mirror of
https://github.com/h44z/wg-portal.git
synced 2026-03-24 00:56:26 +00:00
402cc1b5f3
* Implement LDAP filter-based access control for interface provisioning * test: add unit tests for LDAP interface filtering logic * smaller improvements / cleanup --------- Co-authored-by: jc <37738506+theguy147@users.noreply.github.com> Co-authored-by: Christoph Haas <christoph.h@sprinternet.at>
54 lines
3.6 KiB
Markdown
54 lines
3.6 KiB
Markdown
For all external authentication providers (LDAP, OIDC, OAuth2), WireGuard Portal can automatically create a local user record upon the user's first successful login.
|
|
This behavior is controlled by the `registration_enabled` setting in each authentication provider's configuration.
|
|
|
|
User information from external authentication sources is merged into the corresponding local WireGuard Portal user record whenever the user logs in.
|
|
Additionally, WireGuard Portal supports periodic synchronization of user data from an LDAP directory.
|
|
|
|
To prevent overwriting local changes, WireGuard Portal allows you to set a per-user flag that disables synchronization of external attributes.
|
|
When this flag is set, the user in WireGuard Portal will not be updated automatically during log-ins or LDAP synchronization.
|
|
|
|
### LDAP Synchronization
|
|
|
|
WireGuard Portal lets you hook up any LDAP server such as Active Directory or OpenLDAP for both authentication and user sync.
|
|
You can even register multiple LDAP servers side-by-side. Details on the log-in process can be found in the [LDAP Authentication](./authentication.md#ldap-authentication) section.
|
|
|
|
If you enable LDAP synchronization, all users within the LDAP directory will be created automatically in the WireGuard Portal database if they do not exist.
|
|
If a user is disabled or deleted in LDAP, the user will be disabled in WireGuard Portal as well.
|
|
The synchronization process can be fine-tuned by multiple parameters, which are described below.
|
|
|
|
#### Synchronization Parameters
|
|
|
|
To enable the LDAP sycnhronization this feature, set the `sync_interval` property in the LDAP provider configuration to a value greater than "0".
|
|
The value is a string representing a duration, such as "15m" for 15 minutes or "1h" for 1 hour (check the [exact format definition](https://pkg.go.dev/time#ParseDuration) for details).
|
|
The synchronization process will run in the background and synchronize users from LDAP to the database at the specified interval.
|
|
Also make sure that the `sync_filter` property is a well-formed LDAP filter, or synchronization will fail.
|
|
|
|
##### Limiting Synchronization to Specific Users
|
|
|
|
Use the `sync_filter` property in your LDAP provider block to restrict which users get synchronized.
|
|
It accepts any valid LDAP search filter, only entries matching that filter will be pulled into the portal's database.
|
|
|
|
For example, to import only users with a `mail` attribute:
|
|
```yaml
|
|
auth:
|
|
ldap:
|
|
- id: ldap
|
|
# ... other settings
|
|
sync_filter: (mail=*)
|
|
```
|
|
|
|
##### Disable Missing Users
|
|
|
|
If you set the `disable_missing` property to `true`, any user that is not found in LDAP during synchronization will be disabled in WireGuard Portal.
|
|
All peers associated with that user will also be disabled.
|
|
|
|
If you want a user and its peers to be automatically re-enabled once they are found in LDAP again, set the `auto_re_enable` property to `true`.
|
|
This will only re-enable the user if they were disabled by the synchronization process. Manually disabled users will not be re-enabled.
|
|
|
|
##### Interface-specific Access Materialization
|
|
|
|
If `interface_filter` is configured in the LDAP provider, the synchronization process will evaluate these filters for each enabled user.
|
|
The results are materialized in the `interfaces` table of the database in a hidden field.
|
|
This materialized list is used by the backend to quickly determine if a user has permission to provision peers for a specific interface, without having to query the LDAP server for every request.
|
|
The list is refreshed every time the LDAP synchronization runs.
|
|
For more details on how to configure these filters, see the [Authentication](./authentication.md#interface-specific-provisioning-filters) section. |