{"id":18578668,"url":"https://github.com/jech/galene-ldap","last_synced_at":"2025-04-10T10:31:20.639Z","repository":{"id":52185505,"uuid":"520809131","full_name":"jech/galene-ldap","owner":"jech","description":"LDAP support for the Galene videoconferencing server","archived":false,"fork":false,"pushed_at":"2025-04-05T12:39:13.000Z","size":17,"stargazers_count":3,"open_issues_count":2,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-05T13:38:18.182Z","etag":null,"topics":["galene","jwt","ldap"],"latest_commit_sha":null,"homepage":"https://galene.org","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jech.png","metadata":{"files":{"readme":"README","changelog":"CHANGES","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-03T09:04:33.000Z","updated_at":"2025-04-05T12:39:16.000Z","dependencies_parsed_at":"2024-11-06T23:39:14.052Z","dependency_job_id":"c33c7df3-d3e8-4d95-9d70-18b5a96d791a","html_url":"https://github.com/jech/galene-ldap","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jech%2Fgalene-ldap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jech%2Fgalene-ldap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jech%2Fgalene-ldap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jech%2Fgalene-ldap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jech","download_url":"https://codeload.github.com/jech/galene-ldap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248199136,"owners_count":21063641,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["galene","jwt","ldap"],"created_at":"2024-11-06T23:36:43.846Z","updated_at":"2025-04-10T10:31:20.629Z","avatar_url":"https://github.com/jech.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"Galene-ldap: LDAP integration for the Galene videoconferencing server.\n\nFor more information about Galene, please see \u003chttps://galene.org\u003e.\n\n1. Build galene-ldap\n\n    CGO_ENABLED=0 go build -ldflags='-s -w'\n\n2. Create galene-ldap.json\n\nThere are two ways to perform client authentication using LDAP: using the\nBIND request or matching passwords on the client side.  Using BIND is\nrecommended.\n\nIn order to use BIND, your galene-ldap.json should look like this:\n\n    {\n      \"httpAddress\": \":8444\",\n      \"ldapServer\": \"ldap://localhost:389\",\n      \"ldapBase\": \"ou=users,dc=yunohost,dc=org\",\n      \"key\": {\"alg\":\"HS256\",\"k\":\"xxx\",\"key_ops\":[\"sign\",\"verify\"],\"kty\":\"oct\"},\n      \"groups\": [\"test-auth\"],\n    }\n\nThe field `groups` indicates the set of Galene groups that galene-ldap\nwill authorise; you will also need to configure these groups on the Galene\nside (see below).\n\nThe field `key` should be a (private or shared) key in JWK format;\nYou can generate a shared key using:\n\n    jose jwk gen -i '{\"kty\":\"oct\",\"alg\":\"HS256\"}' -o shared.jwk\n\nand a private/public keypair using\n\n    jose jwk gen -i '{\"kty\":\"EC\",\"alg\":\"ES256\"}' -o private.jwk\n    jose jwk pub -i private.jwk -o public.jwk\n\nIn order to use client-side matching, set the field `ldapClientSideValidate`\nto true, and define a privileged user with access to the passwords using\nthe fields `ldapAuthDN` and `ldapAuthPassword`:\n\n    {\n      \"httpAddress\": \":8444\",\n      \"ldapServer\": \"ldap://localhost:389\",\n      \"ldapBase\": \"ou=users,dc=yunohost,dc=org\",\n      \"ldapClientSideValidate\": true,\n      \"ldapAuthDN\": \"cn=admin,dc=yunohost,dc=org\",\n      \"ldapAuthPassword\": \"xxx\",\n      \"key\": {\"alg\":\"HS256\",\"k\":\"xxx\",\"key_ops\":[\"sign\",\"verify\"],\"kty\":\"oct\"},\n      \"groups\": [\"test-auth\"],\n    }\n\n3. Provide a TLS server certificate\n\n    cp /etc/letsencrypt/live/example.org/privkey.pem key.pem\n    cp /etc/letsencrypt/live/example.org/fullchain.pem cert.pem\n\n4. Run galene-ldap\n\n    nohup ./galene-ldap -debug \u0026\n\n5. Configure a group in Galene\n\nCreate a file `groups/test-auth.json` with the following contents:\n\n    {\n        \"authServer\": \"https://galene-ldap.example.org:8444\",\n        \"authKeys\": [\n          {\"alg\":\"HS256\",\"k\":\"xxx\",\"key_ops\":[\"sign\",\"verify\"],\"kty\":\"oct\"}\n        ]\n    }\n\nThe `authServer` field is the URL at which you instance of `galene-ldap`\nis publicly accessible (it is okay to put it behind a reverse proxy).  The\n`authKeys` field is a list of keys, and must include the key used by\n`galene-ldap` (or at least its public part, if you're using asymmetric\nkeying).\n\n# Configuration file reference\n\nThe `galene-ldap.json` file may contain the following fields:\n\n  - `groups`, the set of groups we will validate; requests for groups\n    outside this set will cause the client to fail login or to fallback to\n    password authentication, depending on `passwordFallback`;\n  - `passwordFallback`, if true, then the client will be instructed to\n    fallback to password authentication if the group or user is not found;\n    by default, we instruct the client fail logins for unknown users,\n    which avoids leaking passwords to the server;\n  - `httpAddress`, the address on which the HTTPS server listens,\n    in the format `host:port`;\n  - `insecure`, if true we run HTTP instead of HTTPS; this is only\n    suitable when running behind a reverse proxy that terminates TLS;\n  - `key`, the key used for signing tokens, in JWK format;\n  - `ldapServer`, the URL of the LDAP server (`ldap://` or `ldaps://`);\n  - `ldapBase`, the base DN used for user searches;\n  - `ldapAuthDN` and `ldapAuthPassword`, the DN and password we will bind\n    as before performing a search; it not specified, we perform an\n    anonymous BIND;\n  - `ldapClientSideValidate`, if true, then we validate passwords in the\n    client; by default, we validate passwords by attempting a BIND.\n  - `defaultPermissions`: the permissions to give to users.  If not set,\n    it defaults to `[\"present\", \"message\"]`.\n  - `ldapObjectClass`: the objectClass of the user entry to search. If not\n    set, it defaults to `posixAccount`.\n\n-- Juliusz Chroboczek\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjech%2Fgalene-ldap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjech%2Fgalene-ldap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjech%2Fgalene-ldap/lists"}