From 7d7751d5b0384ac6fcca2b35f6de4378864e0d2a Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Mon, 3 Apr 2023 11:24:08 -0500 Subject: [PATCH] [v9.4.x] update enhanced-ldap (#65867) update enhanced-ldap (#65687) * update enhanced-ldap documenting a potential issue with ldap active sync, when search filter and username attributes do not match. * Update docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md * formats example * Update docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md --------- Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Chris Moyer (cherry picked from commit 99ac39f0d2470ca83c5817d5a51c80f1999fa676) Co-authored-by: annelaurefroment <49911675+annelaurefroment@users.noreply.github.com> --- .../enhanced-ldap/index.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md index cd059238ac7..1bc215476a8 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md @@ -67,3 +67,17 @@ active_sync_enabled = true # enabled by default ``` Single bind configuration (as in the [Single bind example]({{< relref "ldap/#single-bind-example" >}})) is not supported with active LDAP synchronization because Grafana needs user information to perform LDAP searches. + +For the synchronization to work, the `servers.search_filter` and `servers.attributes.username` in the ldap.toml config file must match. By default, the `servers.attributes.username` is `cn`, so if you use another attribute as the search filter, you must also update the username attribute. + +For example: + +``` +[[servers]] +search_filter = "(sAMAccountName=%s)" + +[servers.attributes] +username = "sAMAccountName" +``` + +If the attributes aren't the same, the users' sessions will be terminated after each synchronization. That's because the search will be done using the username's value, and that value doesn't exist for the attribute used in the search filter.