
kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-config
  namespace: stats
  labels:
    app: grafana
data:
  ldap.toml: |
    [[servers]]
    # Ldap server host (specify multiple hosts space separated)
    host = "ad.fnptr.net"
    # Default port is 389 or 636 if use_ssl = true
    port = 389
    # Set to true if LDAP server supports TLS
    use_ssl = false
    # Set to true if connect LDAP server with STARTTLS pattern (create connection in insecure, then upgrade to secure connection with TLS)
    start_tls = false
    # set to true if you want to skip SSL cert validation
    ssl_skip_verify = false
    # set to the path to your root CA certificate or leave unset to use system defaults
    # root_ca_cert = "/path/to/certificate.crt"
    # Authentication against LDAP servers requiring client certificates
    # client_cert = "/path/to/client.crt"
    # client_key = "/path/to/client.key"

    # Search user bind dn
    bind_dn = "cn=authbind,cn=serviceaccounts,dc=ad,dc=fnptr,dc=net"
    # Search user bind password
    # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
    bind_password = '${LDAP_AUTHBIND_PASSWORD}'

    # User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
    # Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
    search_filter = "(sAMAccountName=%s)"

    # An array of base dns to search through
    search_base_dns = ["cn=users,dc=ad,dc=fnptr,dc=net"]

    # group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))"
    # group_search_filter_user_attribute = "distinguishedName"
    # group_search_base_dns = ["ou=groups,dc=grafana,dc=org"]

    [[servers.group_mappings]]
    group_dn = "CN=System Admins,CN=Groups,DC=ad,DC=fnptr,DC=net"
    org_role = "Admin"
    grafana_admin = true

    # Specify names of the LDAP attributes your LDAP uses
    [servers.attributes]
    name = "givenName"
    surname = "sn"
    username = "sAMAccountName"
    member_of = "memberOf"
    email =  "email"