init
commit
013d38899d
@ -0,0 +1,128 @@
|
|||||||
|
## Установка I, Librarian
|
||||||
|
|
||||||
|
Основан на [https://hub.docker.com/r/cgrima/i-librarian](https://hub.docker.com/r/cgrima/i-librarian)
|
||||||
|
Официальный сайт: [https://i-librarian.net](https://i-librarian.net)
|
||||||
|
|
||||||
|
#### Настройка LDAP `./configs/ilibrarian.ini`
|
||||||
|
|
||||||
|
```
|
||||||
|
ldap_active = "1"
|
||||||
|
ldap_server = "ldap://ldap.example.com:389"
|
||||||
|
ldap_use_tls = "0"
|
||||||
|
ldap_basedn = "dc=example,dc=com"
|
||||||
|
ldap_binduser_dn = "cn=ldapsearch,ou=users,dc=example,dc=com"
|
||||||
|
ldap_binduser_pw = "password"
|
||||||
|
ldap_username_attr = "cn"
|
||||||
|
ldap_userlogin_attr = "cn"
|
||||||
|
ldap_user_filter = "(objectClass=user)"
|
||||||
|
ldap_group_rdn = "ou=groups"
|
||||||
|
ldap_admingroup_cn = "cn=ilib_admins"
|
||||||
|
ldap_admingroup_dn = ""
|
||||||
|
ldap_usergroup_cn = ""
|
||||||
|
ldap_usergroup_dn = ""
|
||||||
|
ldap_admin_users = ""
|
||||||
|
ldap_filter = "member"
|
||||||
|
ldap_version = "3"
|
||||||
|
ldap_opt_referrals = "0"
|
||||||
|
ldap_debug_enabled = "0"
|
||||||
|
ldap_opt_debug_level = "7"
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
#### Запуск
|
||||||
|
```
|
||||||
|
git clone https://git.badms.ru/bms/ilib.git
|
||||||
|
cd ilib
|
||||||
|
# Предварительно отредактировать ./configs/ilibrarian.ini
|
||||||
|
docker compose up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
#### После запуска
|
||||||
|
Настроить `NPM` для доступа к `Authentik` по `HTTPS`.
|
||||||
|
Перейти по ссылке для первоначальной конфигруации: `https://auth.example.com/if/flow/initial-setup/`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Настройка Authentik
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Создать пользователей и группы
|
||||||
|
|
||||||
|
`Directory` > `Users` > `Create`
|
||||||
|
|
||||||
|
- ldapseach
|
||||||
|
|
||||||
|
`Directory` > `Groups` > `Create`
|
||||||
|
|
||||||
|
- ldapseach
|
||||||
|
- ilib_admins
|
||||||
|
- ilib_users
|
||||||
|
|
||||||
|
Добавить пользователя `ldapseach` в группу `ldapseach`
|
||||||
|
|
||||||
|
Пользователям добавить атрибуты:
|
||||||
|
|
||||||
|
```
|
||||||
|
mn: Отчество
|
||||||
|
sn: Фамилия
|
||||||
|
name: Имя
|
||||||
|
givenname: Имя
|
||||||
|
```
|
||||||
|
|
||||||
|
Добавить пользователей в группы `ilib_admins` и `ilib_users`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Создание провайдера
|
||||||
|
`Applications` > `Providers` > `Create` > `LDAP Provider`
|
||||||
|
|
||||||
|
**Name:** Provider for LDAP
|
||||||
|
**Bind flow:** default-authentication-flow (Welcome to authentik!)
|
||||||
|
**Search group:** ldapsearch
|
||||||
|
**Bind mode:** Direct binding
|
||||||
|
**Search mode:** Direct binding
|
||||||
|
**Code-based MFA Support:** V (?)
|
||||||
|
|
||||||
|
**Base DN:** DC=example,DC=com
|
||||||
|
**Certificate:** -
|
||||||
|
**TLS Server name:** -
|
||||||
|
**UID start number:** 2000
|
||||||
|
**GID start number:** 2000
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Создание приложения
|
||||||
|
`Applications` > `Applications` > `Create`
|
||||||
|
|
||||||
|
**Name:** LDAP
|
||||||
|
**Slug:** ldap
|
||||||
|
**Group:** ---
|
||||||
|
**Provider:** Provider for LDAP
|
||||||
|
**Backchannel Providers:** ---
|
||||||
|
**Policy engine mode:** any
|
||||||
|
|
||||||
|
**Launch URL:** ---
|
||||||
|
**Icon:** ---
|
||||||
|
**Publisher:** ---
|
||||||
|
**Description:** ---
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Создание Outpost
|
||||||
|
`Applications` > `Applications` > `Outpost`
|
||||||
|
|
||||||
|
**Name:** LDAP outpost
|
||||||
|
**Tyoe:** LDAP
|
||||||
|
**Integration:** ---
|
||||||
|
**Applications:** LDAP
|
||||||
|
|
||||||
|
|
||||||
|
### Добавление пользователей и групп
|
||||||
|
`Applications` > `Applications` > `LDAP`> `Policy/Group/User Bindings` > `Bind existing policy`
|
||||||
|
|
||||||
|
Добавить группы `ilib_admins` и `ilib_users`
|
||||||
|
Добавить пользователя `ldapseach`
|
||||||
@ -0,0 +1,119 @@
|
|||||||
|
;
|
||||||
|
; Password reset.
|
||||||
|
;
|
||||||
|
[reset_password]
|
||||||
|
|
||||||
|
; To enable password reset, change reset_password to 1. Don't
|
||||||
|
; forget to change the value back to O, after the password
|
||||||
|
; has been reset.
|
||||||
|
reset_password = "0"
|
||||||
|
|
||||||
|
;
|
||||||
|
; Error message level.
|
||||||
|
;
|
||||||
|
[error_messages]
|
||||||
|
|
||||||
|
; Set to "debug", for more information. IMPORTANT! Debug should be used
|
||||||
|
; exclusively during development, and never in production, as it reveals
|
||||||
|
; sensitive information.
|
||||||
|
level = ""
|
||||||
|
|
||||||
|
;
|
||||||
|
; Override php.ini session settings.
|
||||||
|
;
|
||||||
|
[session]
|
||||||
|
|
||||||
|
; If a TLS certificate is set up, set to "1" for increased security.
|
||||||
|
cookie_secure = "0"
|
||||||
|
|
||||||
|
;
|
||||||
|
; LDAP.
|
||||||
|
;
|
||||||
|
; Enter your LDAP server settings below. There are example settings for
|
||||||
|
; a free dummy LDAP server at:
|
||||||
|
;
|
||||||
|
; www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server
|
||||||
|
;
|
||||||
|
; Use einstein:password, euclid:password to test its functionality.
|
||||||
|
;
|
||||||
|
; LDAP access does not work from behind a proxy server.
|
||||||
|
;
|
||||||
|
[ldap]
|
||||||
|
|
||||||
|
; Activate login via LDAP. Caution: Disables local login.
|
||||||
|
ldap_active = "0"
|
||||||
|
|
||||||
|
; LDAP server protocol, hostname, and port, e.g. ldap(s)://hostname:port.
|
||||||
|
;ldap_server = "ldap://ldap.forumsys.com:389"
|
||||||
|
ldap_server = "ldap://ldap.example.com:389"
|
||||||
|
|
||||||
|
; If the protocol is ldap, a TLS-encrypted connection should be used. Set to 0,
|
||||||
|
; only if no TLS certificate is configured on your LDAP server.
|
||||||
|
ldap_use_tls = "0"
|
||||||
|
|
||||||
|
; Base distinguished name (DN).
|
||||||
|
;ldap_basedn = "dc=example,dc=com"
|
||||||
|
ldap_basedn = "dc=example,dc=com"
|
||||||
|
|
||||||
|
; Fully qualified bind user DN.
|
||||||
|
;ldap_binduser_dn = "cn=read-only-admin,dc=example,dc=com"
|
||||||
|
ldap_binduser_dn = "cn=ldapsearch,ou=users,dc=example,dc=com"
|
||||||
|
|
||||||
|
; Bind user password.
|
||||||
|
;ldap_binduser_pw = "password"
|
||||||
|
ldap_binduser_pw = "password"
|
||||||
|
|
||||||
|
; Attribute to use for username lookups.
|
||||||
|
ldap_username_attr = "cn"
|
||||||
|
|
||||||
|
; Attribute which is used to verify login/password pair.
|
||||||
|
;ldap_userlogin_attr = "sAMAccountName"
|
||||||
|
ldap_userlogin_attr = "cn"
|
||||||
|
|
||||||
|
; Custom LDAP Filter to additionally restrict the user search, and with (ldap_userlogin_attr = user)
|
||||||
|
; ldap_user_filter = "(|(objectClass=user)(objectClass=iNetOrgPerson))"
|
||||||
|
ldap_user_filter = "(objectClass=user)"
|
||||||
|
|
||||||
|
;
|
||||||
|
; Authorization. If the below options are provided, a group affiliation
|
||||||
|
; is checked (admins vs. users) and permissions are set accordingly.
|
||||||
|
; Otherwise, all LDAP users are given admin permissions.
|
||||||
|
;
|
||||||
|
|
||||||
|
; Group relative search base without basedn.
|
||||||
|
;ldap_group_rdn = "ou=groups"
|
||||||
|
ldap_group_rdn = "ou=groups"
|
||||||
|
|
||||||
|
; Admin group common name.
|
||||||
|
;ldap_admingroup_cn = "cn=admins"
|
||||||
|
ldap_admingroup_cn = "cn=ilib_admins"
|
||||||
|
|
||||||
|
; Admin group DN, if building CN with group_rdn and basedn is not possible.
|
||||||
|
ldap_admingroup_dn = ""
|
||||||
|
|
||||||
|
; User group common name. If only a specific user group can access I, Librarian.
|
||||||
|
;ldap_usergroup_cn = "cn=users"
|
||||||
|
ldap_usergroup_cn = ""
|
||||||
|
|
||||||
|
; Use user group DN, if building CN with group_rdn and basedn is not possible.
|
||||||
|
ldap_usergroup_dn = ""
|
||||||
|
|
||||||
|
; Optional admin users, comma separated list
|
||||||
|
ldap_admin_users = ""
|
||||||
|
|
||||||
|
; Group filter prefix.
|
||||||
|
; If you want to do recursive searches with LDAP servers that support it
|
||||||
|
; (e.g., MS Active Directory), use the correct matching rule.
|
||||||
|
;ldap_filter = 'member:1.2.840.113556.1.4.1941'
|
||||||
|
ldap_filter = "member"
|
||||||
|
|
||||||
|
; Change to match your ldap protocol version.
|
||||||
|
ldap_version = "3"
|
||||||
|
|
||||||
|
; Enable REFERRALS.
|
||||||
|
ldap_opt_referrals = "0"
|
||||||
|
|
||||||
|
; Enable and set debug level for LDAP authentication.
|
||||||
|
; Messages are logged into Apache Global Error Log.
|
||||||
|
ldap_debug_enabled = "0"
|
||||||
|
ldap_opt_debug_level = "7"
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
version: "2"
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
ilib:
|
||||||
|
image: cgrima/i-librarian:5.11.1
|
||||||
|
hostname: ilib
|
||||||
|
container_name: ilib
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "80:80"
|
||||||
|
volumes:
|
||||||
|
- ./data:/app/data
|
||||||
|
- ./configs:/app/config
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
Loading…
Reference in New Issue