though, is not joining anyone to any Teams.
What am I doing wrong?
Gitea Version
1.17.2
Can you reproduce the bug on the Gitea demo site?
No
Log Gist
No response
Screenshots
No response
Git Version
No response
Operating System
No response
How are you running Gitea?
Gitea binary build
Database
PostgreSQL
@kdumontnu commented on GitHub (Sep 13, 2022):
Is this a duplicate of https://github.com/go-gitea/gitea/issues/19555?
In short, I don’t think this feature is supported.
@drequivalent commented on GitHub (Sep 13, 2022):
No. The issue you referenced is about OIDC.
I'm talking about LDAP.
If it's not supported, why is it ("Map LDAP groups to Organization teams") present in settings?
Besides, it was confirmed to work at #21159
@drequivalent commented on GitHub (Sep 13, 2022):
The log doesn't mention
LDAP group sync:in any way.(I would publish it, but it contains personal data)
@drequivalent commented on GitHub (Sep 13, 2022):
Here's the abridged version:
@6543 commented on GitHub (Sep 13, 2022):
@drequivalent
1.17.12does not exist do you mean1.17.2?@drequivalent commented on GitHub (Sep 13, 2022):
Yes, of course. Sorry for typo.
@drequivalent commented on GitHub (Sep 20, 2022):
Please, help! I'm stuck!
@drequivalent commented on GitHub (Sep 20, 2022):
I have put
dnintoUser Attribute Listed In Groupinstead ofuid, as suggested by @svenseeberg in private correspondence.This seems to have worked, and now I have the teams populated.
I think, this needs a better explanation in documentation and settings UI.
Thanks, @svenseeberg, I really appreciate your help!
@dawivid commented on GitHub (Apr 4, 2023):
Did this get resolved or changed? I am struggling with exactly the same thing

THis is the debug I get
4/04 14:30:12 ...dap/source_search.go:340:SearchEntry() [T] [642c3474] Fetching attributes '', '', '', 'mail', '', '', 'dn' with filter '(sAMAccountName=david.testing)' and base 'CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr14,DC=net'
gitea | 2023/04/04 14:30:12 ...dap/source_search.go:228:listLdapGroupMemberships() [E] [642c3474] Failed group search in LDAP with filter [(&()(member=CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr
FYI - from the screenshot remove the Verify Group Membership, when I confiugure this it doesn't search AD for my group memberships
@dawivid commented on GitHub (Apr 5, 2023):
sorry, I am running v1.19 and authenticating against Active Directory server 2016
@svenseeberg commented on GitHub (Apr 5, 2023):
Can you look into your log files on your AD server and see if there are any problems with the queries? And can you provide examples of your group and user objects?
@dawivid commented on GitHub (Apr 5, 2023):
THanks for getting back to me Sven. The Event viewer shows no errors, only mentions that I am working currently over LDAP and it woiuld like to move to LDAPS. When you say examples, what would you like to see? OUtput from ldapsearch, or Attribute editor or........?
@dawivid commented on GitHub (Apr 5, 2023):
In the meantime I will give you this output:
here is the DN of my user
distinguishedName: CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr
14,DC=net
Here is an LDAPsearch output filtering for member
.# Re_Gitea_user, Gitea, Resources, Infra, ocr.cr14.net
dn: CN=Re_Gitea_user,OU=Gitea,OU=Resources,OU=Infra,DC=ocr,DC=cr14,DC=net
member: CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr14,DC=net
Here is the output from Gitea:
gitea | 2023/04/05 10:38:26 ...dap/source_search.go:145:bindUser() [T] [642d4fa2] Bound successfully with userDN: CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr14,DC=net
gitea | 2023/04/05 10:38:26 ...dap/source_search.go:340:SearchEntry() [T] [642d4fa2] Fetching attributes '', '', '', 'mail', '', '', 'dN' with filter '(sAMAccountName=david.testing)' and base 'CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr14,DC=net'
gitea | 2023/04/05 10:38:26 ...dap/source_search.go:228:listLdapGroupMemberships() [E] [642d4fa2] Failed group search in LDAP with filter [(&()(member=CN=david testing,OU=Internal,OU=Users,OU=Infra,DC=ocr,DC=cr14,DC=net))]: LDAP Result Code 201 "Filter Compile Error": ldap: error parsing filter
gitea | 2023/04/05 10:38:26 [642d4fa2] router: completed POST /user/login for 192.168.200.104:55457, 303 See Other in 11.3ms @ auth/auth.go:170(auth.SignInPost)
Gitea's search text is literally verbatom what I am getting out of ldapsearch.
@dawivid commented on GitHub (Apr 5, 2023):
So, looking through this with chatGPT, it is telling me the problem is at the start of the search string [(&()...
This empty bracket is the issue and I can't work out how to get it populated.
@svenseeberg commented on GitHub (Apr 5, 2023):
Looks like you're running into #23615
@dawivid commented on GitHub (Apr 5, 2023):
Indeed! However, when I populate the 'Verify Group Memebership in LDAP' it stops searching all together.
my version is 1.19.0 built with GNU Make 4.3, go1.20.2 . I will update the other issue though