Enhancing Gollum with LDAP/AD authentication

RequirementsRequirements

Install the needed gems (using rugged adapter otherwise it wouldn’t work),

gem install omniauth
gem install omniauth-ldap
gem install omnigollum
apt install cmake pkg-config
gem install gollum-rugged_adapter

Refs.

https://github.com/gollum/gollum/wiki/Git-adapters

Setting up OmniAuthSetting up OmniAuth

base=...
ldapsrv=...
aduser=...
password=...

vi /gollumprod/config.rb

wiki_options = {
  :live_preview => false,
  :allow_uploads => true,
  :allow_editing => true,
  :h1_title => true
}
Precious::App.set(:wiki_options, wiki_options)

#Precious::App.set(:environment, :production)

require 'omnigollum'
require 'omniauth-ldap'

options = {
  :providers => Proc.new do
    provider :ldap,
    :title => "Gollum Authentication USE YOUR WINDOWS CREDENTIALS e.g. aduser",
    :host => '$ldapsrv',
    :port => 3268,
    :method => :plain,
    :base => '$base',
    :uid => 'sAMAccountName',
    #:filter => '(&(uid=%{username})(memberOf=cn=myapp-users,ou=groups,dc=example,dc=com))',
    #:name_proc => Proc.new {|name| name.gsub(/@.*$/,'')},
    :bind_dn => '$aduser',
    :password => '$password'
  end,
  :dummy_auth => false,
  :protected_routes => ['/*'],
  :author_format => Proc.new { |user| user.name },
  :author_email => Proc.new { |user| user.email },

  :authorized_users => nil,
}

Precious::App.set(:omnigollum, options)
Precious::App.register Omnigollum::Sinatra

Note. fixing authorized_users,

  :authorized_users => nil,

Run the shit using rugged adapter,

su - gollum -c "/usr/local/bin/gollum /gollumprod/operations.git/ --bare --config /gollumprod/config.rb --adapter rugged" &

Refs.

Ready to goReady to go

Once everything is fine you can switch to production env,

vi /gollumprod/config.rb

Precious::App.set(:environment, :production)

and restart the thing.

AlternativesAlternatives

Possible alternative (untested) would be to start Gollum using Rack and using the omniauth-ldap example directly (?):

ReferencesReferences