我们经常发布文档更新,此页面的翻译可能仍在进行中。有关最新信息,请访问英文文档。如果此页面上的翻译有问题,请告诉我们
文章版本: Enterprise Server 2.20

Using LDAP

LDAP lets you authenticate GitHub Enterprise Server against your existing accounts and centrally manage repository access. LDAP is a popular application protocol for accessing and maintaining directory information services, and is one of the most common protocols used to integrate third-party software with large company user directories.

本文内容

如果要验证用户而不将他们添加到您的身份提供程序中,您可以配置内置身份验证。 更多信息请参阅“允许对身份提供程序覆盖范围以外的用户进行内置身份验证”。

Supported LDAP services

GitHub Enterprise Server integrates with these LDAP services:

  • Active Directory
  • FreeIPA
  • Oracle Directory Server Enterprise Edition
  • OpenLDAP
  • Open Directory
  • 389-ds

Username considerations with LDAP

GitHub Enterprise Server 用户名只能包含字母数字和短划线 (-)。 GitHub Enterprise Server 会将帐户用户名中的所有非字母数字字符标准化为短划线。 例如,用户名 gregory.st.john 将标准化为 gregory-st-john。 请注意,标准化的用户名也不能以短划线开头或结尾。 它们还不能包含两个连续的短划线。

创建自电子邮件地址的用户名使用前置 @ 字符的标准化字符创建。

如果多个帐户标准化为同一个 GitHub Enterprise Server 用户名,则只创建第一个用户帐户。 使用相同用户名的后续用户无法登录。

此表格举例说明 GitHub Enterprise Server 中如何标准化用户名:

用户名标准化的用户名结果
Ms.Bubblesms-bubbles此用户名已成功创建。
!Ms.Bubbles-ms-bubbles此用户名无法创建,因其以短划线开头。
Ms.Bubbles!ms-bubbles-此用户名无法创建,因其以短划线结尾。
Ms!!Bubblesms--bubbles此用户名无法创建,因其包含两个连续的短划线。
Ms!Bubblesms-bubbles此用户名无法创建。 虽然标准化的用户名有效,但它已经存在。
Ms.Bubbles@example.comms-bubbles此用户名无法创建。 虽然标准化的用户名有效,但它已经存在。

双重身份验证

使用 LDAP 或内置身份验证时,支持双重身份验证。 组织管理员可以要求成员启用双重身份验证。

Configuring LDAP with 您的 GitHub Enterprise Server 实例

After you configure LDAP, users will be able to sign into your instance with their LDAP credentials. When users sign in for the first time, their profile names, email addresses, and SSH keys will be set with the LDAP attributes from your directory.

When you configure LDAP access for users via the 管理控制台, your user licenses aren't used until the first time a user signs in to your instance. However, if you create an account manually using site admin settings, the user license is immediately accounted for.

Warning: Before configuring LDAP on 您的 GitHub Enterprise Server 实例, make sure that your LDAP service supports paged results.

  1. 在任何页面的右上角,单击
    用于访问站点管理员设置的火箭图标
  2. 在左侧边栏中,单击 管理控制台
    左侧边栏中的 管理控制台 选项卡
  3. 在左侧边栏中,单击 Authentication(身份验证)
    设置侧边栏中的身份验证选项卡
  4. Under "Authentication", select LDAP.
    LDAP select
  5. (可选)选择 Allow built-in authentication(允许内置身份验证)以邀请用户使用内置身份验证(如果他们不属于 您的 GitHub Enterprise Server 实例 的身份提供程序)。
    Select LDAP built-in authentication checkbox
  6. Add your configuration settings.

LDAP attributes

Use these attributes to finish configuring LDAP for 您的 GitHub Enterprise Server 实例.

Attribute nameTypeDescription
HostRequiredThe LDAP host, e.g. ldap.example.com or 10.0.0.30. If the hostname is only available from your internal network, you may need to configure 您的 GitHub Enterprise Server 实例's DNS first so it can resolve the hostname using your internal nameservers.
PortRequiredThe port the host's LDAP services are listening on. Examples include: 389 and 636 (for LDAPS).
EncryptionRequiredThe encryption method used to secure communications to the LDAP server. Examples include plain (no encryption), SSL/LDAPS (encrypted from the start), and StartTLS (upgrade to encrypted communication once connected).
Domain search userOptionalThe LDAP user that performs user lookups to authenticate other users when they sign in. This is typically a service account created specifically for third-party integrations. Use a fully qualified name, such as cn=Administrator,cn=Users,dc=Example,dc=com. With Active Directory, you can also use the [DOMAIN]\[USERNAME] syntax (e.g. WINDOWS\Administrator) for the domain search user with Active Directory.
Domain search passwordOptionalThe password for the domain search user.
Administrators groupOptionalUsers in this group are promoted to site administrators when signing into your appliance. If you don't configure an LDAP Administrators group, the first LDAP user account that signs into your appliance will be automatically promoted to a site administrator.
Domain baseRequiredThe fully qualified Distinguished Name (DN) of an LDAP subtree you want to search for users and groups. You can add as many as you like; however, each group must be defined in the same domain base as the users that belong to it. If you specify restricted user groups, only users that belong to those groups will be in scope. We recommend that you specify the top level of your LDAP directory tree as your domain base and use restricted user groups to control access.
Restricted user groupsOptionalIf specified, only users in these groups will be allowed to log in. You only need to specify the common names (CNs) of the groups, and you can add as many groups as you like. If no groups are specified, all users within the scope of the specified domain base will be able to sign in to your GitHub Enterprise Server instance.
User IDRequiredThe LDAP attribute that identifies the LDAP user who attempts authentication. Once a mapping is established, users may change their GitHub Enterprise Server usernames. This field should be sAMAccountName for most Active Directory installations, but it may be uid for other LDAP solutions, such as OpenLDAP. The default value is uid.
Profile nameOptionalThe name that will appear on the user's GitHub Enterprise Server profile page. Unless LDAP Sync is enabled, users may change their profile names.
EmailsOptionalThe email addresses for a user's GitHub Enterprise Server account.
SSH keysOptionalThe public SSH keys attached to a user's GitHub Enterprise Server account. The keys must be in OpenSSH format.
GPG keysOptionalThe GPG keys attached to a user's GitHub Enterprise Server account.
Disable LDAP authentication for Git operationsOptionalIf selected, turns off users' ability to use LDAP passwords to authenticate Git operations.
Enable LDAP certificate verificationOptionalIf selected, turns on LDAP certificate verification.
SynchronizationOptionalIf selected, turns on LDAP Sync.

Disabling password authentication for Git operations

Select Disable username and password authentication for Git operations in your LDAP settings to enforce use of personal access tokens or SSH keys for Git access, which can help prevent your server from being overloaded by LDAP authentication requests. We recommend this setting because a slow-responding LDAP server, especially combined with a large number of requests due to polling, is a frequent source of performance issues and outages.

Disable LDAP password auth for Git check box

When this option is selected, if a user tries to use a password for Git operations via the command line, they will receive an error message that says, Password authentication is not allowed for Git operations. You must use a personal access token.

Enabling LDAP certificate verification

Select Enable LDAP certificate verification in your LDAP settings to validate the LDAP server certificate you use with TLS.

LDAP certificate verification box

When this option is selected, the certificate is validated to make sure:

  • If the certificate contains at least one Subject Alternative Name (SAN), one of the SANs matches the LDAP hostname. Otherwise, the Common Name (CN) matches the LDAP hostname.
  • The certificate is not expired.
  • The certificate is signed by a trusted certificate authority (CA).

Enabling LDAP Sync

LDAP Sync lets you synchronize GitHub Enterprise Server users and team membership against your established LDAP groups. This lets you establish role-based access control for users from your LDAP server instead of manually within GitHub Enterprise Server. For more information, see "Creating teams."

To enable LDAP Sync, in your LDAP settings, select Synchronize Emails, Synchronize SSH Keys, or Synchronize GPG Keys .

Synchronization check box

After you enable LDAP sync, a synchronization job will run at the specified time interval to perform the following operations on each user account:

  • If you've allowed built-in authentication for users outside your identity provider, and the user is using built-in authentication, move on to the next user.
  • If no LDAP mapping exists for the user, try to map the user to an LDAP entry in the directory. If the user cannot be mapped to an LDAP entry, suspend the user and move on to the next user.
  • If there is an LDAP mapping and the corresponding LDAP entry in the directory is missing, suspend the user and move on to the next user.
  • If the corresponding LDAP entry has been marked as disabled and the user is not already suspended, suspend the user and move on to the next user.
  • If the corresponding LDAP entry is not marked as disabled, and the user is suspended, and Reactivate suspended users is enabled in the Admin Center, unsuspend the user.
  • If the corresponding LDAP entry includes a name attribute, update the user's profile name.
  • If the corresponding LDAP entry is in the Administrators group, promote the user to site administrator.
  • If the corresponding LDAP entry is not in the Administrators group, demote the user to a normal account.
  • If an LDAP User field is defined for emails, synchronize the user's email settings with the LDAP entry. Set the first LDAP mail entry as the primary email.
  • If an LDAP User field is defined for SSH public keys, synchronize the user's public SSH keys with the LDAP entry.
  • If an LDAP User field is defined for GPG keys, synchronize the user's GPG keys with the LDAP entry.

Note: LDAP entries can only be marked as disabled if you use Active Directory and the userAccountControl attribute is present and flagged with ACCOUNTDISABLE.

A synchronization job will also run at the specified time interval to perform the following operations on each team that has been mapped to an LDAP group:

  • If a team's corresponding LDAP group has been removed, remove all members from the team.
  • If LDAP member entries have been removed from the LDAP group, remove the corresponding users from the team. If the user loses access to any repositories as a result, delete any private forks the user has of those repositories.
  • If LDAP member entries have been added to the LDAP group, add the corresponding users to the team. If the user regains access to any repositories as a result, restore any private forks of the repositories that were deleted because the user lost access in the past 90 days.

作为优化配置的一部分,LDAP 同步不会传输您的嵌套团队结构。 要创建子团队与父团队的关系,必须手动重新创建嵌套团队结构并将其与相应的 LDAP 组同步。 更多信息请参阅“创建团队”。

Security Warning:

When LDAP Sync is enabled, site admins and organization owners can search the LDAP directory for groups to map the team to.

This has the potential to disclose sensitive organizational information to contractors or other unprivileged users, including:

  • The existence of specific LDAP Groups visible to the Domain search user.
  • Members of the LDAP group who have GitHub Enterprise Server user accounts, which is disclosed when creating a team synced with that LDAP group.

If disclosing such information is not desired, your company or organization should restrict the permissions of the configured Domain search user in the admin console. If such restriction isn't possible, contact GitHub Enterprise 支持GitHub 高级支持.

Supported LDAP group object classes

GitHub Enterprise Server supports these LDAP group object classes. Groups can be nested.

  • group
  • groupOfNames
  • groupOfUniqueNames
  • posixGroup

Viewing and creating LDAP users

You can view the full list of LDAP users who have access to your instance and provision new users.

  1. 登录到 http(s)://HOSTNAME/login 上的 您的 GitHub Enterprise Server 实例。
  2. 在任何页面的右上角,单击
    用于访问站点管理员设置的火箭图标
  3. In the left sidebar, click LDAP users.
    LDAP users tab
  4. To search for a user, type a full or partial username and click Search. Existing users will be displayed in search results. If a user doesn’t exist, click Create to provision the new user account.
    LDAP search

Updating LDAP accounts

Unless LDAP Sync is enabled, changes to LDAP accounts are not automatically synchronized with GitHub Enterprise Server.

Manually syncing LDAP accounts

  1. 登录到 http(s)://HOSTNAME/login 上的 您的 GitHub Enterprise Server 实例。
  2. 在任何页面的右上角,单击
    用于访问站点管理员设置的火箭图标
  3. 在搜索字段中,输入用户的名称,然后单击 Search(搜索)
    站点管理设置搜索字段
  4. 在搜索结果中,单击用户名称。
    站点管理设置搜索选项
  5. 在页面的右上角,单击 Admin(管理员)
    管理员工具
  6. 在左侧边栏中,单击 Admin(管理员)
    管理员工具
  7. Under "LDAP," click Sync now to manually update the account with data from your LDAP server.
    LDAP sync now button

You can also use the API to trigger a manual sync.

Revoking access to 您的 GitHub Enterprise Server 实例

If LDAP Sync is enabled, removing a user's LDAP credentials will suspend their account after the next synchronization run.

If LDAP Sync is not enabled, you must manually suspend the GitHub Enterprise Server account after you remove the LDAP credentials. For more information, see "Suspending and unsuspending users".

问问别人

找不到要找的内容?

联系我们