{"id":29127666,"url":"https://github.com/bytewavemlp/drawpile-ldap-auth-server","last_synced_at":"2026-04-17T05:03:35.346Z","repository":{"id":39757011,"uuid":"266894638","full_name":"BytewaveMLP/drawpile-ldap-auth-server","owner":"BytewaveMLP","description":"A Drawpile-compatible auth server backed by LDAP","archived":false,"fork":false,"pushed_at":"2023-01-10T22:21:48.000Z","size":455,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-05-01T14:57:18.253Z","etag":null,"topics":["auth","authentication","docker","docker-compose","dockerized","drawing","drawing-app","drawpile","ldap","ldap-authentication"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BytewaveMLP.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-25T22:45:28.000Z","updated_at":"2023-11-06T21:55:18.000Z","dependencies_parsed_at":"2023-02-08T20:31:12.486Z","dependency_job_id":null,"html_url":"https://github.com/BytewaveMLP/drawpile-ldap-auth-server","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/BytewaveMLP/drawpile-ldap-auth-server","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BytewaveMLP%2Fdrawpile-ldap-auth-server","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BytewaveMLP%2Fdrawpile-ldap-auth-server/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BytewaveMLP%2Fdrawpile-ldap-auth-server/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BytewaveMLP%2Fdrawpile-ldap-auth-server/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BytewaveMLP","download_url":"https://codeload.github.com/BytewaveMLP/drawpile-ldap-auth-server/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BytewaveMLP%2Fdrawpile-ldap-auth-server/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262690387,"owners_count":23349167,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auth","authentication","docker","docker-compose","dockerized","drawing","drawing-app","drawpile","ldap","ldap-authentication"],"created_at":"2025-06-30T01:01:35.698Z","updated_at":"2026-04-17T05:03:35.317Z","avatar_url":"https://github.com/BytewaveMLP.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# drawpile-ldap-auth-server\n\n[![Docker Pulls](https://img.shields.io/docker/pulls/bytewave81/drawpile-ldap-auth-server)][docker-hub-repo]\n[![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/bytewave81/drawpile-ldap-auth-server)][docker-hub-repo]\n\n\u003e A Drawpile-compatible auth server backed by LDAP\n\n## Table of Contents\n\n- [Install](#install)\n  - [Prerequisites](#prerequisites)\n  - [Docker](#docker)\n  - [Manual](#manual)\n- [Usage](#usage)\n  - [Configuring Drawpile](#configuring-drawpile)\n  - [Configuring the auth server](#configuring-the-auth-server)\n    - [Generating a token keypair](#generating-a-token-keypair)\n- [Maintainers](#maintainers)\n- [Contribute](#contribute)\n- [License](#license)\n\n## Install\n\n### Prerequisites\n\n- Node.js v12 or greater\n- An LDAP server\n- A Drawpile server configured for external authentication\n\n### Docker\n\nSee [`docker-compose.yml`](/docker-compose.yml) for an example Compose file. Alternatively, you may want to use `docker run`:\n\n```shell\n$ cp config.example.toml config.toml\n$ $EDITOR config.toml # see README.md \"Configuring the auth server\" for details\n$ docker run -d --rm \\\n    -p 8081:8081 \\\n    -v path/to/config.toml:/usr/src/app/config.toml:ro \\\n    bytewave81/drawpile-ldap-auth-server\n```\n\n### Manual\n\nYou don't want to use my shiny Docker setup? But I worked so hard on it!\n\n```shell\n$ git clone https://github.com/BytewaveMLP/drawpile-ldap-auth-server.git\n$ cd drawpile-ldap-auth-server\n$ yarn install\n$ yarn build\n$ cp config.example.toml config.toml\n$ $EDITOR config.toml # see README.md \"Configuring the auth server\" for details\n$ node .\n```\n\n## Usage\n\n### Configuring Drawpile\n\nIn order to make use of this, you need to configure Drawpile to look for your external auth server. Note that both Drawpile and clients will need access to the auth server, so drawpile-ldap-auth-server *must* be internet-facing. I recommend putting this behind nginx in order to allow secure communications between clients and the server.\n\nTo configure Drawpile to direct clients to this auth server, add the following entries to the `[config]` section of your Drawpile instance:\n\n```ini\n; enable extauth and direct users to the auth server\nextauth = true\n; PUBLIC key for token signing, see \"Generating a token keypair\"\nextauthkey = \"\"\n; users must be in this LDAP group in order to user the instance (optional)\nextauthgroup = user\n; should Drawpile fall back to the internal user database if the auth server is unreachable?\nextauthfallback = false\n; drawpile-ldap-auth-server can pull moderator status from LDAP groups; set this to true if\n; you'd like to enable that\n; Drawpile flag: MOD\nextauthmod = true\n; drawpile-ldap-auth-server can also allow users to host sessions based on LDAP group membership;\n; set this to true if you'd like that as well\n; Drawpile flag: HOST\nextauthhost = true\n; drawpile-ldap-auth-server may additionally retrieve user avatars from LDAP; set this to true\n; if you want Drawpile to request user avatars upon authentication\n; You must also configure ldap.imageAttribute in your drawpile-ldap-auth-server configuration\nextAuthAvatars = true\n; should guests be allowed to access Drawpile?\n; this setting must match the setting in config.toml for drawpile-ldap-auth-server\nallowGuests = false\n; should all users be allowed to host sessions?\n; if allowGuests is false but this is true, *any* authenticated user will be allowed to host sessions\n; regardless if they have the HOST flag\nallowGuestHosts = false\n```\n\nAdditionally, you need to pass the `--extauth` parameter to `drawpile-srv` which points to the **public-facing** URL for your drawpile-ldap-auth-server instance.\n\n### Configuring the auth server\n\nFirst, copy `config.example.toml` to `config.toml`. Then, open it in your favorite editor. Each config option is explained rather clearly in the config comments.\n\nFor more details on TOML syntax, see [the README](https://github.com/toml-lang/toml#user-content-example).\n\nIf you would prefer, you may set configuration options through environment variables/command-line arguments rather than through the config file. Each config option has a corresponding environment variable/argument which will override the value listed in the config if set. Note that `ldap.flagGroups` does *not* have an associated environment variable mapping; this is the only value which *must* be set in `config.tmol`.\n\nAdditionally, there are two environment-only configuration options relating to logging. These are:\n\n- `LOG_LEVEL`\n\n  The [Winston log level](https://github.com/winstonjs/winston#logging-levels) to use. By default, this is `info` if `NODE_ENV` is `production`, and `debug` otherwise. It's probably best to leave this as the default; setting this to anything below `debug` may expose sensitive information in your logs, and should only be used for debugging.\n\n- `NODE_ENV`\n\n  The environment this instance is running under. By default, this is assumed to be `development`, in which case debug-level logging output is enabled (unless overridden via `LOG_LEVEL`). Set this to `production` in an actual deployment (the Docker image does this for you).\n\n#### Generating a token keypair\n\nDrawpile uses libsodium to handle token verification, which expects a \"raw\" format Ed25519 public key (ie, no container format). However, OpenSSL (and therefore Node) operate on containerized keys using DER and PEM formats. As such, you will need to generate your keypair in a very specific manner.\n\n```shell\n# generate private key; this goes in config.toml or in your environment as DRAWPILE_AUTH_TOKEN_SIGNING_KEY\n$ PRIVKEY=\"$(openssl genpkey -algorithm ed25519 -outform DER | openssl base64)\"; echo $PRIVKEY\n# generate public key; this goes in your Drawpile config.ini\n$ echo \"$PRIVKEY\" | openssl base64 -d | openssl pkey -inform DER -outform DER -pubout | tail -c +13 | openssl base64\n```\n\n## Maintainers\n\n- [Eliot Partridge](https://github.com/BytewaveMLP)\n\n## Contribute\n\nPRs, feature suggestions, and bug reports welcome.\n\n## License\n\nCopyright (c) Eliot Partridge, 2020. Licensed under [the MIT License](/LICENSE).\n\n[docker-hub-repo]: https://hub.docker.com/r/bytewave81/drawpile-ldap-auth-server\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbytewavemlp%2Fdrawpile-ldap-auth-server","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbytewavemlp%2Fdrawpile-ldap-auth-server","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbytewavemlp%2Fdrawpile-ldap-auth-server/lists"}