Enhancing Gollum with LDAP/AD authentication

Requirements

Install the needed gems (using rugged adapter otherwise it wouldn’t work),

gem install omniauth
gem install omniauth-ldap
gem install omnigollum
apt install cmake pkg-config
gem install gollum-rugged_adapter

Refs.

https://github.com/gollum/gollum/wiki/Git-adapters

Setting up OmniAuth

base=...
ldapsrv=...
aduser=...
password=...

vi /gollumprod/config.rb

wiki_options = {
  :live_preview => false,
  :allow_uploads => true,
  :allow_editing => true,
  :h1_title => true
}
Precious::App.set(:wiki_options, wiki_options)

#Precious::App.set(:environment, :production)

require 'omnigollum'
require 'omniauth-ldap'

options = {
  :providers => Proc.new do
    provider :ldap,
        :title => "Gollum Authentication USE YOUR WINDOWS CREDENTIALS e.g. aduser",
        :host => '$ldapsrv',
        :port => 3268,
        :method => :plain,
        :base => '$base',
        :uid => 'sAMAccountName',
        #:filter => '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))',
        #:name_proc => Proc.new {|name| name.gsub(/@.*$/,'')},
        :bind_dn => '$aduser',
        :password => '$password'
  end,
  :dummy_auth => false,
  :protected_routes => ['/*'],
  :author_format => Proc.new { |user| user.name },
  :author_email => Proc.new { |user| user.email },

  :authorized_users => nil,
}

Precious::App.set(:omnigollum, options)
Precious::App.register Omnigollum::Sinatra

Note. fixing authorized_users,

  :authorized_users => nil,

Run the shit using rugged adapter,

su - gollum -c "/usr/local/bin/gollum /gollumprod/operations.git/ --bare --config /gollumprod/config.rb --adapter rugged" &

Refs.

Ready to go

Once everything is fine you can switch to production env,

vi /gollumprod/config.rb

Precious::App.set(:environment, :production)

and restart the thing.

Alternatives

Possible alternative (untested) would be to start Gollum using Rack and using the omniauth-ldap example directly (?):

References