teamcity-ldap-sync

LDAP groups sync for TeamCity

View on GitHub

teamcity-ldap-sync – Sync your Teamcity groups and users with LDAP directory server

The teamcity-ldap-sync script is used for one side sync of existing LDAP groups and users into Teamcity. Idea taken zabbix-ldap-sync

Tested on:
For test and development:

Copy-paste to your shell

cd && mkdir teamcity-test-srv && \
docker run -it --name teamcity-server \
-v $HOME/teamcity-test-srv/:/data/teamcity_server/datadir \
-v $HOME/teamcity-test-srv/:/opt/teamcity/logs      \
-p 80:8111     \
jetbrains/teamcity-server:10.0.4

Open browser, configure teamcity, paste user credential to teamcity-ldap.conf, test it.

Requirements

Configuration

Teamcity user should have System Administrator role.

Config file sections

[ldap]

[openldap]

[teamcity]

Configuration file example

[ldap]
type = activedirectory
uri = ldap://company.com:389/
base = dc=company,dc=com
binduser = domain_login
bindpass = domain_password
groups = R.*.Teamcity.*

[ad]
filtergroup = (&(objectClass=group)(name=%s))
filteruser = (objectClass=user)(objectCategory=Person)
filterdisabled = (!(userAccountControl:1.2.840.113556.1.4.803:=2))
filtermemberof = (memberOf:1.2.840.113556.1.4.1941:=%s)
groupattribute = member
userattribute = sAMAccountName

[openldap]
type = posix
filtergroup = (&(objectClass=posixGroup)(cn=%s))
filteruser = (&(objectClass=posixAccount)(uid=%s))
groupattribute = memberUid
userattribute = uid

[teamcity]
server = http://localhost
username = teamcity_user_login
password = teamcity_user_password
verify_certificate = False

Command-line arguments

Usage: teamcity-ldap-sync [-sr] -f <config>
       teamcity-ldap-sync -h

Options:
  -h, --help                    Display this usage info
  -s, --skip-disabled           Skip disabled AD users
  -r, --recursive               Resolves AD group members recursively (i.e. nested groups)
  -f <config>, --file <config>  Configuration file to use

Importing LDAP users into Teamcity

Now that we have the above mentioned configuration file created, let’s import our groups and users from LDAP to Teamcity.

$ teamcity-ldap-sync -f /path/to/teamcity-ldap.conf

You would generally be running the above scripts on regular basis, say each day from cron(8) in order to make sure your Teamcity is in sync with LDAP.

TODO: