recommendation on ldap as the authentication source #9990

New Issue

GiteaMirror · 2025-11-02T08:55:08-06:00

GiteaMirror commented

2025-11-02 08:55:08 -06:00

Originally created by @wzqiang1332 on GitHub (Dec 19, 2022).

Feature Description

User DN (required)
This configuration item restricts the ldap directory structure, such as
CN=user1,OU=group1,OU=xx,OU=com
CN=user2,OU=group2,OU=xx,OU=com.
There's no way to configure it.
This attribute can be removed, and the user's DN can be obtained by searching the user.
Through the UserFilter attribute, you can query the ldap attributes of a specified user. Again, log in using multiple methods, such as a username or email address, like "(&(|((sAMAccountName={0})(employeeID={0})(mail={0})))(objectClass=user))"
Other applications, such as jenkins, also have no UserDN in the ldap configuration.

Screenshots

No response

Originally created by @wzqiang1332 on GitHub (Dec 19, 2022). ### Feature Description User DN (required) This configuration item restricts the ldap directory structure, such as CN=user1,OU=group1,OU=xx,OU=com CN=user2,OU=group2,OU=xx,OU=com. There's no way to configure it. This attribute can be removed, and the user's DN can be obtained by searching the user. Through the UserFilter attribute, you can query the ldap attributes of a specified user. Again, log in using multiple methods, such as a username or email address, like "(&(|((sAMAccountName={0})(employeeID={0})(mail={0})))(objectClass=user))" Other applications, such as jenkins, also have no UserDN in the ldap configuration. ### Screenshots _No response_

GiteaMirror added the type/proposal type/feature labels 2025-11-02 08:55:08 -06:00

GiteaMirror commented

2025-11-02 08:55:08 -06:00

@markkrj commented on GitHub (Dec 22, 2022):

This is required for simple auth, as the DN is a template for performing the bind itself. If you wish to use another attribute to login, you'll need a bind user anyway. It is a best practice to use a bind DN anyway.
https://docs.gitea.io/en-us/authentication/#ldap-via-binddn

@markkrj commented on GitHub (Dec 22, 2022): This is required for simple auth, as the DN is a template for performing the bind itself. If you wish to use another attribute to login, you'll need a bind user anyway. It is a best practice to use a bind DN anyway. https://docs.gitea.io/en-us/authentication/#ldap-via-binddn

GiteaMirror commented

2025-11-02 08:55:08 -06:00

@wzqiang1332 commented on GitHub (Dec 29, 2022):

This is required for simple auth, as the DN is a template for performing the bind itself. If you wish to use another attribute to login, you'll need a bind user anyway. It is a best practice to use a bind DN anyway. https://docs.gitea.io/en-us/authentication/#ldap-via-binddn

In simple auth mode, User DN is also a mandatory field.
Usually, the UserDN attribute of a user is different from the user name. For example, in the active directory, sAMAccountName is used as the user name, but UserDN is his Chinese name. In addition, in gitea, UserDN cannot contain special characters, such as Chinese characters. Otherwise, UserDN cannot be used. The error message is that the user name cannot contain special characters.

@wzqiang1332 commented on GitHub (Dec 29, 2022): > This is required for simple auth, as the DN is a template for performing the bind itself. If you wish to use another attribute to login, you'll need a bind user anyway. It is a best practice to use a bind DN anyway. https://docs.gitea.io/en-us/authentication/#ldap-via-binddn In simple auth mode, User DN is also a mandatory field. Usually, the UserDN attribute of a user is different from the user name. For example, in the active directory, sAMAccountName is used as the user name, but UserDN is his Chinese name. In addition, in gitea, UserDN cannot contain special characters, such as Chinese characters. Otherwise, UserDN cannot be used. The error message is that the user name cannot contain special characters.

GiteaMirror commented

2025-11-02 08:55:09 -06:00

@markkrj commented on GitHub (Jan 18, 2023):

@wzqiang1332 If you are using Active Directory, there is a easy fix. Just use the DOMAIN\%s or %s@example.com (userPrincipalName), as Active Directory allow binding with DN, userPrincipalName or DOMAIN\sAMAccountName...

Again, using simple auth is bad practice. One should really just use a bind user instead...

@markkrj commented on GitHub (Jan 18, 2023): @wzqiang1332 If you are using Active Directory, there is a easy fix. Just use the `DOMAIN\%s` or `%s@example.com` (`userPrincipalName`), as Active Directory allow binding with `DN`, `userPrincipalName` or `DOMAIN\sAMAccountName`... Again, using simple auth is bad practice. One should really just use a bind user instead...

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9990