Typical LDAP Configurations
This page contains samples of the
ldap-config.properties file for different configuration cases.
Basic LDAP Login
The examples of minimal working configurations are given below.
Windows Active Directory
sAMAccountName is limited to 20 symbols. You might want to use another attribute which contains the entire username.
TeamCity does not store the user passwords in this case. On each user login, authentication is performed by a direct login into LDAP with the credentials entered in the login form.
Specifying Backup LDAP server
You can specify a backup LDAP server in the
java.naming.provider.url property as follows:
Basic LDAP Login for Users in Specific LDAP Group Only
Only users from a specific user group are allowed to log in. The users need to enter the username only the without domain part to log in. The example is for Windows Active Directory:
Active Directory With User Details Synchronization
Users can log in to TeamCity with their domain name without the domain part, there is an account "teamcity" with the password "secret" that can read all Active Directory entries. The TeamCity user display name and email are synchronized from Active Directory.
Active Directory With User Details Synchronization and User Creation
Users can log in to TeamCity with their domain name without the domain part, there is an account "teamcity" with the password "secret" that can read all Active Directory entries. The TeamCity user display name and email are synchronized from Active Directory. The users not existing in the TeamCity database are created. Users no longer existing in Active Directory are deleted from the TeamCity user database.
Active Directory With Group Synchronization
There should be
ldap-mapping.xml file with one or more group mappings defined.
java.naming.provider.url=ldap://example.com:389/DC=example,DC=com java.naming.security.principal=CN=teamcity,CN=Users,DC=example,DC=com java.naming.security.credentials=secret teamcity.users.login.filter=(sAMAccountName=$capturedLogin$) teamcity.users.username=sAMAccountName # User synchronization is on, synchronize display name and email. teamcity.options.users.synchronize=true teamcity.users.filter=(objectClass=user) teamcity.users.property.displayName=displayName teamcity.users.property.email=mail # Automatic user creation and deletion during users synchronization teamcity.options.createUsers=true teamcity.options.deleteUsers=true # Groups synchronization is on teamcity.options.groups.synchronize=true # The group search LDAP filter used to retrieve groups to synchronize. # The result includes all the groups configured in the ldap-mapping.xml file. teamcity.groups.filter=(objectClass=group) # The LDAP attribute of a group storing its members. teamcity.groups.property.member=member
Limiting the number of groups to be synchronized
teamcity.users.filter property helps limit the number of processed user accounts during users synchronization.
It is recommended to create the "TeamCity Users" group in Active Directory, and include all your required groups into this group, for example, you may have the following Active Directory structure:
Group A with members User 1, User 2
Group B with members User 3, User 4
Group "TeamCity Users" with members Group A, Group B
Then update the
teamcity.users.filter property. For example,
In this case TeamCity creates accounts only if they are members of the corresponding Active Directory group. Nested groups are supported.
Alternatively, you can list several groups:
To limit users who can login into TeamCity you also need to change the