- Bind Password (optional)
- The password for the Bind DN specified above, if any. _Note: The password
- is stored in plaintext at the server. As such, ensure that the Bind DN
- has as few privileges as possible._
+ is stored encrypted with the SECRET_KEY on the server. It is still recommended
+ to ensure that the Bind DN has as few privileges as possible._
- User Search Base **(required)**
"code.gitea.io/gitea/modules/auth/oauth2"
"code.gitea.io/gitea/modules/auth/pam"
"code.gitea.io/gitea/modules/log"
+ "code.gitea.io/gitea/modules/secret"
"code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/timeutil"
"code.gitea.io/gitea/modules/util"
// FromDB fills up a LDAPConfig from serialized format.
func (cfg *LDAPConfig) FromDB(bs []byte) error {
json := jsoniter.ConfigCompatibleWithStandardLibrary
- return json.Unmarshal(bs, &cfg)
+ err := json.Unmarshal(bs, &cfg)
+ if err != nil {
+ return err
+ }
+ if cfg.BindPasswordEncrypt != "" {
+ cfg.BindPassword, err = secret.DecryptSecret(setting.SecretKey, cfg.BindPasswordEncrypt)
+ cfg.BindPasswordEncrypt = ""
+ }
+ return err
}
// ToDB exports a LDAPConfig to a serialized format.
func (cfg *LDAPConfig) ToDB() ([]byte, error) {
+ var err error
+ cfg.BindPasswordEncrypt, err = secret.EncryptSecret(setting.SecretKey, cfg.BindPassword)
+ if err != nil {
+ return nil, err
+ }
+ cfg.BindPassword = ""
json := jsoniter.ConfigCompatibleWithStandardLibrary
return json.Marshal(cfg)
}
SecurityProtocol SecurityProtocol
SkipVerify bool
BindDN string // DN to bind with
+ BindPasswordEncrypt string // Encrypted Bind BN password
BindPassword string // Bind DN password
UserBase string // Base search path for users
UserDN string // Template for the DN of the user for simple auth
auths.port = Port
auths.bind_dn = Bind DN
auths.bind_password = Bind Password
-auths.bind_password_helper = Warning: This password is stored in plain text. Use a read-only account if possible.
auths.user_base = User Search Base
auths.user_dn = User DN
auths.attribute_username = Username Attribute
<div class="field">
<label for="bind_password">{{.i18n.Tr "admin.auths.bind_password"}}</label>
<input id="bind_password" name="bind_password" type="password" value="{{$cfg.BindPassword}}">
- <p class="help text red">{{.i18n.Tr "admin.auths.bind_password_helper"}}</p>
</div>
{{end}}
<div class="{{if .Source.IsLDAP}}required{{end}} field">
<div class="ldap field {{if not (eq .type 2)}}hide{{end}}">
<label for="bind_password">{{.i18n.Tr "admin.auths.bind_password"}}</label>
<input id="bind_password" name="bind_password" type="password" autocomplete="off" value="{{.bind_password}}">
- <p class="help text red">{{.i18n.Tr "admin.auths.bind_password_helper"}}</p>
</div>
<div class="binddnrequired {{if (eq .type 2)}}required{{end}} field">
<label for="user_base">{{.i18n.Tr "admin.auths.user_base"}}</label>