208 lines
10 KiB
HTML
208 lines
10 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>documentation:2.0:applications:mattermost</title>
|
|
<meta name="generator" content="DokuWiki"/>
|
|
<meta name="robots" content="index,follow"/>
|
|
<meta name="keywords" content="documentation,2.0,applications,mattermost"/>
|
|
<link rel="search" type="application/opensearchdescription+xml" href="../lib/exe/opensearch.html" title="LemonLDAP::NG"/>
|
|
<link rel="start" href="mattermost.html"/>
|
|
<link rel="contents" href="mattermost.html" title="Sitemap"/>
|
|
<link rel="stylesheet" type="text/css" href="../lib/exe/css.php.t.bootstrap3.css"/>
|
|
<!-- //if:usedebianlibs
|
|
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
|
|
//elsif:useexternallibs
|
|
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
|
|
//elsif:cssminified
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
|
|
//else -->
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
|
|
<!-- //endif -->
|
|
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:2.0:applications';var JSINFO = {"id":"documentation:2.0:applications:mattermost","namespace":"documentation:2.0:applications"};
|
|
/*!]]>*/</script>
|
|
<script type="text/javascript" charset="utf-8" src="../lib/exe/js.php.t.bootstrap3.js"></script>
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script>
|
|
<!-- //endif -->
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.js"></script>
|
|
<!-- //endif -->
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export container">
|
|
<!-- TOC START -->
|
|
<div id="dw__toc">
|
|
<h3 class="toggle">Table of Contents</h3>
|
|
<div>
|
|
|
|
<ul class="toc">
|
|
<li class="level1"><div class="li"><a href="#presentation">Presentation</a></div></li>
|
|
<li class="level1"><div class="li"><a href="#configuring_mattermost_team_edition">Configuring Mattermost Team Edition</a></div>
|
|
<ul class="toc">
|
|
<li class="level2"><div class="li"><a href="#configuring_your_web_server">Configuring your web server</a></div></li>
|
|
<li class="level2"><div class="li"><a href="#configuring_lemonldap">Configuring LemonLDAP</a></div></li>
|
|
<li class="level2"><div class="li"><a href="#troubleshooting">Troubleshooting</a></div></li>
|
|
</ul></li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<!-- TOC END -->
|
|
|
|
<h1 class="sectionedit1" id="mattermost_team_edition">Mattermost Team Edition</h1>
|
|
<div class="level1">
|
|
|
|
<p>
|
|
<img src="mattermost_logo.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "Mattermost Team Edition" [1-88] -->
|
|
<h2 class="sectionedit2" id="presentation">Presentation</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Mattermost is a team-based instant messaging application.
|
|
</p>
|
|
|
|
<p>
|
|
See <a href="https://mattermost.com/" class="urlextern" title="https://mattermost.com/" rel="nofollow">the official Mattermost website</a> for a complete presentation.
|
|
</p>
|
|
|
|
<p>
|
|
Mattermost follows an Open Core development model. The freely available <a href="https://docs.mattermost.com/developer/manifesto.html" class="urlextern" title="https://docs.mattermost.com/developer/manifesto.html" rel="nofollow">Team edition</a> contains all the basic chat features, but lack the integration capabilities found in the <a href="https://mattermost.com/pricing/" class="urlextern" title="https://mattermost.com/pricing/" rel="nofollow">Enterprise edition</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The Enterprise edition provides <a href="https://docs.mattermost.com/deployment/sso-saml.html" class="urlextern" title="https://docs.mattermost.com/deployment/sso-saml.html" rel="nofollow">SAML integration</a> out of the box, and you can configure it just like <a href="../idpsaml.html" class="wikilink1" title="documentation:2.0:idpsaml">any other SAML service in LemonLDAP::NG</a>
|
|
</p>
|
|
|
|
<p>
|
|
The Team edition, however, only provides <abbr title="Single Sign On">SSO</abbr> integration with Gitlab.
|
|
</p>
|
|
|
|
<p>
|
|
However, it is possible to configure LemonLDAP::NG to behave exactly like a Gitlab Oauth2 server, allowing Mattermost Team Edition to be integrated with LemonLDAP::NG without having to use a <a href="gitlab.html" class="wikilink1" title="documentation:2.0:applications:gitlab">Gitlab</a> server.
|
|
</p>
|
|
<div class="notewarning">The following configuration requires your user database to expose a unique numeric identifier for every user.
|
|
|
|
</div>
|
|
</div>
|
|
<!-- EDIT2 SECTION "Presentation" [89-1191] -->
|
|
<h2 class="sectionedit3" id="configuring_mattermost_team_edition">Configuring Mattermost Team Edition</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Configuring Mattermost through the <em>System Console</em> will not allow you to set the correct URLs. You need to edit the Mattermost configuration file, and avoid changing Gitlab integration settings in the <em>System Console</em>
|
|
</p>
|
|
|
|
<p>
|
|
Set the following settings in <code>/opt/mattermost/config/config.json</code>
|
|
</p>
|
|
<pre class="code"> "GitLabSettings": {
|
|
"Enable": true,
|
|
"Secret": "CHOOSE_A_CLIENT_SECRET",
|
|
"Id": "CHOOSE_A_CLIENT_ID",
|
|
"Scope": "",
|
|
"AuthEndpoint": "https://auth.example.com/oauth2/gitlab_authorize",
|
|
"TokenEndpoint": "https://auth.example.com/oauth2/token",
|
|
"UserApiEndpoint": "https://auth.example.com/oauth2/userinfo"
|
|
},</pre>
|
|
|
|
</div>
|
|
<!-- EDIT3 SECTION "Configuring Mattermost Team Edition" [1192-1919] -->
|
|
<h3 class="sectionedit4" id="configuring_your_web_server">Configuring your web server</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
Mattermost does not use OpenID Connect to communicate with Gitlab, but uses plain OAuth2 instead. Because of that, LemonLDAP::NG will not receive the <code>scope=</code> parameter and will display an error on the portal when trying to authenticate.
|
|
</p>
|
|
|
|
<p>
|
|
In order to fix this, we can add a fake OAuth2 authorize <abbr title="Uniform Resource Locator">URL</abbr> on the LemonLDAP::NG server that will automatically add this <code>scope=</code> parametrer, before sending the request to the correct OIDC <abbr title="Uniform Resource Locator">URL</abbr>
|
|
</p>
|
|
|
|
<p>
|
|
Here is an example configuration for Nginx, add it in your Portal virtualhost before any other rewrite rule:
|
|
</p>
|
|
<pre class="code"> rewrite ^/oauth2/gitlab_(authorize.*)$ https://auth.example.com/oauth2/$1?scope=openid%20gitlab ;</pre>
|
|
|
|
<p>
|
|
And if you are using Apache
|
|
</p>
|
|
<pre class="code">RewriteRule "^/oauth2/gitlab_authorize(.*)$" "https://auth.example.com/oauth2/authorize?$1scope=openid gitlab" [QSA,NE]</pre>
|
|
|
|
</div>
|
|
<!-- EDIT4 SECTION "Configuring your web server" [1920-2789] -->
|
|
<h3 class="sectionedit5" id="configuring_lemonldap">Configuring LemonLDAP</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
We now have to configure LemonLDAP::NG to recognize Mattermost as a valid OAuth2 relaying party and send it the information it needs to recognize a user.
|
|
</p>
|
|
|
|
<p>
|
|
Add a <a href="../idpopenidconnect.html" class="wikilink1" title="documentation:2.0:idpopenidconnect"> new OpenID Connect relaying party </a> with the following parameters:
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <strong>Client ID</strong>: the same you set in Mattermost configuration</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> <strong>Client Secret</strong>: the same you set in Mattermost configuration</div>
|
|
</li>
|
|
<li class="level2"><div class="li"> Add a new scope in "Extra claims"</div>
|
|
<ul>
|
|
<li class="level4"><div class="li"> <strong>Key</strong>: <code>gitlab</code></div>
|
|
</li>
|
|
<li class="level4"><div class="li"> <strong>Value</strong>: <code>id username name email</code></div>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
<li class="level2"><div class="li"> Add the following exported attributes</div>
|
|
<ul>
|
|
<li class="level4"><div class="li"> <code>username</code>: set it to the session attribute containing the user login</div>
|
|
</li>
|
|
<li class="level4"><div class="li"> <code>name</code>: session attribute containing the user's full name</div>
|
|
</li>
|
|
<li class="level4"><div class="li"> <code>email</code>: session attribute containing the user's email</div>
|
|
</li>
|
|
<li class="level4"><div class="li"> <code>id</code>: session attribute containing the user's numeric ID</div>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
<div class="notewarning">Mattermost absolutely needs to receive a numerical value in the <code>id</code> claim. If you are using a LDAP server, you could use the <code>uidNumber</code> LDAP attribute. If you use something else, you will have to find a trick to assign a unique numeric ID to each Mattermost user.
|
|
<p>
|
|
The <code>id</code> attribute has to be different for each user, since this is the field Mattermost will use internally to map Gitlab identities to Mattermost accouts.
|
|
</p>
|
|
|
|
</div>
|
|
</div>
|
|
<!-- EDIT5 SECTION "Configuring LemonLDAP" [2790-4119] -->
|
|
<h3 class="sectionedit6" id="troubleshooting">Troubleshooting</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
If you see a HTTP code 500 when going back to mattermost, with a panic() in <code>(*GitLabUser).IsValid(...)</code> , it probably means that you are not exporting the correct attributes, but it can also mean that <code>id</code> is exported as a JSON string.
|
|
</p>
|
|
|
|
<p>
|
|
If this case, it can help to create a macro, for example <code>uidNumber_n</code>, with a value of <code>$uidNumber + 0</code> to force conversion to a numeric value. You must then export it as the <code>id</code> field in the Relaying Party configuration.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT6 SECTION "Troubleshooting" [4120-] --></div>
|
|
</body>
|
|
</html>
|