{"componentChunkName":"component---node-modules-gatsby-theme-blog-core-src-templates-post-query-js","path":"/integrate-gitblit-with-ldap/","result":{"data":{"site":{"siteMetadata":{"title":"one melo a day","social":[{"name":"twitter","url":"https://twitter.com/melo0187"},{"name":"github","url":"https://github.com/melo0187"}]}},"blogPost":{"__typename":"MdxBlogPost","id":"37b4d733-9fc3-52e9-b9ae-8a3c6dad7578","excerpt":"Make use of DSM Directory Server as Gitblit authentication provider","body":"function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"layout\": \"post\",\n  \"title\": \"Integrating GitBlit with Directory Server\",\n  \"author\": \"melo\",\n  \"date\": \"2016-07-12T19:57:09.000Z\",\n  \"categories\": [\"DiskStation\", \"Git\", \"Technical\"],\n  \"slug\": \"integrate-gitblit-with-ldap\",\n  \"excerpt\": \"Make use of DSM Directory Server as Gitblit authentication provider\",\n  \"draft\": false,\n  \"meta_title\": \"Integrating GitBlit with Directory Server\"\n};\n\nvar makeShortcode = function makeShortcode(name) {\n  return function MDXDefaultShortcode(props) {\n    console.warn(\"Component \" + name + \" was not imported, exported, or provided by MDXProvider as global scope\");\n    return mdx(\"div\", props);\n  };\n};\n\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, [\"components\"]);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"I did describe how to \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/turn-diskstation-into-self-hosted-git-server/\"\n  }), \"turn your DiskStation into a self-hosted Git server\"), \" in the past, but I wanted to push things a little further and so I started experimenting with DSM\\u2019s Directory Server. Read along to find out how to manage users in Directory Server and set it up as authentication provider for GitBlit.\"), mdx(\"h2\", {\n    \"id\": \"why-the-effort\"\n  }, \"Why the effort?\"), mdx(\"p\", null, \"My main reason for setting up Gitblit was to be able to collaborate with friends on projects we don\\u2019t want to publicly host on GitHub. By using something like Gitblit instead of following Synology\\u2019s suggestion to manually create server repositories with  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"git init --bare\"), \" , I gained one important advantage: I do not need to create a full fledged user account on my DiskStation to allow someone access to my git repositories. To me this is important from a security point of view. If I create a DSM user for every single person I want to give access to a git repository, I also need to ensure that I basically take away all privileges from these user accounts. I don\\u2019t want them to be able to log in to DSM in the first place so Gitblit having its own user management is a big plus. However I also run Jenkins on my DiskStation. This made me think about Directory Server as an opportunity to manage non DSM users on my DiskStation and allow my collaborators to access both Gitblit and Jenkins (and potentially more applications) with one username and password.\"), mdx(\"h2\", {\n    \"id\": \"setting-up-directory-server\"\n  }, \"Setting up Directory Server\"), mdx(\"p\", null, \"So to get started we setup Directory Server by following these steps:\"), mdx(\"ol\", null, mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Install Directory Server from DSM Package Center\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Launch Directory Server to bring up the Directory Server settings screen\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Check the box reading \\u201CEnable LDAP Server\\u201D\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Check the \\u201CAs the Provider server\\u201D radio button\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Specify the domain name for the LDAP database in the FQDN field\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Setup a password\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Check the connection settings to ensure you \", mdx(\"em\", {\n    parentName: \"li\"\n  }, \"allow\"), \" anonymous binds\")), mdx(\"p\", null, \"Your settings should look similar to the ones in the screenshot. \", \"[\", \"caption id=\\u201Cattachment\", \"_\", \"317\\u201D align=\\u201Caligncenter\\u201D width=\\u201C300\\u201D\", \"]\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://melo.myds.me/wordpress/wp-content/uploads/2016/07/dsm_directory_server_settings.jpg\"\n  }), mdx(\"span\", _extends({\n    parentName: \"a\"\n  }, {\n    \"className\": \"gatsby-resp-image-wrapper\",\n    \"style\": {\n      \"position\": \"relative\",\n      \"display\": \"block\",\n      \"marginLeft\": \"auto\",\n      \"marginRight\": \"auto\",\n      \"maxWidth\": \"300px\"\n    }\n  }), \"\\n      \", mdx(\"span\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-background-image\",\n    \"style\": {\n      \"paddingBottom\": \"71.33333333333334%\",\n      \"position\": \"relative\",\n      \"bottom\": \"0\",\n      \"left\": \"0\",\n      \"backgroundImage\": \"url('data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAIBBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHtVeIC/wD/xAAYEAEAAwEAAAAAAAAAAAAAAAABAAIQEf/aAAgBAQABBQIoGc0Z/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFxAAAwEAAAAAAAAAAAAAAAAAACAxQf/aAAgBAQAGPwLSL//EABoQAAICAwAAAAAAAAAAAAAAAAABESFBUaH/2gAIAQEAAT8huOmUIaRggQ1J/9oADAMBAAIAAwAAABDPD//EABcRAQADAAAAAAAAAAAAAAAAAAEQETH/2gAIAQMBAT8QCsj/xAAWEQEBAQAAAAAAAAAAAAAAAAABEDH/2gAIAQIBAT8QVdn/xAAbEAEBAQACAwAAAAAAAAAAAAABEQAxgSFhkf/aAAgBAQABPxCyaU4odGBsD8MKcXRvKZmyNS3mYGLPe//Z')\",\n      \"backgroundSize\": \"cover\",\n      \"display\": \"block\"\n    }\n  })), \"\\n  \", mdx(\"img\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-image\",\n    \"alt\": \"Directory Server setup\",\n    \"title\": \"Directory Server setup\",\n    \"src\": \"/static/6e1bfababc7ad8847a184558d84f3514/afcd2/dsm_directory_server_settings-300x214.jpg\",\n    \"srcSet\": [\"/static/6e1bfababc7ad8847a184558d84f3514/afcd2/dsm_directory_server_settings-300x214.jpg 300w\"],\n    \"sizes\": \"(max-width: 300px) 100vw, 300px\",\n    \"loading\": \"lazy\"\n  })), \"\\n    \")), \" Directory Server setup\", \"[\", \"/caption\", \"]\", \" For a complete explanation of Directory Server settings have a look at \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.synology.com/en-global/knowledgebase/DSM/help/DirectoryServer/ldap_server\"\n  }), \"Synology\\u2019s documentation\"), \". Now that the server is setup, we can add our users by following these steps:\"), mdx(\"ol\", null, mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Switch to the \\u201CUser\\u201D Tab\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Click \\u201CCreate\\u201D\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Fill in all fields in \\u201CUser information\\u201D, where \\u201CName\\u201D is the username used for login and \\u201CDescription\\u201D can be used for user\\u2019s full name\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Add your new user to the \\u201Cusers\\u201D group and click \\u201COK\\u201D\")), mdx(\"p\", null, \"Your user should look something like the one in the screenshot. \", \"[\", \"caption id=\\u201Cattachment\", \"_\", \"324\\u201D align=\\u201Caligncenter\\u201D width=\\u201C300\\u201D\", \"]\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://melo.myds.me/wordpress/wp-content/uploads/2016/07/dsm_directory_server_users.jpg\"\n  }), mdx(\"span\", _extends({\n    parentName: \"a\"\n  }, {\n    \"className\": \"gatsby-resp-image-wrapper\",\n    \"style\": {\n      \"position\": \"relative\",\n      \"display\": \"block\",\n      \"marginLeft\": \"auto\",\n      \"marginRight\": \"auto\",\n      \"maxWidth\": \"300px\"\n    }\n  }), \"\\n      \", mdx(\"span\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-background-image\",\n    \"style\": {\n      \"paddingBottom\": \"55.00000000000001%\",\n      \"position\": \"relative\",\n      \"bottom\": \"0\",\n      \"left\": \"0\",\n      \"backgroundImage\": \"url('data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHu2xDI/8QAGRAAAgMBAAAAAAAAAAAAAAAAABEBAjEQ/9oACAEBAAEFAhC5OVz/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAUEAEAAAAAAAAAAAAAAAAAAAAg/9oACAEBAAY/Al//xAAaEAEAAwADAAAAAAAAAAAAAAABABFRECFx/9oACAEBAAE/IaMlMJTDjovIlKz/2gAMAwEAAgADAAAAEF//AP/EABcRAAMBAAAAAAAAAAAAAAAAAAABESH/2gAIAQMBAT8QwUZ//8QAFhEBAQEAAAAAAAAAAAAAAAAAAAER/9oACAECAQE/EF2P/8QAGxABAAICAwAAAAAAAAAAAAAAAQARITFRkfH/2gAIAQEAAT8Q3AbviFOeqeNKIlZhEkVy1BZ//9k=')\",\n      \"backgroundSize\": \"cover\",\n      \"display\": \"block\"\n    }\n  })), \"\\n  \", mdx(\"img\", _extends({\n    parentName: \"span\"\n  }, {\n    \"className\": \"gatsby-resp-image-image\",\n    \"alt\": \"Directory Server user setup\",\n    \"title\": \"Directory Server user setup\",\n    \"src\": \"/static/41920159ee9160669afa872ba7c86656/afcd2/dsm_directory_server_users-300x165.jpg\",\n    \"srcSet\": [\"/static/41920159ee9160669afa872ba7c86656/afcd2/dsm_directory_server_users-300x165.jpg 300w\"],\n    \"sizes\": \"(max-width: 300px) 100vw, 300px\",\n    \"loading\": \"lazy\"\n  })), \"\\n    \")), \" Directory Server user\", \"[\", \"/caption\", \"]\", \" We\\u2019re done with Directory Server setup. Let\\u2019s now learn how to configure Gitblit to use our Directory Server as authentication provider so we can log in with the Directory Server user we just created.\"), mdx(\"h2\", {\n    \"id\": \"integrating-with-gitblit\"\n  }, \"Integrating with Gitblit\"), mdx(\"p\", null, \"One of Gitblit\\u2019s features is to connect to an LDAP server and use it as an authentication provider. You can find documentation for this \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://gitblit.com/setup_authentication.html#H2\"\n  }), \"here\"), \". Most of the LDAP setup is pretty straight forward and is performed through the  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"gitblit.properties\"), \"  file. You can find  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"gitblit.properties\"), \"  in Gitblit\\u2019s  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"baseFolder\"), \" . For me this is  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"/volume1/@appstore/gitblit\"), \" , because I configured Gitblit to use that as a custom  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"baseFolder\"), \"  by specifying it as environment variable in Tomcat\\u2019s  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"context.xml\"), \"  file, as described \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://gitblit.com/setup_war.html#H5\"\n  }), \"here\"), \". So to configure Gitblit to anonymously bind to Directory Server I added the following settings to  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"gitblit.properties\"), \" : \", \"[\", \"code lang=text\", \"]\", \" realm.authenticationProviders = ldap realm.ldap.server = ldap://localhost:389 realm.ldap.username = realm.ldap.password = realm.ldap.accountBase = dc=melo,dc=myds,dc=me realm.ldap.accountPattern = (&(objectclass=inetorgperson)(cn=${username})) realm.ldap.displayName = gecos realm.ldap.email = mail \", \"[\", \"/code\", \"]\", \" This tells Gitblit to use an LDAP server as authentication provider, the address of the LDAP server and - since we allow anonymous binds - to use empty username and password to let Gitblit bind to our Directory Server. Gitblit comes with a  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"default.properties\"), \"  file (described \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://gitblit.com/properties.html\"\n  }), \"here\"), \") that gets included in  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"gitblit.properties\"), \"  and because the  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"default.properties\"), \"  file has default values for username and password providing the  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.username\"), \"  and  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.password\"), \"  with an empty value is mandatory to anonymously bind to our Directory Server. For  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.accountBase\"), \"  you need to provide the value called \\u201CBase DN\\u201D in Directory Server\\u2019s settings screen. For me this is  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"dc=melo,dc=myds,dc=me\"), \" , like you can see in the \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://melo.myds.me/wordpress/wp-content/uploads/2016/07/dsm_directory_server_settings.jpg\",\n    \"title\": \"Directory Server setup\"\n  }), \"screenshot\"), \". The values for the remaining settings were a bit tricky. To understand what I need to configure I connected to the DiskStation by ssh as admin and executed the following command: \", \"[\", \"code lang=bash\", \"]\", \" ldapsearch -D uid=root,cn=users,dc=melo,dc=myds,dc=me -w <redacted\", \"_\", \"password>\\xA0-b dc=melo,dc=myds,dc=me \", \"[\", \"/code\", \"]\", \" This binds to the Directory Server, searches all objects and displays a rather verbose output. Among lots of other details the output has the following information: \", \"[\", \"code lang=text\", \"]\", \" objectClass: inetOrgPerson cn: <redacted\", \"_\", \"username> gecos: Carmelo Scollo mail: <redacted\", \"_\", \"email> \", \"[\", \"/code\", \"]\", \" Remember how I suggested to use the \\u201CDescription\\u201D field for the user\\u2019s full name when creating the user in Directory Server? The ldapsearch output informs us that internally the field is called  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"gecos\"), \" , so that is what we define as  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.displayName\"), \" . It also tells us that the email is stored in a field called  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"mail\"), \" , which we need to consider, because Gitblit\\u2019s  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"default.properties\"), \"  assume that the field is called email, so we set  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.email = mail\"), \" . The default accountPattern would be  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"(&(objectClass=person)(sAMAccountName=${username}))\"), \" , but the ldapsearch output shows that our user object is  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"objectClass:inetOrgPerson\"), \"  and the field for the username is  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"cn\"), \" , which leads us to  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"realm.ldap.accountPattern = (&(objectclass=inetorgperson)(cn=${username}))\"), \"  So that is the complete Gitblit configuration required for using our Directory Server as authentication provider and thus allowing us to connect to Gitblit with Directory Server users. Just restart Gitblit for the configuration changes to take effect and log in with a user that exists in Directory Server!\"), mdx(\"h2\", {\n    \"id\": \"password-change-self-service\"\n  }, \"Password change self-service\"), mdx(\"p\", null, \"Since Directory Server requires us to provide a password when creating a user, we need to provide our users a way to change the initial password we set for them during user-creation. The easiest solution for me to get password change self-service in place was by using a php based solution from GitHub user Matt Rude found \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://gist.github.com/657334\"\n  }), \"here\"), \". So I grabbed that php file, edited the  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"$dn\"), \"  variable to match my base dn and put it in a directory inside my web folder. Then I added an .htaccess file to the same path that rewrites all http requests to that resource to https like this: \", \"[\", \"code lang=text\", \"]\", \" RewriteEngine On RewriteCond %{HTTPS} !on RewriteRule (.\", \"*\", \") \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://%25%7BHTTP%5C_HOST%7D%25%7BREQUEST%5C_URI%7D\"\n  }), \"https://%{HTTP\\\\_HOST}%{REQUEST\\\\_URI}\"), \" \", \"[\", \"/code\", \"]\", \" Last step was to make sure that the ldap php extension is enabled. You can do this by going to \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"Control Panel\"), \" -> \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"Web Services\"), \" -> \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"PHP Settings\"), \" -> \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"Extensions\"), \" and check the box for ldap. Now I can point my users to the URL for this php form where they provide their username and initial password and define a new password.\"), mdx(\"h2\", {\n    \"id\": \"conclusion\"\n  }, \"Conclusion\"), mdx(\"p\", null, \"The users I create in Directory Server can now be used to log in to my Gitblit server. Thanks to the php solution from GitHub user Matt Rude I have a password change self-service in place. I was able to configure Jenkins to use the Directory Server for authenticating users, too. This way I got a central user management that is independent of DSM users, which is exactly what I wanted!\"));\n}\n;\nMDXContent.isMDXComponent = true;","slug":"/integrate-gitblit-with-ldap/","title":"Integrating GitBlit with Directory Server","tags":[],"keywords":[],"date":"July 12, 2016"},"previous":{"__typename":"MdxBlogPost","id":"85e8ac74-84c8-5557-a454-43b08deb85b4","excerpt":"It is when you start your weekend and notice that your certificates expired, that you start spending your free time on things you actually…","slug":"/enjoying-automatic-lets-encrypt-certificate-renewal/","title":"Enjoying automatic Let's Encrypt certificate renewal","date":"June 18, 2016"},"next":{"__typename":"MdxBlogPost","id":"904a26f2-0fb1-548c-be24-cbaca2b3ffbf","excerpt":"Recently I found myself looking on some base64 encoded values while debugging. I had an assumption about inputs and wanted to tell if the…","slug":"/quicktip-base64-in-the-shell/","title":"Quicktip: Working with base64 in the shell","date":"July 15, 2016"}},"pageContext":{"isCreatedByStatefulCreatePages":false,"id":"37b4d733-9fc3-52e9-b9ae-8a3c6dad7578","previousId":"85e8ac74-84c8-5557-a454-43b08deb85b4","nextId":"904a26f2-0fb1-548c-be24-cbaca2b3ffbf"}}}