diff --git a/app/portainer/settings/authentication/auto-user-provision-toggle/index.js b/app/portainer/settings/authentication/auto-user-provision-toggle/index.js
new file mode 100644
index 000000000..68c7b95d1
--- /dev/null
+++ b/app/portainer/settings/authentication/auto-user-provision-toggle/index.js
@@ -0,0 +1,9 @@
+export const autoUserProvisionToggle = {
+ templateUrl: './auto-user-provision-toggle.html',
+ transclude: {
+ description: 'fieldDescription',
+ },
+ bindings: {
+ ngModel: '=',
+ },
+};
diff --git a/app/portainer/settings/authentication/index.js b/app/portainer/settings/authentication/index.js
new file mode 100644
index 000000000..a6e907ebe
--- /dev/null
+++ b/app/portainer/settings/authentication/index.js
@@ -0,0 +1,12 @@
+import angular from 'angular';
+
+import ldapModule from './ldap';
+
+import { autoUserProvisionToggle } from './auto-user-provision-toggle';
+import { autoTeamMembershipToggle } from './auto-team-membership-toggle';
+
+export default angular
+ .module('portainer.settings.authentication', [ldapModule])
+
+ .component('autoUserProvisionToggle', autoUserProvisionToggle)
+ .component('autoTeamMembershipToggle', autoTeamMembershipToggle).name;
diff --git a/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js
new file mode 100644
index 000000000..4a988b321
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js
@@ -0,0 +1,61 @@
+import _ from 'lodash-es';
+
+export default class AdSettingsController {
+ /* @ngInject */
+ constructor(LDAPService) {
+ this.LDAPService = LDAPService;
+
+ this.domainSuffix = '';
+
+ this.onTlscaCertChange = this.onTlscaCertChange.bind(this);
+ this.searchUsers = this.searchUsers.bind(this);
+ this.searchGroups = this.searchGroups.bind(this);
+ this.parseDomainName = this.parseDomainName.bind(this);
+ this.onAccountChange = this.onAccountChange.bind(this);
+ }
+
+ parseDomainName(account) {
+ this.domainName = '';
+
+ if (!account || !account.includes('@')) {
+ return;
+ }
+
+ const [, domainName] = account.split('@');
+ if (!domainName) {
+ return;
+ }
+
+ const parts = _.compact(domainName.split('.'));
+ this.domainSuffix = parts.map((part) => `dc=${part}`).join(',');
+ }
+
+ onAccountChange(account) {
+ this.parseDomainName(account);
+ }
+
+ searchUsers() {
+ return this.LDAPService.users(this.settings);
+ }
+
+ searchGroups() {
+ return this.LDAPService.groups(this.settings);
+ }
+
+ onTlscaCertChange(file) {
+ this.tlscaCert = file;
+ }
+
+ addLDAPUrl() {
+ this.settings.URLs.push('');
+ }
+
+ removeLDAPUrl(index) {
+ this.settings.URLs.splice(index, 1);
+ }
+
+ $onInit() {
+ this.tlscaCert = this.settings.TLSCACert;
+ this.parseDomainName(this.settings.ReaderDN);
+ }
+}
diff --git a/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html
new file mode 100644
index 000000000..29c7d7008
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html
@@ -0,0 +1,115 @@
+
+
+ With automatic user provisioning enabled, Portainer will create user(s) automatically with standard user role and assign them to team(s) which matches to LDAP group name(s). If
+ disabled, users must be created in Portainer beforehand.
+
+
+
+
+
+ Information
+
+
+ When using Microsoft AD authentication, Portainer will delegate user authentication to the Domain Controller(s) configured below; if there is no connectivity, Portainer will
+ fallback to internal authentication.
+
+
+
+
+ AD configuration
+
+
+
+
+
+
+ You can configure multiple AD Controllers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all use the
+ same certificates).
+
+ When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.
+
+
+
+
+ LDAP configuration
+
+
+
+
+
+
+ You can configure multiple LDAP Servers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all use the
+ same certificates).
+
+ When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.
+
+
+
+
+ LDAP configuration
+
+
+
+
+
+
+ You can configure multiple LDAP Servers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all use the
+ same certificates).
+
+
+
+ With automatic user provisioning enabled, Portainer will create user(s) automatically with standard user role and assign them to team(s) which matches to LDAP group name(s).
+ If disabled, users must be created in Portainer beforehand.
+
+
+
+
- When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.
-
-
+
-
- LDAP configuration
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- LDAP security
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {{ formValues.TLSCACert.name }}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Automatic user provisioning
-
-
-
- With automatic user provisioning enabled, Portainer will create user(s) automatically with standard user role and assign them to team(s) which matches to LDAP group
- name(s). If disabled, users must be created in Portainer beforehand.
-
-