(LDAP) integrated authentication for Loomio?
Nick S PublicSeen by 69This has been asked elsewhere before, but I'd like to revive it, and ask for some clarification.
Background: I help run social.coop, an experiment in a cooperatively owned and run social media site (specifically, it's a Mastodon site). We have a Loomio subscription which we use for governance matters.
However, we have a difficulty, in that our users find it hard to navigate the various log-ins, and it's hard for us to ensure that paid up members get access to the right places, without simply expecting them to follow a long laundry list of registration instructions.
Likewise, my local hackerspace voted to use Loomio, but this was effectively vetoed by the sysadmin team who refused to add anything which didn't have LDAP integration. They have a point.
The point being: managing user accounts across several systems becomes an admin nightmare when you have a constantly shifting membership, and if this is left to the users typically this becomes to burdensome for them to bother, and drives people away.
Hopefully you see the need for some a to integrate Loomio's account management in these circumstances, I'm pretty sure our cases aren't unique. The problem will be a barrier for adopting Loomio in many cases.
Could I ask:
- Have the plans not to integrate LDAP changed?
- Assuming not, what would be needed for it to change?
- We don't have much in the way of funds, but if we can contribute labour, how can we best ensure the result gets picked up and maintained in house by Loomio?
If I recall, someone in the past has implemented a "good enough for me" LDAP integration, but this never went beyond that.
As an aside:
- I also can't find any information about Loomio plug-ins, do they exist?
- Some other mechanism besides LDAP may be acceptable so long as it is commonly supported by the other applications we use. Specifically in our case:
- Mastodon
- GitLab
- Potentially other services like Dovecot (email), Matrix (chat) and the like.
Super briefly, (but hopefully more helpfully) if you want to integrate SAML, assuming you're using our docker-compose based system.
Add the following to your env file:
```
SAML
SAML_APP_KEY=1 # just a value to indicate true
SAML_IDP_METADATA_URL=https://login.provider.com/idp/metadata # the IDP metadata url of the SAML server.
```
I expect you'll need a SDP metadata url on the auth server, pointing to your loomio install. That would be something like: https://loomio.example.com/saml/metadata
But replacing loomio.example.com with your own hostname.
Thanks - this is encouraging. We're not using docker-compose - we use this instance - but we could.
I'd have to research which of LDAP/SAML/OAUTH is most suitable. Standards, eh.
Would using any of these be contingent on you not going the enterprise route with it? We're not really an enterprise, and $10k for a managed instance is totally out of the question, but we pay Gold level for our use on this instance. How much might we have to pay in that case?
Hi @wulee. Thanks for using Loomio, and for bringing this up.
We have LDAP integration - Well, to be specific, we have SAML integration and we have OAUTH integration.
I've not documented this yet (we're considering making it a private repo and charging enterprise clients for it), but tell me which of those you're planning on using and I'll provide some guidance.