docs: update LDAP documentation according to user feedback.

docs/auth/auth-ldap-groups.rst

@@ -0,0 +1,112 b''
+.. _config-ldap-groups-ref:
+
+LDAP/AD With User Groups Sync
+-----------------------------
+
+|RCM| supports LDAP (Lightweight Directory Access Protocol) or
+AD (active Directory) authentication.
+All LDAP versions are supported, with the following |RCM| plugins managing each:
+
+* For LDAP/AD with user group sync use ``LDAP + User Groups (egg:rhodecode-enterprise-ee#ldap_group)``
+
+RhodeCode reads all data defined from plugin and creates corresponding
+accounts on local database after receiving data from LDAP. This is done on
+every user log-in including operations like pushing/pulling/checkout.
+In addition group membership is read from LDAP and following operations are done:
+
+- automatic addition of user to |RCM| user group
+- automatic removal of user from any other  |RCM| user groups not specified in LDAP.
+  The removal is done *only* on groups that are marked to be synced from ldap.
+  This setting can be changed in advanced settings on user groups
+- automatic creation of user groups if they aren't yet existing in |RCM|
+- marking user as super-admins if he is a member of any admin group defined in plugin settings
+
+This plugin is available only in EE Edition.
+
+.. important::
+
+   The email used with your |RCE| super-admin account needs to match the email
+   address attached to your admin profile in LDAP. This is because
+   within |RCE| the user email needs to be unique, and multiple users
+   cannot share an email account.
+
+   Likewise, if as an admin you also have a user account, the email address
+   attached to the user account needs to be different.
+
+
+LDAP Configuration Steps
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure |LDAP|, use the following steps:
+
+1. From the |RCM| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Enable the ldap+ groups plugin and select :guilabel:`Save`
+3. Select the :guilabel:`Enabled` check box in the plugin configuration section
+4. Add the required LDAP information and :guilabel:`Save`, for more details,
+   see :ref:`config-ldap-groups-examples`
+
+For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
+
+.. _config-ldap-groups-examples:
+
+Example LDAP configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. code-block:: bash
+
+        # Auth Cache TTL, Defines the caching for authentication to offload LDAP server.
+        # This means that cache result will be saved for 3600 before contacting LDAP server to verify the user access
+        3600
+        # Host, comma seperated format is optionally possible to specify more than 1 server
+        https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
+        # Default LDAP Port, use 689 for LDAPS
+        389
+        # Account, used for SimpleBind if LDAP server requires an authentication
+        e.g [e-mail]
+        # Password used for simple bind
+        ldap-user-password
+        # LDAP connection security
+        LDAPS
+        # Certificate checks level
+        DEMAND
+        # Base DN
+        cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
+        # User Search Base
+        ou=groups,ou=users
+        # LDAP search filter to narrow the results
+        (objectClass=person)
+        # LDAP search scope
+        SUBTREE
+        # Login attribute
+        sAMAccountName
+        # First Name Attribute to read
+        givenName
+        # Last Name Attribute to read
+        sn
+        # Email Attribute to read email address from
+        mail
+        # group extraction method
+        rfc2307bis
+        # Group search base
+        ou=RC-Groups
+        # Group Name Attribute, field to read the group name from
+        sAMAAccountName
+        # User Member of Attribute, field in which groups are stored
+        memberOf
+        # LDAP Group Search Filter, allows narrowing the results
+
+        # Admin Groups. Comma separated list of groups. If user is member of
+        # any of those he will be marked as super-admin in RhodeCode
+        admins, management
+
+
+Below is example setup that can be used with Active Directory and ldap groups.
+
+.. image:: ../images/ldap-groups-example.png
+   :alt: LDAP/AD setup example
+   :scale: 50 %
+
+.. toctree::
+
+   ldap-active-directory
+   ldap-authentication
  No newline at end of file

docs/auth/auth-ldap.rst

@@ -1,90 +1,89 b''
 .. _config-ldap-ref:
 
-LDAP
-----
+LDAP/AD
+-------
 
 |RCM| supports LDAP (Lightweight Directory Access Protocol) or
 AD (active Directory) authentication.
 All LDAP versions are supported, with the following |RCM| plugins managing each:
 
-* For LDAPv3 use ``LDAP (egg:rhodecode-enterprise-ce#ldap)``
-* For LDAPv3 with user group sync use ``LDAP + User Groups (egg:rhodecode-enterprise-ee#ldap_group)``
+* For LDAP or Active Directory use ``LDAP (egg:rhodecode-enterprise-ce#ldap)``
+
+RhodeCode reads all data defined from plugin and creates corresponding
+accounts on local database after receiving data from LDAP. This is done on
+every user log-in including operations like pushing/pulling/checkout.
 
 
 .. important::
 
    The email used with your |RCE| super-admin account needs to match the email
    address attached to your admin profile in LDAP. This is because
    within |RCE| the user email needs to be unique, and multiple users
    cannot share an email account.
 
    Likewise, if as an admin you also have a user account, the email address
    attached to the user account needs to be different.
 
+
 LDAP Configuration Steps
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
 To configure |LDAP|, use the following steps:
 
 1. From the |RCM| interface, select
    :menuselection:`Admin --> Authentication`
-2. Enable the required plugin and select :guilabel:`Save`
+2. Enable the ldap plugin and select :guilabel:`Save`
 3. Select the :guilabel:`Enabled` check box in the plugin configuration section
 4. Add the required LDAP information and :guilabel:`Save`, for more details,
    see :ref:`config-ldap-examples`
 
 For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
 
 .. _config-ldap-examples:
 
 Example LDAP configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
 .. code-block:: bash
 
-        # Auth Cache TTL
+        # Auth Cache TTL, Defines the caching for authentication to offload LDAP server.
+        # This means that cache result will be saved for 3600 before contacting LDAP server to verify the user access
         3600
-        # Host
+        # Host, comma seperated format is optionally possible to specify more than 1 server
         https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
-        # Port
+        # Default LDAP Port, use 689 for LDAPS
         389
-        # Account
-        cn=admin,dc=rhodecode,dc=com
-        # Password
+        # Account, used for SimpleBind if LDAP server requires an authentication
+        e.g [e-mail]
+        # Password used for simple bind
         ldap-user-password
         # LDAP connection security
         LDAPS
         # Certificate checks level
         DEMAND
         # Base DN
         cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
-        # User Search Base
-        ou=groups,ou=users
-        # LDAP search filter
+        # LDAP search filter to narrow the results
         (objectClass=person)
         # LDAP search scope
         SUBTREE
         # Login attribute
-        rmagillacuddy
-        # First Name Attribute
-        Rufus
-        # Last Name Attribute
-        Magillacuddy
-        # Email Attribute
-        [e-mail]
-        # User Member of Attribute
-        Organizational Role
-        # Group search base
-        cn=users,ou=groups,dc=rhodecode,dc=com
-        # LDAP Group Search Filter
-        (objectclass=posixGroup)
-        # Group Name Attribute
-        users
-        # Group Member Of Attribute
-        cn
-        # Admin Groups
-        admin,devops,qa
+        sAMAccountName
+        # First Name Attribute to read
+        givenName
+        # Last Name Attribute to read
+        sn
+        # Email Attribute to read email address from
+        mail
+
+
+Below is example setup that can be used with Active Directory/LDAP server.
+
+.. image:: ../images/ldap-example.png
+   :alt: LDAP/AD setup example
+   :scale: 50 %
+
 
 .. toctree::
 
    ldap-active-directory
    ldap-authentication

docs/auth/auth.rst

@@ -1,37 +1,32 b''
 .. _authentication-ref:
 
 Authentication Options
 ======================
 
-|RCE| provides a built in authentication plugin
-``rhodecode.lib.auth_rhodecode``. This is enabled by default and accessed
-through the administrative interface. Additionally,
-|RCE| provides a Pluggable Authentication System (PAS). This gives the
+|RCE| provides a built in authentication against its own database. This is
+implemented using ``rhodecode.lib.auth_rhodecode`` plugin. This plugin is
+enabled by default.
+Additionally, |RCE| provides a Pluggable Authentication System. This gives the
 administrator greater control over how users authenticate with the system.
 
 .. important::
 
   You can disable the built in |RCM| authentication plugin
   ``rhodecode.lib.auth_rhodecode`` and force all authentication to go
-  through your authentication plugin. However, if you do this,
-  and your external authentication tools fails, you will be unable to
-  access |RCM|.
+  through your authentication plugin of choice e.g LDAP only.
+  However, if you do this, and your external authentication tools fails,
+  you will be unable to access |RCM|.
 
 |RCM| comes with the following user authentication management plugins:
 
-.. only:: latex
-
-    * :ref:`config-ldap-ref`
-    * :ref:`config-pam-ref`
-    * :ref:`config-crowd-ref`
-    * :ref:`config-token-ref`
 
 .. toctree::
 
-    ldap-config-steps
-    crowd-auth
-    pam-auth
-    token-auth
+    auth-ldap
+    auth-ldap-groups
+    auth-crowd
+    auth-pam
+    auth-token
     ssh-connection
 
 

docs/conf.py

@@ -1,317 +1,316 b''
 # -*- coding: utf-8 -*-
 #
 # RhodeCode Enterprise documentation build configuration file, created by
 # sphinx-quickstart on Tue Nov  4 11:48:37 2014.
 #
 # This file is execfile()d with the current directory set to its
 # containing dir.
 #
 # Note that not all possible configuration values are present in this
 # autogenerated file.
 #
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
 import sys
 import os
 import datetime
 import sphinx_rtd_theme
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
 sys.path.insert(0, os.path.abspath('.'))
 import common
 
 # -- General configuration ------------------------------------------------
 
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 extensions = [
     'sphinx.ext.intersphinx',
     'sphinx.ext.todo',
     'sphinx.ext.imgmath'
 ]
 
 intersphinx_mapping = {
     'enterprise': ('https://docs.rhodecode.com/RhodeCode-Enterprise/', None),
     'control': ('https://docs.rhodecode.com/RhodeCode-Control/', None),
 }
 
 if tags.has('dev'):
     intersphinx_mapping.update({
         'enterprise': ('https://ci.rhodecode.com/documentation/Momentum/', None),
         'control': ('https://ci.rhodecode.com/documentation/Control/', None),
     })
 
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
 # The suffix of source filenames.
 source_suffix = '.rst'
 
 # The encoding of source files.
 #source_encoding = 'utf-8-sig'
 
 # The master toctree document.
 master_doc = 'index'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
 
 # TODO: johbo: Move into common package for documentation utilities
 def _get_version():
     with open('../rhodecode/VERSION') as f:
         return f.read().strip()
 
 # The full version, including alpha/beta/rc tags.
 release = _get_version()
 # The short X.Y version.
 version = '.'.join(release.split('.', 2)[:2])  # First two parts of release
 
 # General information about the project.
 project = u'RhodeCode Enterprise %s ' % _get_version()
 copyright = u'2010-{now.year}, RhodeCode GmbH'.format(
     now=datetime.datetime.today())
 
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 #language = None
 
 rst_epilog = common.rst_epilog + """
 .. |async| replace:: asynchronous
 """
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
 #today = ''
 # Else, today_fmt is used as the format for a strftime call.
 #today_fmt = '%B %d, %Y'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 exclude_patterns = [
     # Special directories
     '_build',
     'result',
 
     # Other RST files
     'admin/rhodecode-backup.rst',
-    'auth/ldap-configuration-example.rst',
     'issue-trackers/redmine.rst',
     'known-issues/error-msg-guide.rst',
     'tutorials/docs-build.rst',
     'integrations/example-ext.py',
     'collaboration/supported-workflows.rst',
 ]
 
 
 # The reST default role (used for this markup: `text`) to use for all
 # documents.
 #default_role = None
 
 # If true, '()' will be appended to :func: etc. cross-reference text.
 #add_function_parentheses = True
 
 # If true, the current module name will be prepended to all description
 # unit titles (such as .. function::).
 #add_module_names = True
 
 # If true, sectionauthor and moduleauthor directives will be shown in the
 # output. They are ignored by default.
 #show_authors = False
 
 # The name of the Pygments (syntax highlighting) style to use.
 pygments_style = 'sphinx'
 
 # A list of ignored prefixes for module index sorting.
 #modindex_common_prefix = []
 
 # If true, keep warnings as "system message" paragraphs in the built documents.
 keep_warnings = tags.has("dev")
 
 
 # -- Options for HTML output ----------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #html_theme = 'rctheme'
 html_theme = 'sphinx_rtd_theme'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
 #html_theme_options = {}
 html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 
 # Add any paths that contain custom themes here, relative to this directory.
 #html_theme_path = []
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".
 #html_title = None
 
 # A shorter title for the navigation bar.  Default is the same as html_title.
 #html_short_title = None
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
 #html_logo = None
 html_sidebars = {
    '**': ['globaltoc.html'],
 }
 
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
 # pixels large.
 html_favicon = 'images/favicon.ico'
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = ['static/css/add.css']
 
 # Add any extra paths that contain custom files (such as robots.txt or
 # .htaccess) here, relative to this directory. These files are copied
 # directly to the root of the documentation.
 #html_extra_path = []
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.
 #html_last_updated_fmt = '%b %d, %Y'
 
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
 #html_use_smartypants = True
 
 # Custom sidebar templates, maps document names to template names.
 #html_sidebars = {}
 
 # Additional templates that should be rendered to pages, maps page names to
 # template names.
 #html_additional_pages = {}
 
 # If false, no module index is generated.
 #html_domain_indices = True
 
 # If false, no index is generated.
 #html_use_index = True
 
 # If true, the index is split into individual pages for each letter.
 #html_split_index = False
 
 # If true, links to the reST sources are added to the pages.
 #html_show_sourcelink = True
 
 # If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
 #html_show_sphinx = True
 
 # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
 #html_show_copyright = True
 
 # If true, an OpenSearch description file will be output, and all pages will
 # contain a <link> tag referring to it.  The value of this option must be the
 # base URL from which the finished HTML is served.
 #html_use_opensearch = ''
 
 # This is the file name suffix for HTML files (e.g. ".xhtml").
 #html_file_suffix = None
 
 # Output file base name for HTML help builder.
 htmlhelp_basename = 'rhodecode-enterprise'
 
 
 # -- Options for LaTeX output ---------------------------------------------
 
 latex_elements = {
     'classoptions': ',oneside',
     'babel': '\\usepackage[english]{babel}',
 
 # The paper size ('letterpaper' or 'a4paper').
 #'papersize': 'letterpaper',
 
 # The font size ('10pt', '11pt' or '12pt').
 #'pointsize': '10pt',
 
 # Additional stuff for the LaTeX preamble.
 #'preamble': '',
 }
 
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
   ('index', 'RhodeCodeEnterprise.tex', u'RhodeCode Enterprise',
    u'RhodeCode GmbH', 'manual'),
 ]
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
 #latex_logo = None
 
 # For "manual" documents, if this is true, then toplevel headings are parts,
 # not chapters.
 #latex_use_parts = False
 
 # If true, show page references after internal links.
 latex_show_pagerefs = True
 
 # If true, show URL addresses after external links.
 latex_show_urls = 'footnote'
 
 # Documents to append as an appendix to all manuals.
 #latex_appendices = []
 
 # If false, no module index is generated.
 #latex_domain_indices = True
 
 # Mode for literal blocks wider than the frame. Can be
 # overflow, shrink or truncate
 pdf_fit_mode = "truncate"
 
 
 # -- Options for manual page output ---------------------------------------
 
 # One entry per manual page. List of tuples
 # (source start file, name, description, authors, manual section).
 man_pages = [
     ('index', 'rhodecodeenterprise', u'RhodeCode Enterprise',
      [u'RhodeCode GmbH'], 1)
 ]
 
 # If true, show URL addresses after external links.
 #man_show_urls = False
 
 
 # -- Options for Texinfo output -------------------------------------------
 
 # Grouping the document tree into Texinfo files. List of tuples
 # (source start file, target name, title, author,
 #  dir menu entry, description, category)
 texinfo_documents = [
   ('index', 'RhodeCodeEnterprise', u'RhodeCode Enterprise',
    u'RhodeCode Docs Team', 'RhodeCodeEnterprise', 'RhodeCode Docs Project',
    'Miscellaneous'),
 ]
 
 # Documents to append as an appendix to all manuals.
 #texinfo_appendices = []
 
 # If false, no module index is generated.
 #texinfo_domain_indices = True
 
 # How to display URL addresses: 'footnote', 'no', or 'inline'.
 #texinfo_show_urls = 'footnote'
 
 # If true, do not generate a @detailmenu in the "Top" node's menu.
 #texinfo_no_detailmenu = False
 
 # We want to see todo notes in case of a pre-release build of the documentation
 todo_include_todos = tags.has("dev")