wmantly
fe9b7c168b
All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one container, plus an idempotent bare-metal install.sh, and a Jekyll docs site for GitHub Pages: - Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/ refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /). - docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes + access), self-signed LDAPS cert, seed directory tree + required groups, bundled redis, export app_* config, exec node. - docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example. - install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x, OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app. - ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs. - nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost / SSO Manager) so per-deployment values move to secrets.js or app_* env. - nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides). - nodejs/routes/index.js: /health endpoint for healthchecks. - docs/: _config.yml + index/deployment/configuration/oauth/ldap pages (jekyll-theme-cayman) for GitHub Pages from /docs. Co-Authored-By: Claude <noreply@anthropic.com>
105 lines
3.6 KiB
Markdown
105 lines
3.6 KiB
Markdown
---
|
|
layout: default
|
|
title: Home
|
|
---
|
|
|
|
# SSO Manager
|
|
|
|
A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory**
|
|
and a web management UI — for home labs and small businesses that want their
|
|
own identity provider instead of a hosted one.
|
|
|
|
## Features
|
|
|
|
- **OpenID Connect / OAuth 2.0 provider** — issue your own access/refresh/id
|
|
tokens; protect your apps with OIDC login.
|
|
- **OpenLDAP directory** — users, groups, POSIX accounts (`posixAccount`/
|
|
`inetOrgPerson`), SSH public keys, and sudo roles, with `memberOf` +
|
|
referential-integrity overlays.
|
|
- **Web management UI** — manage users, groups, and OAuth clients from a
|
|
browser; invite/password-reset flows over email.
|
|
- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, …)
|
|
can use LDAPS (636) / StartTLS.
|
|
- **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
|
|
run each piece separately via `app_*` env config.
|
|
|
|
## Quick Start
|
|
|
|
### Docker (all-in-one)
|
|
|
|
```bash
|
|
git clone https://github.com/theta42/sso-manager-node.git
|
|
cd sso-manager-node
|
|
cp secrets.js.example nodejs/conf/secrets.js # edit it, or use app_* env
|
|
docker compose up -d --build
|
|
```
|
|
|
|
The web UI comes up at `http://localhost:3001`. See the
|
|
[Deployment Guide](deployment.html) for the full set of `app_*` env vars.
|
|
|
|
### Bare metal (Debian/Ubuntu)
|
|
|
|
```bash
|
|
sudo ./install.sh
|
|
```
|
|
|
|
Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app,
|
|
and starts a systemd unit. Re-run to update.
|
|
|
|
### Run it together with the proxy
|
|
|
|
The proxy ([theta42/proxy](https://github.com/theta42/proxy)) fronts this SSO
|
|
under TLS and protects it with OIDC, while also binding LDAP directly. Run both
|
|
with one command via [theta-env](https://github.com/theta42/theta-env):
|
|
|
|
```bash
|
|
git clone --recursive https://github.com/theta42/theta-env.git
|
|
cd theta-env && cp .env.example .env # edit, then:
|
|
./setup.sh
|
|
```
|
|
|
|
## Documentation
|
|
|
|
- [Deployment Guide](deployment.html) — Docker + bare metal, the config layers,
|
|
the `app_*` env reference, backups.
|
|
- [Configuration](configuration.html) — every `app_*` env var and the conf
|
|
merge order.
|
|
- [OAuth / OIDC](oauth.html) — the provider: discovery, client management,
|
|
token lifetimes, scopes.
|
|
- [LDAP](ldap.html) — directory layout, TLS, overlays, schema, direct-bind
|
|
service accounts.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
┌─────────────┐
|
|
│ Browser / │
|
|
│ OIDC apps │
|
|
└──────┬──────┘
|
|
│ HTTP/HTTPS
|
|
▼
|
|
┌────────────────────────┐ ┌─────────────┐
|
|
│ Express SSO Manager │◄────►│ Redis │
|
|
│ - OIDC provider │ │ - sessions │
|
|
│ - web UI (:3001) │ │ - models │
|
|
│ - management API │ └─────────────┘
|
|
└────────┬───────────────┘
|
|
│ ldapi/ldap (localhost)
|
|
▼
|
|
┌────────────────────────┐
|
|
│ OpenLDAP (slapd) │
|
|
│ - users / groups │
|
|
│ - LDAPS :636 │─── legacy apps bind directly
|
|
│ - StartTLS :389 │
|
|
└────────────────────────┘
|
|
```
|
|
|
|
## Community
|
|
|
|
- [GitHub Repository](https://github.com/theta42/sso-manager-node)
|
|
- [Issue Tracker](https://github.com/theta42/sso-manager-node/issues)
|
|
- [Pull Requests](https://github.com/theta42/sso-manager-node/pulls)
|
|
|
|
## License
|
|
|
|
MIT License — see the repository for details. |