UPDATE: Thanks for everyone’s feedback on Active Directory/LDAP, the feature is now available with Mattermost Enterprise Edition and documentation is available online.
The current release of Mattermost integrates with GitLab to support authentication via LDAP, SAML, Kerberos and other enterprise authentication standards. Run GitLab omnibus to install GitLab Mattermost, a Mattermost deployment pre-configured with Gitlab SSO and ready to connect with enterprise protocols via GitLab accounts.
For connecting Mattermost directly to enterprise protocols, there is a commercial version of Mattermost being developed to offer (among many other features) similar authentication options as a standalone installation, starting with OpenLDAP and Active Directory.
Following our principle of designing familiar experiences, we’ve reviewed a broad range of LDAP configurations and decided to pattern our design off of AeroFS, the leading on-prem DropBox alternative.
We’ve re-grouped and omitted some settings to focus on what we think are priority, and from the below starting point we plan to incorporate feedback from forums and customers to craft a final design that meets the needs of a broad range of users.
We look forward to hearing your thoughts and feedback on prioritizing and adjusting the below features.
1. In System Console > Authentication > Single Sign-On
Offer a “Lightweight Directory Access Protocol (LDAP)” authentication option with the following headings, fields and help text:
2. Basic Configuration options
These would be offered in the pane from the menu above.
Server Host: the hostname or IP of your account server. This address must be resolvable by the Mattermost server.
Server Port: the port to connect to. Default LDAP ports are 389 for ldap, and 636 for ldaps.
Base DN: this will be the root of the search tree. Generally you would like to point this at the most specific node in your LDAP store that will include all the users that should have access to Mattermost.
Bind user name: to search for a user’s information, Mattermost requires access to an account with the ability to run a search. In almost all cases, this should be an account with limited access that you create especially for the Mattermost server.
Using an administrator account with broad permissions is not recommended. Usually this is given in LDAP format (
CN=Directory Agent,DC=example,DC=com), but Active Directory will accept other formats (
\\DOMAIN\Directory Agent) etc. See below for hints on testing this.
Password: the password for the bind account given above.
Security: StartTLS or SSL is recommended. Selecting plaintext will result in a warning, and should be avoided for best network security.
Also, for user configuration the following fields are required:
User attribute: the attribute in the user record to used to map LDAP users to Mattermost users, such as uid or username.
Email attribute: the attribute in the user record that holds the primary email address. This attribute should hold the email address that users will provide to Mattermost as their login information.
3. Advanced User Configuration
LDAP schemas may vary across customer environments. Here you can configure specifics of your LDAP schema. Most users will not need to modify this section.
Search scope: by restricting this search to the immediate children only, or ignoring the base DN, you can prune undesired matches from the LDAP result set. Normally this is set to “Search the object specified by Base DN and its entire subtree”.
User class: the object class that all users should belong to. This should be restrictive enough to disallow accounts that may have been allocated for software packages, devices, etc. This becomes part of the LDAP query in the authentication path.
First name attribute: the attribute that stores the users’ first name. Normally this should be “givenName”.
Last name attribute: the attribute that stores the users’ last name. Normally this should be “lastName”.
Username attribute: the attribute that stores the users’ username, that will be used as a Mattermost username.
4. Advanced Group Configuration
If you choose to enable LDAP Group Syncing on your Mattermost server, more configuration options specific to Groups will appear below the checkbox. You may need to change these default values if you use custom LDAP Object Classes.
Search Scope: similar to User Search Scope, except this scope is used when looking for groups to sync between LDAP and Mattermost. Normally this is set to “Search the object specified by Base DN and its entire subtree”.
Object Classes: the object classes that Mattermost will recognize as groups and sync from LDAP. Normally there are several different object classes which function as groups, please list them all here in a comma-separated list.
Static Member Attributes: attributes on LDAP group nodes which hold group members’ Distinguished Names (DNs) as values. Normally a groupOfNames object would have “member” as a static member attribute.
Group Name Attribute: the attribute which holds the name of the LDAP group as you want it to appear in Mattermost.
Daily Syncing Time: what time each day you want Mattermost to sync groups with your LDAP endpoint. You can also sync immediately from the Groups administration interface on the Web admin interface.
- What are the valid characters for an LDAP username/user group compared to a Mattermost username