Using SAML for Authentication with LDAP for Group Membership Sync

Dear OpenProject Community,

We are currently evaluating a specific authentication use case and would appreciate confirmation on whether this configuration is supported.

Our Goal:

Authentication: Handle all user logins via a SAML provider.
Authorization/Groups: Fetch user group memberships from an LDAP server.

Current Progress:

SAML: Successfully configured; users can log in without issues.
LDAP: The connection is established, and OpenProject successfully "sees" the groups from our LDAP server.

Despite the connection working, the LDAP groups remain empty in OpenProject. It appears the system isn't successfully mapping the SAML-authenticated users to their respective LDAP groups.

Is this "hybrid" setup (SAML Auth + LDAP Group Sync) currently supported in OpenProject? If so, are there specific mapping attributes required to link the SAML user identity to the LDAP entry?

Thank you in advance for your help!

Best regards,
--
Issa

Replies (1)

RE: Using SAML for Authentication with LDAP for Group Membership Sync - Added by Issa Gorissen about 9 hours ago

If this can help somebody else, with guidance from OpenProject support, I manage to diagnose and resolve the issue. The LDAP account used was not permitted to access the ou=people,dc=... subtree to read the user accounts

Support directed me to launch a command inside a console in rails, such as (deployment here is inside containers)

# I'm using podman in my container deploy
podman exec -it op-web bash

bundle exec rails c

ldap_source = LdapAuthSource.last
ldap = Net::LDAP.new( host: ldap_source.host, port: ldap_source.port, verbose: true, auth: {method: :simple, username: ldap_source.account, password: ldap_source.account_password}, encryption: {method: :simple_tls, tls_options: {verify_mode: OpenSSL::SSL::VERIFY_NONE} } )
ldap.search(base: ldap_source.base_dn, filter: Net::LDAP::Filter.eq("memberOf", "cn=your_grup_name,ou=groups,dc=xyz"))

# you should see your users member of that group
# you can also execute other LDAP queries to help the troubleshoot

Thx again to OP support team for their help :)

Content