mirror of https://github.com/docker/docs.git
move info about local users to note at the top (#1497)
* move info about local users to note at the top To prevent users from configuring LDAP and *then* realizing their local users are deleted, it should also be stated at the beginning that a recovery admin should be created and that all the local users are deleted. * Improve LDAP disclaimer
This commit is contained in:
Tammy Fox
Joao Fernandes
parent
76754d2502
commit
efbc943514
|
|
@ -8,6 +8,11 @@ title: Integrate with LDAP
|
|||
Docker UCP integrates with LDAP services, so that you can manage users from a
|
||||
single place.
|
||||
|
||||
When you switch from built-in authentication to LDAP authentication,
|
||||
all manually created users whose usernames do not match any LDAP search results
|
||||
become inactive with the exception of the recovery admin user which can still
|
||||
login with the recovery admin password.
|
||||
|
||||
## Configure the LDAP integration
|
||||
|
||||
To configure UCP to authenticate users using an LDAP service, go to
|
||||
|
|
@ -89,5 +94,3 @@ You can also manually synchronize users by clicking the **Sync Now** button.
|
|||
|
||||
When a user is removed from LDAP, that user becomes inactive after the LDAP
|
||||
synchronization runs.
|
||||
Also, when you switch from the built-in authentication to using LDAP
|
||||
authentication, all manually created users become inactive.
|
||||
|
|
|
|||
|
|
@ -9,6 +9,11 @@ Docker UCP integrates with LDAP directory services, so that you can manage
|
|||
users and groups from your organization's directory and it will automatically
|
||||
propagate that information to UCP and DTR.
|
||||
|
||||
When you switch from built-in authentication to LDAP authentication,
|
||||
all manually created users whose usernames do not match any LDAP search results
|
||||
become inactive with the exception of the recovery admin user which can still
|
||||
login with the recovery admin password.
|
||||
|
||||
## Configure the LDAP integration
|
||||
|
||||
To configure UCP to create and authenticate users using an LDAP directory,
|
||||
|
|
@ -22,14 +27,14 @@ Then configure your LDAP directory integration.
|
|||
**Authentication**
|
||||
|
||||
| Field | Description |
|
||||
|:-------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
|:-------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Method | The method used to create and authenticate users. The *LDAP* method uses a remote directory server to automatically create users and all logins will be forwarded to the directory server. |
|
||||
| Default permission for newly discovered accounts | The permission level assigned by default to a new user. [Learn more about default permission levels](../../manage-users/permission-levels.md). |
|
||||
|
||||
**LDAP server configuration**
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
|:------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| LDAP server URL | The URL where the LDAP server can be reached. |
|
||||
| Recovery admin username | The username for a recovery user that can access UCP even when the integration with LDAP is misconfigured or the LDAP server is offline. |
|
||||
| Recovery admin password | The password for the recovery user which is securely salted and hashed and stored in UCP. The recovery admin user can use this password to login if the LDAP server is misconfigured or offline. |
|
||||
|
|
@ -39,14 +44,14 @@ Then configure your LDAP directory integration.
|
|||
**LDAP security options**
|
||||
|
||||
| Field | Description |
|
||||
|:----------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
|:----------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Skip verification of server certificate | Whether to verify the LDAP server certificate when using TLS. The connection is still encrypted, but vulnerable to man-in-the-middle attacks. |
|
||||
| Use StartTLS | Whether to authenticate/encrypt the connection after connecting to the LDAP server over TCP. If you set the LDAP Server URL field with `ldaps://`, this field is ignored. |
|
||||
|
||||
**User search configurations**
|
||||
|
||||
| Field | Description |
|
||||
|:------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------|
|
||||
|:------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Base DN | The distinguished name of the node in the directory tree where the search should start looking for users. |
|
||||
| Username attribute | The LDAP attribute to use as username on UCP. Only user entries with a valid username will be created. A valid username is no longer than 100 characters and does not contain any unprintable characters, whitespace characters, or any of the following characters: `/` `\` `[` `]` `:` `;` `|` `=` `,` `+` `*` `?` `<` `>` `'` `"`. |
|
||||
| Full name attribute | The LDAP attribute to use as the user's full name for display purposes. If left empty, UCP will not create new users with a full name value. |
|
||||
|
|
@ -68,7 +73,7 @@ configurations will be synced as a user.
|
|||
**Advanced LDAP configuration**
|
||||
|
||||
| Field | Description |
|
||||
|:---------------------------|:----------------------------------------------------|
|
||||
|:---------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| No simple pagination | If your LDAP server doesn't support pagination. |
|
||||
| Enable sync of admin users | Whether to import LDAP users as UCP administrators. |
|
||||
| LDAP Match Method | If admin user sync is enabled, this option specifies whether to match admin user entries using a search query or by selecting them as members from a group. For the expanded options, refer to the options described below. |
|
||||
|
|
@ -109,7 +114,7 @@ remain a system admin.
|
|||
**Test LDAP connection**
|
||||
|
||||
| Field | Description |
|
||||
|:---------|:-------------------------------------------------------------------------|
|
||||
|:---------|:-----------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Username | The username with which the user will login to this application. This value should correspond to the Username Attribute specified in the form above. |
|
||||
| Password | The user's password used to authenticate (BIND) to the directory server. |
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue