{"id":4833,"date":"2019-12-27T16:03:47","date_gmt":"2019-12-27T13:03:47","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4833"},"modified":"2024-03-12T23:31:50","modified_gmt":"2024-03-12T20:31:50","slug":"configure-owncloud-openldap-authentication","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/configure-owncloud-openldap-authentication\/","title":{"rendered":"Configure ownCloud OpenLDAP Authentication"},"content":{"rendered":"\n<p>To avoid having to create local ownCloud user accounts, it is possible to configure ownCloud to authenticate users against the directory systems such as OpenLDAP or AD. In this guide, we are going to learn how to configure ownCloud OpenLDAP authentication. ownCloud server used in this demo is running on a CentOS 8 system.<\/p>\n\n\n\n<p>Learn how to setup ownCloud server on CentOS 8 by following the link below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-owncloud-server-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Install ownCloud Server on CentOS 8<\/a><\/p>\n\n\n\n<p>Before you can proceed, ensure that you have an LDAP server up running with user accounts created. Check our guide on how to setup OpenLDAP on CentOS 8.<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-setup-openldap-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Install and Setup OpenLDAP on CentOS 8<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configure-owncloud-ldap-authentication\">Configuring ownCloud LDAP Authentication<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-required-modules\">Install Required Modules<\/h3>\n\n\n\n<p>ownCloud requires the PHP LDAP module (php-ldap) in order to support LDAP authentication. To install php-ldap module,  (if not already installed), run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dnf install php-ldap php-process<\/code><\/pre>\n\n\n\n<p>If you are using a different system distribution, you might want to check how PHP LDAP module is installed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-owncloud-ldap-app\">Install ownCloud LDAP App<\/h3>\n\n\n\n<p>Once you have the PHP LDAP module installed, you need to install LDAP user and group backend app on ownCloud.<\/p>\n\n\n\n<p>Download the latest release version of LDAP app from <a rel=\"noreferrer noopener\" aria-label=\"ownCloud Marketplace (opens in a new tab)\" href=\"https:\/\/marketplace.owncloud.com\/apps\/user_ldap\" target=\"_blank\">ownCloud Marketplace<\/a>. <\/p>\n\n\n\n<p>Once the download is complete, extract the App.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>tar xzf user_ldap-0.14.0.tar.gz<\/code><\/pre>\n\n\n\n<p>Copy the <code>user_ldap<\/code> app directory into ownCloud default apps directory.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cp -r user_ldap \/var\/www\/html\/owncloud\/apps\/<\/code><\/pre>\n\n\n\n<p>Change the ownership of the LDAP app to web server user and group.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chown -R apache:apache \/var\/www\/html\/owncloud\/apps\/user_ldap<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-owncloud-ldap-app\">Enable ownCloud LDAP App<\/h3>\n\n\n\n<p>The LDAP app is now installed but it is disabled. To enable it, login to your ownCloud server as admin and navigate to Apps management menu. Click <strong>Show disabled apps<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1351\" height=\"625\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-apps.png\" alt=\"Configure ownCloud OpenLDAP Authentication\" class=\"wp-image-4846\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-apps.png?v=1577446805 1351w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-apps-768x355.png?v=1577446805 768w\" sizes=\"(max-width: 1351px) 100vw, 1351px\" \/><\/figure>\n\n\n\n<p>On LDAP Integration App, click enable.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1353\" height=\"630\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/enable-ldap.png\" alt=\"Configure ownCloud OpenLDAP Authentication\" class=\"wp-image-4847\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/enable-ldap.png?v=1577446880 1353w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/enable-ldap-768x358.png?v=1577446880 768w\" sizes=\"(max-width: 1353px) 100vw, 1353px\" \/><\/figure>\n\n\n\n<p>The app will now show on the enabled apps page. You should also be able to see the <strong>User Authentication<\/strong> tab the Admins menu on the left panel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1155\" height=\"408\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/user-auth.png\" alt=\"ownCloud OpenLDAP\" class=\"wp-image-4848\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/user-auth.png?v=1577446898 1155w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/user-auth-768x271.png?v=1577446898 768w\" sizes=\"(max-width: 1155px) 100vw, 1155px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-openldap-ca-certificate\">Install OpenLDAP CA Certificate<\/h3>\n\n\n\n<p>If you are going to setup LDAP connection over SSL\/TLS, you need to install the CA certificate on ownCloud server.<\/p>\n\n\n\n<p>Download the CA certificate from LDAP server;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo -n | openssl s_client -connect ldapmaster.kifarunix-demo.com:636 -showcerts | awk '\/-----BEGIN\/,\/END CERTIFICATE-----\/'<\/code><\/pre>\n\n\n\n<p>Copy the certificate from &#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211; to &#8212;&#8211;END CERTIFICATE&#8212;&#8211; and put it on specific file, in this guide we use <code>\/etc\/pki\/tls\/cacert.pem<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim etc\/pki\/tls\/cacert.pem<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>-----BEGIN CERTIFICATE-----\nMIIDvzCCAqegAwIBAgIUc8imlOVhEej453dXtvacn7krg1MwDQYJKoZIhvcNAQEL\nBQAwbzELMAkGA1UEBhMCS0UxDDAKBgNVBAgMA05haTEMMAoGA1UEBwwDTWFpMRww\n...\n...\nUy7ivNi2PL6mBwxMpyi0zTopqTXSvi54APm48dd0JPsGLTIgPMc1WvaN7TsUeIBs\nIgf9K1e9M0Q+j2XEsTeCYVU\/v0Jt0kER0+V\/NM0IrDOX+6kRz6DNsZrwcMEf5Yvp\nARWZ\n-----END CERTIFICATE-----<\/code><\/pre>\n\n\n\n<p>Next, open the <code>\/etc\/openldap\/ldap.conf<\/code> configuration file and define the location of the certificate above as follows;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/openldap\/ldap.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>...\n#TLS_CACERT     \/etc\/pki\/tls\/cert.pem<strong>\nTLS_CACERT      \/etc\/pki\/tls\/cacert.pem<\/strong>\n...<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-selinux\">Configure SELinux<\/h3>\n\n\n\n<p>If SELinux is running, implement the following policies.<\/p>\n\n\n\n<p>Allow HTTPD scripts and modules to connect to the network.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>setsebool -P httpd_can_network_connect 1<\/code><\/pre>\n\n\n\n<p>Allow HTTPD to connect to LDAP<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>setsebool -P httpd_can_connect_ldap 1<\/code><\/pre>\n\n\n\n<p>Allow nsswitch to allow LDAP logins<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>setsebool -P authlogin_nsswitch_use_ldap 1<\/code><\/pre>\n\n\n\n<p>Enable NIS<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>setsebool -P nis_enabled 1<\/code><\/pre>\n\n\n\n<p>You can as well choose to disable SELinux completely.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sed -i 's\/=enforcing\/=disabled\/' \/etc\/selinux\/config<\/code><\/pre>\n\n\n\n<p>If you choose to disable, reboot to apply the changes.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl reboot<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-ldap-authentication\">Configure LDAP Authentication<\/h3>\n\n\n\n<p>Click on <strong>User Authentication<\/strong> to start configuring LDAP server connection details.<\/p>\n\n\n\n<p>On the <strong>Server<\/strong> tab, enter your OpenLDAP URI, the BInd DN and its password, the Base DN. <strong>Be sure to replace your domain components accordingly<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1340\" height=\"479\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/ldap-server.png\" alt=\"ownCloud LDAP authentication\" class=\"wp-image-4849\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/ldap-server.png?v=1577446950 1340w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/ldap-server-768x275.png?v=1577446950 768w\" sizes=\"(max-width: 1340px) 100vw, 1340px\" \/><\/figure>\n\n\n\n<p>Next, click the <strong>Users<\/strong> tab and set the object classes that are used to filter user access.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1339\" height=\"517\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/users-oc.png\" alt=\"ownCloud LDAP user object class\" class=\"wp-image-4850\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/users-oc.png?v=1577446996 1339w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/users-oc-768x297.png?v=1577446996 768w\" sizes=\"(max-width: 1339px) 100vw, 1339px\" \/><\/figure>\n\n\n\n<p>Next, click the <strong>Login Attributes<\/strong> tab and define the user attributes that ownCloud will check OpenLDAP against while authenticating the user.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1333\" height=\"498\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/login-attributes.png\" alt=\"ownCLoud LDAP login attributes\" class=\"wp-image-4851\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/login-attributes.png?v=1577447018 1333w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/login-attributes-768x287.png?v=1577447018 768w\" sizes=\"(max-width: 1333px) 100vw, 1333px\" \/><\/figure>\n\n\n\n<p>On the <strong>Groups <\/strong>tab, define your object class for your OpenLDAP user groups.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1335\" height=\"475\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/LDAP-groups.png\" alt=\"ownCloud LDAP groups\" class=\"wp-image-4852\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/LDAP-groups.png?v=1577447038 1335w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/LDAP-groups-768x273.png?v=1577447038 768w\" sizes=\"(max-width: 1335px) 100vw, 1335px\" \/><\/figure>\n\n\n\n<p>You can click on Advanced and Expert tabs for more fundamental LDAP connection settings.<\/p>\n\n\n\n<p>One more setting is to set the LDAP users internal display name. On <strong>Expert<\/strong> settings tab, and set the value to <strong>uid<\/strong> to have the LDAP users user ID displayed instead of the auto-generated UUID.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1328\" height=\"419\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/display-name.png\" alt=\"ownCloud OpenLDAP user display name.\" class=\"wp-image-4853\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/display-name.png?v=1577450078 1328w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/display-name-768x242.png?v=1577450078 768w\" sizes=\"(max-width: 1328px) 100vw, 1328px\" \/><\/figure>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\"Refer to User Authentication with LDAP for more information (opens in a new tab)\" href=\"https:\/\/doc.owncloud.com\/server\/admin_manual\/configuration\/user\/user_auth_ldap.html\" target=\"_blank\">Refer to ownCloud User Authentication with LDAP for more information<\/a>.<\/p>\n\n\n\n<p>Once you are done with the settings, click <strong>Test Configuration<\/strong> to confirm is everything is Okay. If all is well, you should get a message below displayed.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>The configuration is valid and connection could be established!<\/strong><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"synchronizing-owncloud-ldap-users\">Synchronizing ownCloud LDAP Users<\/h3>\n\n\n\n<p>It is also important to synchronize OpenLDAP users with ownCloud internal user database to ensure that any changes made to the user on the authentication backend, eg OpenLDAP, will also be effected on ownCloud.<\/p>\n\n\n\n<p>This can be done using the <strong><code>occ user:sync<\/code><\/strong> command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo -u apache php \/var\/www\/html\/owncloud\/occ user:sync \"OCA\\User_LDAP\\User_Proxy\" -m disable -r<\/code><\/pre>\n\n\n\n<p>For more explanation on the command line options used, check the <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/doc.owncloud.com\/server\/admin_manual\/configuration\/server\/occ_command.html#syncing-user-accounts\" target=\"_blank\">occ user:sync command<\/a>.<\/p>\n\n\n\n<p>Create a cron job for this command to run at least once a day. For example, in this guide, we have a cron job for this task that runs every day at 0600 hrs.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo crontab -e<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>0 6 * * * sudo -u apache php \/var\/www\/html\/owncloud\/occ user:sync \"OCA\\User_LDAP\\User_Proxy\" -m disable -r<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"testing-ldap-users-owncloud-authentication\">Testing LDAP Users ownCloud Authentication<\/h3>\n\n\n\n<p>If everything has gone well so far, then it is time to test if you can login to ownCloud as LDAP user. In this guide, we have a user called, <strong><code>johndoe<\/code><\/strong> in our OpenLDAP server.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapsearch -H ldapi:\/\/\/ -Y EXTERNAL -LLL -b \"dc=ldapmaster,dc=kifarunix-demo,dc=com\" uid=*<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>dn: uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nobjectClass: inetOrgPerson\nobjectClass: posixAccount\nobjectClass: shadowAccount\nuid: <strong>johndoe<\/strong>\ncn: John\nsn: Doe\nloginShell: \/bin\/bash\nuidNumber: 10000\ngidNumber: 10000\nhomeDirectory: \/home\/johndoe\n...<\/code><\/pre>\n\n\n\n<p>Login to ownCloud as OpenLDAP user.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"810\" height=\"437\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-login.png\" alt=\"ownCloud LDAP authentication\" class=\"wp-image-4854\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-login.png?v=1577451327 810w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-login-768x414.png?v=1577451327 768w\" sizes=\"(max-width: 810px) 100vw, 810px\" \/><\/figure>\n\n\n\n<p>Upon successful login, you should land on ownCloud dashboard.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1356\" height=\"597\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-ldap-auth.png\" alt=\"\" class=\"wp-image-4855\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-ldap-auth.png?v=1577451512 1356w, https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/12\/owncloud-ldap-auth-768x338.png?v=1577451512 768w\" sizes=\"(max-width: 1356px) 100vw, 1356px\" \/><\/figure>\n\n\n\n<p>Great. You have successfully setup your ownCloud server for OpenLDAP authentication.<\/p>\n\n\n\n<p>Read more on <a rel=\"noreferrer noopener\" aria-label=\"ownCloud User Authentication with LDAP (opens in a new tab)\" href=\"https:\/\/doc.owncloud.com\/server\/admin_manual\/configuration\/user\/user_auth_ldap.html\" target=\"_blank\">ownCloud User Authentication with LDAP<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"related-tutorials\">Related Tutorials<\/h3>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-owncloud-desktop-client-on-centos-8\/\" target=\"_blank\">Install ownCloud Desktop Client on CentOS 8<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-owncloud-desktop-client-on-debian-10-buster\/\" target=\"_blank\">Install ownCloud Desktop Client on Debian 10 Buster<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-owncloud-server-on-debian-10-buster\/\" target=\"_blank\">Install ownCloud Server on Debian 10 Buster<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-upgrade-owncloud-9-to-owncloud-10-on-ubuntu-16-04\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">How to Upgrade ownCloud 9 to ownCloud 10 on Ubuntu 16.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>To avoid having to create local ownCloud user accounts, it is possible to configure ownCloud to authenticate users against the directory systems such as OpenLDAP<\/p>\n","protected":false},"author":1,"featured_media":11059,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,1099,249,39],"tags":[1248,267,1249,1247],"class_list":["post-4833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-openldap","category-owncloud","category-storage","tag-ldap-authentication","tag-owncloud","tag-owncloud-ldap","tag-owncloud-ldap-authentication","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4833"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4833"}],"version-history":[{"count":8,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4833\/revisions"}],"predecessor-version":[{"id":21277,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4833\/revisions\/21277"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/11059"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}