Feel free to open a #992916353847668756 thread for this!

is there a way to always start the server with

force-ldap-user-pass-reset

? I'd like to just change it when i rotate the password, but can't leave the flag active, because it will fail with

Error: Restart the server without --force-update-private-key or --force-ldap-user-pass-reset to continue.

Why not just call lldap_set_user_password?

Without restarting the server

That would require having the admin password in the first place for authentication, doesnt it?

Yes

is your question about rotating the password, to reset it in case of forgetting it or both?

both kind of. I manage my passwords in sops. When i change the password with sops, say by automatically rotating it, i would like to change it automatically for the admin. So best case would be that i can always run LLDAP with

force-ldap-user-pass-reset

and it would just reset the admin PW to whatever the env variable is

How do you automate the restart of LLDAP?

its managed with sd-switch. basically when the hash of the systemd unit changes, it gets restarted automatically

That's a fancy setup you have here 😄 Looking at the docs, I realize that your use case is already supported: you need to set force_ldap_user_pass_reset to "always"

ahh yes, i knew i stumbled across this before but couldnt find it again. Thanks!

and yes, i'm a Nix(OS) fanboy, you can't go back once you started making everything declarative ;D

I will start using nixos in like 1-2 days 😅

you'll like it

hopefully ;D

I hope so too 😅

you can even use Nix on non NixOS distros, many people don't know

its a nice start playing around with Home Manager before jumping to NixOS

Yeah, but I went with the vm approach for a while now. I just didn't like mixing it

even better, nice one

i try to do as much as in HM as possible ;D

Been using NixOS on the server for years now, including running LLDAP. Its great, but the learning curve can be brutal 😅

I see that group inheritance is still open on the roadmap (sadly since '22) but would it be possible to use a custom multi value attribute and a corresponding filter to Authelia to add a list of groups to a user in one go? I tried it but I don't really understand the filter syntax...

You can make "meta groups" that represent several other groups, at the cost of making all your filters more complicated: instead of "is user in group X", it becomes "is user or group X or the meta group"

That would be enough for me, is there anywhere an example config for that?

The syntax for an "or" condition is

(| condition-1 condition-2)

with each condition being a parenthesized expression

So something like

(| (memberOf=...) (memberOf=...) )

Is it possible to give a user or a group write permission to only specific attributes?

No, permissions are very coarse grain