{"id":29859309,"url":"https://github.com/gocd/gocd-ldap-authentication-plugin","last_synced_at":"2025-07-30T02:12:51.008Z","repository":{"id":14428700,"uuid":"75817504","full_name":"gocd/gocd-ldap-authentication-plugin","owner":"gocd","description":"LDAP authentication plugin for GoCD","archived":false,"fork":false,"pushed_at":"2025-07-17T00:45:39.000Z","size":1155,"stargazers_count":7,"open_issues_count":10,"forks_count":14,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-07-17T07:29:41.471Z","etag":null,"topics":["authentication","gocd","ldap","plugin"],"latest_commit_sha":null,"homepage":"https://www.gocd.org","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gocd.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2016-12-07T08:53:02.000Z","updated_at":"2025-07-17T00:41:20.000Z","dependencies_parsed_at":"2023-12-08T05:23:20.876Z","dependency_job_id":"69ae9628-9e19-4369-be84-96e2b3d3ef0c","html_url":"https://github.com/gocd/gocd-ldap-authentication-plugin","commit_stats":null,"previous_names":[],"tags_count":236,"template":false,"template_full_name":null,"purl":"pkg:github/gocd/gocd-ldap-authentication-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gocd%2Fgocd-ldap-authentication-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gocd%2Fgocd-ldap-authentication-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gocd%2Fgocd-ldap-authentication-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gocd%2Fgocd-ldap-authentication-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gocd","download_url":"https://codeload.github.com/gocd/gocd-ldap-authentication-plugin/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gocd%2Fgocd-ldap-authentication-plugin/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267797763,"owners_count":24145710,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-30T02:00:09.044Z","response_time":70,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","gocd","ldap","plugin"],"created_at":"2025-07-30T02:12:50.344Z","updated_at":"2025-07-30T02:12:50.999Z","avatar_url":"https://github.com/gocd.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GoCD LDAP/AD Authentication Plugin\n\nLDAP plugin which implements the GoCD [Authorization Plugin](https://plugin-api.gocd.io/current/authorization/) endpoint.\n\n## Building the code base\n\nTo build the jar, run `./gradlew clean test assemble`\n\n## Requirements\n\nThese plugins require GoCD version v17.5 or above.\n\n## Installation\n\n- From GoCD `17.5.0` onwards the plugin comes bundled along with server, hence a separate installation is not required.\n\n## Ldap Client\nThe plugin uses JNDI and ApacheDs ldap client for the authentication. Defaults to `ApacheDs client`. In order to use JNDI\nclient use system property `use.jndi.ldap.client=true` while starting the GoCD server.\n\n## Configuration\n\nThe plugin requires necessary configurations to connect to LDAP/AD. The configuration can be added by adding a Authorization Configuration by visting the Authorization Configuration page under *Admin \u003e Security*.\n\nAlternatively, the configuration can be added directly to the `config.xml` using the `\u003cauthConfig\u003e` configuration.\n  \n* Example Configuration\n \n   ```xml\n    \u003csecurity\u003e\n      \u003cauthConfigs\u003e\n        \u003cauthConfig id=\"profile-id\" pluginId=\"cd.go.authentication.ldap\"\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eUrl\u003c/key\u003e\n            \u003cvalue\u003eldap://ldap-server-url\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eManagerDN\u003c/key\u003e\n            \u003cvalue\u003ecn=go,ou=Teams,dc=corporate,dc=example,dc=com\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003ePassword\u003c/key\u003e\n            \u003cvalue\u003esecret\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eSearchBases\u003c/key\u003e\n            \u003cvalue\u003eou=Teams,dc=corporate,dc=example,dc=com\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eUserLoginFilter\u003c/key\u003e\n            \u003cvalue\u003e(sAMAccountName={0})\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eUserSearchFilter\u003c/key\u003e\n            \u003cvalue\u003e(|(sAMAccountName=*{0}*)(uid=*{0}*)(cn=*{0}*)(mail=*{0}*)(otherMailbox=*{0}*))\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eDisplayNameAttribute\u003c/key\u003e\n            \u003cvalue\u003edisplayName\u003c/value\u003e\n          \u003c/property\u003e\n          \u003cproperty\u003e\n            \u003ckey\u003eEmailAttribute\u003c/key\u003e\n            \u003cvalue\u003email\u003c/value\u003e\n          \u003c/property\u003e\n        \u003c/authConfig\u003e\n      \u003c/authConfigs\u003e\n    \u003c/security\u003e\n    ```\n\n* **Url (Mandatory) :** Specify your ldap server URL. The plugin does not [support](https://github.com/gocd/gocd-ldap-authentication-plugin/issues/24) configuring certificates for connecting to LDAP server over SSL, a workaround for this issue involves importing the certificates directly into java's cacerts.\n\n\n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eUrl\u003c/key\u003e\n       \u003cvalue\u003eldap://ldap-server-url:1234\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n\nif you are trying to configure ldaps then use the url as:\n\n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eUrl\u003c/key\u003e\n       \u003cvalue\u003eldaps://ldap-server-url:1234\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n\n* **ManagerDN (Optional):**  The LDAP/AD manager user's DN, used to connect to the LDAP/AD server.\n \n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eManagerDN\u003c/key\u003e\n       \u003cvalue\u003euid=admin,ou=system,dc=example,dc=com\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n\n* **Password (Mandatory if `ManagerDN` provided):** The LDAP/AD manager password, used to connect to the LDAP/AD server. Required only if a ManagerDN is specified.\n\n* **SearchBases (Mandatory):** This field defines the location in the directory from which the LDAP search begins.\nYou can provide multiple search bases. If multiple search bases are configured the plugin would look for the user in each search base sequentially until the user is found.\n\n    \u003e Single search base: \n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eSearchBases\u003c/key\u003e\n       \u003cvalue\u003eou=users,ou=system\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n    \n    \u003e Multiple search base\n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eSearchBases\u003c/key\u003e\n       \u003cvalue\u003e\n        ou=users,ou=system\n        ou=employee,ou=system\n        \u003c/value\u003e\n    \u003c/property\u003e\n    ```\n* **UserLoginFilter (Mandatory):** It is an LDAP search filter used during authentication to lookup for a user entry matching the given expression.\n\n    In the following example the filter would search for a username matching the ```sAMAccountName``` attribute.\n    \n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eUserLoginFilter\u003c/key\u003e\n       \u003cvalue\u003e(sAMAccountName={0})\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n    \n* **UserSearchFilter (Optional):** It is an LDAP search filter used to lookup for users matching a given search term.\nThis is an optional configuration, the default filter used is ```(|(sAMAccountName=*{0}*)(uid=*{0}*)(cn=*{0}*)(mail=*{0}*)(otherMailbox=*{0}*))```.\n\n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eUserSearchFilter\u003c/key\u003e\n       \u003cvalue\u003e(|(sAMAccountName=*{0}*)(uid=*{0}*))\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n  \n* **DisplayNameAttribute (Optional):** Value of this attribute is mapped to GoCD User displayname, default attribute used is ```cn```.\n\n    ```xml\n    \u003cproperty\u003e\n       \u003ckey\u003eDisplayNameAttribute\u003c/key\u003e\n       \u003cvalue\u003edisplayName\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n\n* **EmailAttribute (Optional):** Value of this attribute is mapped to GoCD User mail, default value used is ```mail```.\n \n   ```xml\n    \u003cproperty\u003e\n        \u003ckey\u003eEmailAttribute\u003c/key\u003e\n        \u003cvalue\u003email\u003c/value\u003e\n    \u003c/property\u003e\n    ```\n\n*Note: The plugin allows having multiple configurations to connect to different LDAP/AD servers*\n\n```xml\n\u003cauthConfig id=\"second-profile-id\" pluginId=\"cd.go.authentication.ldap\"\u003e\n...\n\u003c/authConfig\u003e\n```\n\n## Troubleshooting\n\n### Verify Connection\n\nFor a given Authorization Configuration verify if the plugin can connect to the LDAP/AD server. The Authorization Configuration page under *Admin \u003e Security* gives an option to verify connection.\n\n### Enable Debug Logs\n\n#### If you are on GoCD version 19.6 and above:\n\nEdit the file `wrapper-properties.conf` on your GoCD server and add the following options. The location of the `wrapper-properties.conf` can be found in the [installation documentation](https://docs.gocd.org/current/installation/installing_go_server.html) of the GoCD server.\n\n```properties\n# We recommend that you begin with the index `100` and increment the index for each system property\nwrapper.java.additional.105=-Dplugin.cd.go.authentication.ldap.log.level=debug\n```\n\nFor this to work it's extremely important that there are no other entries with the same index number for `wrapper.java.additional`. E.g. with the docker version in the docker-entrypoint.sh is a line that adds an item for `wrapper.java.additional.100` but _only_ after boot time.\n\nIf you're running with GoCD server 19.6 and above on docker using one of the supported GoCD server images, set the environment variable `GOCD_SERVER_JVM_OPTIONS`:\n\n```shell\ndocker run -e \"GOCD_SERVER_JVM_OPTIONS=-Dplugin.cd.go.authentication.ldap.log.level=debug\" ...\n```\n\n#### If you are on GoCD version 19.5 and lower:\n\n* On Linux:\n\n    Enabling debug level logging can help you troubleshoot an issue with this plugin. To enable debug level logs, edit the file `/etc/default/go-server` (for Linux) to add:\n\n    ```shell\n    export GO_SERVER_SYSTEM_PROPERTIES=\"$GO_SERVER_SYSTEM_PROPERTIES -Dplugin.cd.go.authentication.ldap.log.level=debug\"\n    ```\n\n    If you're running the server via `./server.sh` script:\n\n    ```shell\n    $ GO_SERVER_SYSTEM_PROPERTIES=\"-Dplugin.cd.go.authentication.ldap.log.level=debug\" ./server.sh\n    ```\n\n* On windows:\n\n    Edit the file `config/wrapper-properties.conf` inside the GoCD Server installation directory (typically `C:\\Program Files\\Go Server`):\n\n    ```\n    # config/wrapper-properties.conf\n    # since the last \"wrapper.java.additional\" index is 15, we use the next available index.\n    wrapper.java.additional.16=-Dplugin.cd.go.authentication.ldap.log.level=debug\n    ```\n### Known issues while upgrading to Plugin version 2.0.1-90\n\n  * A must change would be to now specify a fully qualified ManagerDN instead of just username.\n  * The user search base specified should return unique result for the given username.\n\n\n## License\n\n```plain\nCopyright 2022 Thoughtworks, Inc.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgocd%2Fgocd-ldap-authentication-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgocd%2Fgocd-ldap-authentication-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgocd%2Fgocd-ldap-authentication-plugin/lists"}