73 lines
2.7 KiB
Bash
73 lines
2.7 KiB
Bash
# Authelia Active Directory / ADUC migration worksheet
|
|
# Fill this out locally, then we can use it to update Authelia from LLDAP to AD LDAP.
|
|
# Do NOT commit this file after adding real passwords or secrets.
|
|
|
|
# Current deployment context
|
|
AUTHELIA_URL=https://auth.wheelz.lab
|
|
AUTHELIA_BACKEND_URL=http://192.168.20.5:9091
|
|
AUTHELIA_CONFIG_DIR=/mnt/HomeStorage02/Docker/Authelia/config
|
|
|
|
# Active Directory domain
|
|
AD_DOMAIN_FQDN=local.wheelz.com
|
|
AD_NETBIOS_DOMAIN=WHEELZ
|
|
AD_BASE_DN=DC=local,DC=wheelz,DC=com
|
|
AD_DC_HOSTNAME=WheelzDC01.local.wheelz.com
|
|
AD_DC_IP=192.168.30.15
|
|
|
|
# LDAP connection
|
|
# Start with ldap:// for testing, then move to ldaps:// once CA trust is handled.
|
|
AD_LDAP_URL=ldap://192.168.30.15:389
|
|
# AD_LDAPS_URL=ldaps://WheelzDC01.local.wheelz.com:636
|
|
AD_START_TLS=false
|
|
AD_TLS_SKIP_VERIFY=false
|
|
# If using LDAPS, provide/export the AD CA root cert path later.
|
|
AD_CA_CERT_PATH=/config/certs/ad-ca-root.crt
|
|
|
|
# Bind/service account for Authelia LDAP searches
|
|
# Recommended: create a normal AD user with read/search access only.
|
|
AD_BIND_USERNAME=svc-authelia@local.wheelz.com
|
|
AD_BIND_PASSWORD=
|
|
# Optional DN form if UPN bind does not work:
|
|
# AD_BIND_DN=CN=svc_authelia_ldap,OU=Service Accounts,DC=local,DC=wheelz,DC=com
|
|
|
|
# User search scope
|
|
# Broad is easiest. Narrow to an OU later if desired.
|
|
AD_USERS_BASE_DN=DC=local,DC=wheelz,DC=com
|
|
# Example narrower value:
|
|
# AD_USERS_BASE_DN=OU=Users,DC=local,DC=wheelz,DC=com
|
|
AD_USERS_FILTER=(&({username_attribute}={input})(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
|
|
AD_USERNAME_ATTRIBUTE=sAMAccountName
|
|
AD_DISPLAY_NAME_ATTRIBUTE=displayName
|
|
AD_MAIL_ATTRIBUTE=mail
|
|
|
|
# Group search scope
|
|
AD_GROUPS_BASE_DN=DC=local,DC=wheelz,DC=com
|
|
# Example narrower value:
|
|
# AD_GROUPS_BASE_DN=OU=Groups,DC=local,DC=wheelz,DC=com
|
|
AD_GROUPS_FILTER=(member={dn})
|
|
AD_GROUP_NAME_ATTRIBUTE=cn
|
|
|
|
# Authelia AD security groups
|
|
AD_GROUP_AUTHELIA_ADMINS=Authelia-Admin
|
|
AD_GROUP_AUTHELIA_FAMILY=Authelia-Family
|
|
AD_GROUP_AUTHELIA_FRIENDS=Authelia-Friends
|
|
AD_GROUP_AUTHELIA_GUESTS=Authelia-Guest
|
|
|
|
# First admin user to verify after switching
|
|
AD_FIRST_ADMIN_USERNAME=wheelz
|
|
AD_FIRST_ADMIN_UPN=wheelz@local.wheelz.com
|
|
AD_FIRST_ADMIN_MUST_BE_MEMBER_OF=Authelia-Admin
|
|
|
|
# Network checks needed before changing Authelia
|
|
# TrueNAS/Authelia container must reach the DC on one of these:
|
|
# - TCP 389 for LDAP
|
|
# - TCP 636 for LDAPS
|
|
LDAP_PORT_TO_TEST=389
|
|
|
|
# Notes for Wheelz:
|
|
# 1. Create svc_authelia_ldap in ADUC.
|
|
# 2. Create security groups: Authelia-Admin, Authelia-Family, Authelia-Guest.
|
|
# 3. Add your real AD user to Authelia-Admin.
|
|
# 4. Fill in exact DC hostname, any real OU paths, and the service account password.
|
|
# 5. Do not paste the real password into Obsidian or commit it to Gitea.
|