Mealie with LLDAP

[cptnapalm]

Mealie supports LDAP and adding this to the docker-compose.yml file got it up and running for me:

Add below environment

LDAP

LDAP_AUTH_ENABLED: "true"
LDAP_SERVER_URL: "ldap://lldap.ip.address.here:3890/"
LDAP_BIND_TEMPLATE: "uid={},ou=people,dc=example,dc=com"

[nitnelave]

Thanks!

[nitnelave]

I'll add it to the config when I have a moment.

[Entheologian]

Hi,

I am trying to get this working too, (using ldaps) but it's not working for me so I was wondering if in addition to those three options, did you have to set some other LDAP options, ie, LDAP_USER_FILTER, LDAP_ADMIN_FILTER, BASE_DN..?

Thanks in advance.

[nitnelave]

Hi! What are you trying/what's the error?

[Entheologian]

oops, I mis-replied to this initially:

All I get is invalid Credentials when I enter my LDAP account credentials to login to mealie, and this in the logs:

mealie-api | 172.25.0.3:56856 - "POST /api/auth/token HTTP/1.1" 401

I tried what you posted, but I haven't had any luck with it yet. I also tried without ldaps (disabled SSL and used the non-SSL port).

[nitnelave]

You might want to check with LDAP_TLS_INSECURE if it's an issue with a self-signed certificate.

You might also be hitting mealie-recipes/mealie#1775

Lastly, you can start LLDAP in verbose mode so we can check the logs and see if the request makes sense.

[Entheologian]

I tried both for LDAP_TLS_INSECURE true/false and verbose I have enabled, but it doesn't seem to be hitting the lldap server, which is why I was wondering if it's my config or maybe some specific LDAP variables that needed to be set.

That issue #1775 sounds like it might be related though.

[martadinata666]

So despite success on LDAP query it still unautorizhed by mealie. So 🤷🏼

version: "3.7"
services:
  mealie-omni:
    image: hkotel/mealie:omni-nightly
    container_name: mealie
    ports:
      - "3000:3000"
      - "3001:9000"
    volumes:
      - ./data:/app/data/
    environment:
      - ALLOW_SIGNUP=false
      - API_URL=http://api-ip:3001
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Jakarta
      - BASE_URL=http://web-ip:3000
      - LDAP_AUTH_ENABLED=true
      - LDAP_SERVER_URL=ldaps://ip:port
      - LDAP_TLS_INSECURE=true
      - LDAP_QUERY_BIND=cn=readonly,ou=people,dc=example,dc=com
      - LDAP_QUERY_PASSWORD=readonlypassword
      - LDAP_BASE_DN=ou=people,dc=example,dc=com
      - LDAP_USER_FILTER=(memberOf=cn=the-grup-name,ou=groups,dc=example,dc=com)
    restart: always

LLDAP debug

lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.518833167+00:00  DEBUG    🐛 [debug]: decided upon suite TLS13_AES_256_GCM_SHA384 | log.target: "rustls::server::hs" | log.module_path: "rustls::server::hs" | log.file: "/builds/kDyxWbAy/1/dedyms/lldap/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rustls-0.20.8/src/server/hs.rs" | log.line: 382
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520613060+00:00  INFO     LDAP session [ 174ms | 0.09% / 100.00% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520747595+00:00  INFO     ┝━ LDAP request [ 82.0ms | 0.07% / 47.23% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520756053+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "cn=readonly,ou=people,dc=example,dc=com", cred: Simple("********") }), ctrl: [] }
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520757643+00:00  DEBUG    │  ┝━ do_bind [ 81.8ms | 0.01% / 47.15% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520759595+00:00  DEBUG    │  │  ┝━ 🐛 [debug]: DN: cn=readonly,ou=people,dc=example,dc=com
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520766114+00:00  DEBUG    │  │  ┝━ bind [ 81.7ms | 0.00% / 47.06% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520767336+00:00  DEBUG    │  │  │  ┝━ get_password_file_for_user [ 113µs | 0.06% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.520883430+00:00  DEBUG    │  │  │  ┕━ passwords_match [ 81.5ms | 46.99% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.602430984+00:00  DEBUG    │  │  ┝━ get_user_groups [ 147µs | 0.08% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.602436064+00:00  DEBUG    │  │  │  ┝━ 🐛 [debug]:  | user_id: UserId("readonly")
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.602889665+00:00  DEBUG    │  │  │  ┕━ 🐛 [debug]:  | return: {GroupDetails { group_id: GroupId(8), display_name: "lldap_strict_readonly", creation_date: 2022-07-08T18:07:17.348784118, uuid: Uuid("9f70cc27-7fa4-3f76-9126-d63f8b4cd03b") }, GroupDetails { group_id: GroupId(2), display_name: "lldap_password_manager", creation_date: 2022-07-03T05:15:33, uuid: Uuid("7df0de78-ce88-34c3-ba18-de84f44ffbf5") }}
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.602894034+00:00  DEBUG    │  │  ┕━ 🐛 [debug]: Success!
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.602898523+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None })
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603209091+00:00  INFO     ┝━ LDAP request [ 201µs | 0.04% / 0.12% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603217501+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 2, op: SearchRequest(LdapSearchRequest { base: "ou=people,dc=example,dc=com", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: And([Or([Equality("uid", "dummyuser"), Equality("mail", "dummyuser")])]), attrs: ["uid", "name", "mail"] }), ctrl: [] }
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603218651+00:00  DEBUG    │  ┝━ do_search [ 123µs | 0.01% / 0.07% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603224621+00:00  DEBUG    │  │  ┝━ 🐛 [debug]:  | request.base: "ou=people,dc=example,dc=com" | scope: Users
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603225453+00:00  DEBUG    │  │  ┝━ get_user_list [ 105µs | 0.01% / 0.06% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603227676+00:00  DEBUG    │  │  │  ┝━ 🐛 [debug]:  | ldap_filter: And([Or([Equality("uid", "dummyuser"), Equality("mail", "dummyuser")])])
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603232505+00:00  DEBUG    │  │  │  ┝━ 🐛 [debug]:  | filters: And([Or([UserId(UserId("dummyuser")), Equality(Email, "dummyuser")])])
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603234577+00:00  DEBUG    │  │  │  ┕━ list_users [ 92.0µs | 0.05% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603237039+00:00  DEBUG    │  │  │     ┝━ 🐛 [debug]:  | filters: Some(And([Or([UserId(UserId("dummyuser")), Equality(Email, "dummyuser")])]))
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603536203+00:00  DEBUG    │  │  │     ┕━ 🐛 [debug]:  | return: [UserAndGroups { user: User { user_id: UserId("dummyuser"), email: "dummyuser@example.com", display_name: None, first_name: None, last_name: None, avatar: Some(JpegPhoto([])), creation_date: 2023-03-21T11:50:11.264186752, uuid: Uuid("f7753897-7e85-3e4d-89da-87a0946772cb") }, groups: None }]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603539996+00:00  DEBUG    │  │  ┝━ expand_attribute_wildcards [ 3.96µs | 0.00% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603543618+00:00  DEBUG    │  │  │  ┕━ 🐛 [debug]:  | ldap_attributes: ["uid", "name", "mail"] | resolved_attributes: ["uid", "name", "mail"]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603547141+00:00  WARN     │  │  ┕━ 🚧 [warn]: Ignoring unrecognized group attribute: name\n\
lldap_app.1.xbnks6lcy5vr@homelab    |                       To disable this warning, add it to "ignored_user_attributes" in the config.
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603554529+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | response: SearchResultEntry(LdapSearchResultEntry { dn: "uid=dummyuser,ou=people,dc=example,dc=com", attributes: [LdapPartialAttribute { atype: "uid", vals: [[100, 117, 109, 109, 121, 117, 115, 101, 114]] }, LdapPartialAttribute { atype: "mail", vals: [[100, 117, 109, 109, 121, 117, 115, 101, 114, 64, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109]] }] })
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.603608854+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] })
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644742827+00:00  INFO     ┝━ LDAP request [ 91.2ms | 0.08% / 52.56% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644760806+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 3, op: BindRequest(LdapBindRequest { dn: "uid=dummyuser,ou=people,dc=example,dc=com", cred: Simple("********") }), ctrl: [] }
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644766078+00:00  DEBUG    │  ┝━ do_bind [ 91.1ms | 0.02% / 52.48% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644770713+00:00  DEBUG    │  │  ┝━ 🐛 [debug]: DN: uid=dummyuser,ou=people,dc=example,dc=com
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644789749+00:00  DEBUG    │  │  ┝━ bind [ 90.9ms | 0.01% / 52.37% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.644792372+00:00  DEBUG    │  │  │  ┝━ get_password_file_for_user [ 108µs | 0.06% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.645144043+00:00  DEBUG    │  │  │  ┕━ passwords_match [ 90.8ms | 52.30% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.735908595+00:00  DEBUG    │  │  ┝━ get_user_groups [ 144µs | 0.08% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.735913681+00:00  DEBUG    │  │  │  ┝━ 🐛 [debug]:  | user_id: UserId("dummyuser")
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.736318427+00:00  DEBUG    │  │  │  ┕━ 🐛 [debug]:  | return: {GroupDetails { group_id: GroupId(15), display_name: "lldap_mealie", creation_date: 2023-04-02T07:38:00.092163755, uuid: Uuid("6c2cd0a6-ce77-3908-a599-b2ceb6886103") }}
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.736323252+00:00  DEBUG    │  │  ┕━ 🐛 [debug]: Success!
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.736327634+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None })
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.738865822+00:00  INFO     ┕━ LDAP request [ 9.10µs | 0.01% ]
lldap_app.1.xbnks6lcy5vr@homelab    | 2023-04-02T08:43:26.738872903+00:00  DEBUG       ┕━ 🐛 [debug]:  | msg: LdapMsg { msgid: 4, op: UnbindRequest, ctrl: [] }

The original post refer to old version of mealie, or stable version as currently still beta? The caveat is everyone can login

---
version: "3.7"
services:
  mealie-omni:
    image: hkotel/mealie:v0.5.6
    container_name: mealie
    ports:
      - "3000:80"
    volumes:
      - ./data:/app/data/
    environment:
      - PUID=1000
      - PGID=1000
      - LDAP_AUTH_ENABLED=true
      - LDAP_SERVER_URL=ldap://192.168.0.2:3890
      - LDAP_BIND_TEMPLATE=uid={},ou=people,dc=example,dc=com
    restart: always

[Entheologian]

Do you mean you were able to get it to work with one of those two configs?

[martadinata666]

only v0.5.6 work, but no filter, etc. As long as the user exist it will get in. The newer image that had many additional config can connect to lldap, lldap throw success login match, but mealie bug itself prevent it login mealie-recipes/mealie#1775 (attached previously), so only v0.5.6 work with lldap

[Entheologian]

Ahh, I see. Thanks very much for your time and help.

[nomandera]

There are several mentions of LDAP_BIND_TEMPLATE here and working examples using this ENV but according to the backend config reference this ENV does not exist.

Is this documented anywhere as I am having a trouble getting this to operate with the examples above

[Entheologian]

I don't know what has changed since, but here's a snippet example of what I have now and is working for me, so hopefully this might help you out:

      - LDAP_AUTH_ENABLED=true
      - LDAP_SERVER_URL=ldaps://192.168.0.10:636                                                                                            
      - LDAP_TLS_INSECURE=true
      - LDAP_BASE_DN=ou=people,dc=mydomain,dc=net
      - LDAP_QUERY_BIND=uid=admin,ou=people,dc=mydomain,dc=net
      - LDAP_QUERY_PASSWORD=asecretpassword
      - LDAP_ID_ATTRIBUTE=uid
      - LDAP_NAME_ATTRIBUTE=cn
      - LDAP_MAIL_ATTRIBUTE=mail
      - LDAP_ADMIN_FILTER=memberOf=cn=mealie_admin,ou=groups,dc=mydomain,dc=net

[nomandera]

Thanks a known definitively working example helps me a lot.

I am currently attempting without TLS and using a readonly user which is not working so I will port to your setup and trace back where it breaks.

My intention is to PR this when done.

[nomandera]

https://github.com/lldap/lldap/blob/main/example_configs/mealie.md

not my work but tested and working great