Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.
Added
LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
Support for configuring the healthcheck listen addresses
Usernames are now included in password recovery emails
Changed
JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
Migrated to rustls 0.23 and centralized TLS handling
The login form no longer enforces a password length limit
Fixed
pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
LDAP base-scope searches for non-existent entries now return NoSuchObject
cn equality filters are now case insensitive
The server now shuts down the database connection pool gracefully
The bootstrap script now handles empty globs correctly
Security
Updated the LDAP dependency stack, including ldap3_proto, in response to
security advisory GHSA-qcxq-75wr-5cm8,
where a specially crafted LDAP query could make the server crash
Cleanups
Split GraphQL queries and mutations into smaller modules
Refactored configuration and user update logic
Upgraded the Rust toolchain and shared dependencies
Long-awaited release, with the flagship feature of custom attributes! This unlock many integrations, notably Linux user management through PAM.
Thanks to all the contributors who sent some code, some configuration guide, reported a bug or otherwise helped the project!
Breaking
The endpoint /auth/reset/step1 is now POST instead of GET (#704)
Added
Custom attributes are now supported (#67) ! You can add new fields (string, integers, JPEG or dates) to users and query them. That unlocks many integrations with other services, and allows for a deeper/more customized integration. Special thanks to @pixelrazor and @bojidar-bg for their help with the UI.
Custom object classes (for all users/groups) can now be added (#833)
Barebones support for Paged Results Control (no paging, no respect for windows, but a correct response with all the results) (#698)
A daily docker image is tagged and released. (#613)
A bootstrap script allows reading the list of users/groups from a file and making sure the server contains exactly the same thing. (#654)
Make it possible to serve lldap behind a sub-path in (#752)
LLDAP can now be found on a custom package repository for opensuse, fedora, ubuntu, debian and centos (Repository link). Thanks @Masgalor for setting it up and maintaining it.
There's now an option to force reset the admin password (#748) optionally on every restart (#959)
Added a way to print raw logs to debug long-running sessions (#992)
Changed
The official docker repository is now lldap/lldap
Removed password length limitation in lldap_set_password tool
Group names and emails are now case insensitive, but keep their casing (#666)
Better error messages (and exit code (#745)) when changing the private key (#778, #1008), using the wrong SMTP port (#970), using the wrong env variables (#972)
Allow member= filters with plain user names (not full DNs) (#949)
Correctly detect and refuse anonymous binds (#974)
If you have several users with the same email, you'll have to disambiguate
them. You can do that by either issuing SQL commands directly
(UPDATE users SET email = 'x@x' WHERE user_id = 'bob';), or by reverting
to a 0.4.x version of LLDAP and editing the user through the web UI.
An error will prevent LLDAP 0.5+ from starting otherwise.
This was done to prevent account takeover for systems that allow to
login via email.
Added
The server private key can be set as a seed from an env variable (#504).
This is especially useful when you have multiple containers, they don't
need to share a writeable folder.
Added support for changing the password through a plain LDAP Modify
operation (as opposed to an extended operation), to allow Jellyfin
to change password (#620).
Allow creating a user with multiple objectClass (#612).
Default admin user is only created if there are no admins (#563).
That allows you to remove the default admin, making it harder to
bruteforce.
Fixed
Fixed URL parsing with a trailing slash in the password setting utility
(#597).
New services
Ejabberd
Ergo
LibreNMS
Mealie
MinIO
OpnSense
PfSense
PowerDnsAdmin
Proxmox
Squid
Tandoor recipes
TheLounge
Zabbix-web
Zulip
In addition to all that, there was significant progress towards #67,
user-defined attributes. That complex feature will unblock integration with many
systems, including PAM authentication.
The repository has changed from nitnelave/lldap to lldap/lldap, both on GitHub
and on DockerHub (although we will keep publishing the images to nitnelave/lldap for the foreseeable future). All data on GitHub has been
migrated, and the new docker images are available both on DockerHub and on the
GHCR under lldap/lldap.
Added
EC private keys are not supported for LDAPS.
Changed
SMTP user no longer has a default value (and instead defaults to unauthenticated).
Fixed
WASM payload is now delivered uncompressed to Safari due to a Safari bug.
Password reset no longer redirects to login page.
NextCloud config should add the "mail" attribute.
GraphQL parameters are now urldecoded, to support special characters in usernames.
Healthcheck correctly checks the server certificate.
Quick update to replace lldap_readonly with 2 groups lldap_password_manager and lldap_strict_readonly.
Breaking
The lldap_readonly group has been renamed lldap_password_manager (migration happens automatically) and a new lldap_strict_readonly group was introduced.
Added
A new lldap_strict_readonly group allows granting readonly rights to users (not able to change other's passwords, in particular).
Changed
The lldap_readonly group is renamed lldap_password_manager since it still allows users to change (non-admin) passwords.
This new release brings LLDAP to a stable point where it should be compatible with most services and can be safely used as main source of truth for managing users!
Thanks to all the new contributors who helped make this release and continue to improve LLDAP 🎆
Breaking
As part of the update, the database will do a one-time automatic migration to
add UUIDs and group creation times.
Added
Added support and documentation for many services:
Apache Guacamole
Bookstack
Calibre
Dolibarr
Emby
Gitea
Grafana
Jellyfin
Matrix Synapse
NextCloud
Organizr
Portainer
Seafile
Syncthing
WG Portal
New migration tool from OpenLDAP.
New docker images for alternate architectures (arm64, arm/v7).
Added support for LDAPS.
New readonly group.
Added UUID attribute for users and groups.
Frontend now uses the refresh tokens to reduce the number of logins needed.
Changed
Much improved logging format.
Simplified API login.
Allowed non-admins to run search queries on the content they can see.
"cn" attribute now returns the Full Name, not Username.
Unknown attributes now warn instead of erroring.
Introduced a list of attributes to silence those warnings.
Deprecated
Deprecated "cn" as LDAP username, "uid" is the correct attribute.
Fixed
Usernames, objectclass and attribute names are now case insensitive.
Handle "1.1" and other wildcard LDAP attributes.
Handle "memberOf" attribute.
Handle fully-specified scope.
Security
Prevent SQL injections due to interaction between two libraries.
New Contributors
Thanks to all contributors, old and new. A special welcome to these new contributors:
Log in
