diff --git a/README.md b/README.md index 99b381e..12143b1 100644 --- a/README.md +++ b/README.md @@ -347,6 +347,7 @@ folder for help with: - [WikiJS](example_configs/wikijs.md) - [XBackBone](example_configs/xbackbone_config.php) - [Zendto](example_configs/zendto.md) +- [Zitadel](example_configs/zitadel.md) - [Zulip](example_configs/zulip.md) ## Migrating from SQLite diff --git a/example_configs/zitadel.md b/example_configs/zitadel.md new file mode 100644 index 0000000..e5146b9 --- /dev/null +++ b/example_configs/zitadel.md @@ -0,0 +1,47 @@ +# Configuration for Zitadel +In Zitadel, go to `Instance > Settings` for instance-wide LDAP setup or ` > Settings` for organization-wide LDAP setup. + +## Identity Providers Setup +Click `Identity Providers` and select `Active Directory/LDAP`. + +Replace every instance of `dc=example,dc=com` with your configured domain. +**Group filter is not supported in `Zitadel` at the time of writing.** +### Connection +* Name: The name to identify your identity provider +* Servers: `ldaps://:` or `ldap://:` +* BaseDn: `dc=example,dc=com` +* BindDn: `cn=admin,ou=people,dc=example,dc=com`. It is recommended that you create a separate user account (e.g, `bind_user`) instead of `admin` for sharing Bind credentials with other services. The `bind_user` should be a member of the `lldap_strict_readonly` group to limit access to your LDAP configuration in LLDAP. +* Bind Password: `` + +### User binding +* Userbase: `ou=people,dc=example,dc=com` +* User filters: `uid`. `mail` will not work. +* User Object Classes: `inetOrgPerson` + +### LDAP Attributes +* ID attribute: `uid` +* displayName attribute: `cn` +* Email attribute: `mail` +* Given name attribute: `givenName` +* Family name attribute: `lastName` + +### optional +The following section applied to `Zitadel` only, nothing will change on `LLDAP` side. + +* Account creation allowed [x] +* Account linking allowed [x] + +**Either one of them or both of them must be enabled** + +**DO NOT** enable `Automatic update` if you haven't setup a smtp server. Zitadel will update account's email and sent a verification code to verify the address. +If you don't have a smtp server setup correctly and the email adress of `ZITADEL Admin` is changed, you are **permanently** locked out. + +## Enable Identity Provider +After clicking `Save`, you will be redirected to `Identity Providers` page. + +Enable the LDAP by hovering onto the item and clicking the checkmark (`set as available`) + +## Enable LDAP Login +Under `Settings`, select `Login Behavior and Security` + +Under `Advanced`, enable `External IDP allowed` \ No newline at end of file