# LDAP — Zammad ke Active Directory

> **Terakhir Diperbarui:** 2026-07-02  
> **AD:** `10.100.1.40` · domain `gisportal.id`  
> ⚠️ Bind password **tidak** didokumentasikan di repo — sama dengan `geonet-console` `.env`

---

## Prasyarat

- [x] Zammad setup wizard selesai (admin `support@geonet.co.id`)
- [x] Koneksi TCP `10.100.1.40:389` dari container Zammad
- [x] LDAP bind + search uji dari container (`BIND_OK`, `SEARCH_OK`)
- [x] LDAP source `GIS Portal AD` dikonfigurasi & first sync selesai (2026-07-02)

---

## Test koneksi (sudah diverifikasi 2026-07-02)

Dari server `10.100.1.24`:

```bash
# TCP
nc -zv -w5 10.100.1.40 389

# Bind + search (script di /tmp/ldap-test.rb via rails runner)
source /opt/stacks/geonet-console/.env
docker exec -e LDAP_HOST -e LDAP_PORT -e LDAP_BASE_DN -e LDAP_BIND_DN -e LDAP_BIND_PASSWORD \
  zammad-zammad-railsserver-1 bundle exec rails runner /tmp/ldap-test.rb
# Harapan: BIND_OK + SEARCH_OK
```

Credential bind **reuse** dari `/opt/stacks/geonet-console/.env` (sama dengan geonet-console).

---

## Step-by-step — UI Zammad

Login admin → **https://zammad.gisportal.id**

### Langkah 1 — Buka menu LDAP (Zammad 7)

⚠️ **Penting — jangan salah menu:**

| Lokasi | Isi | LDAP? |
|--------|-----|-------|
| **Settings** → **Security** → *Third-party applications* | SAML, SSO | ❌ Bukan di sini |
| **Settings** → **System** | Base, Storage, Network, Frontend | ❌ Bukan di sini |
| **System** → **Integrations** | LDAP, GitHub, Exchange, … | ✅ **Di sini** |

Di Zammad 7 ada **dua menu terpisah** di panel Admin (ikon ⚙️):

1. **Settings** (`#settings`) — branding, security, ticket, dll.
2. **System** (`#system`) — integrations, API, maintenance, dll.

LDAP ada di menu **System** (bukan di dalam Settings → System).

Path yang benar:

**Admin** (⚙️) → **System** → **Integrations** → klik **LDAP**

Atau langsung buka URL:

```
https://zammad.gisportal.id/#system/integration/ldap
```

> URL `#settings/integration/ldap` **tidak ada** di Zammad 7 — itu penyebab halaman tidak merespons.

Klik **New Source** untuk menambah sumber LDAP baru.

> Referensi resmi: [Zammad Admin — LDAP / Active Directory](https://admin-docs.zammad.org/en/latest/system/integrations/ldap/)

---

### Langkah 2 — Connection

| Field UI | Nilai |
|----------|-------|
| **Name** | `GIS Portal AD` |
| **Host** | `10.100.1.40` |
| **Port** | `389` |
| **SSL** | **Off** / unchecked *(sama geonet-console: `LDAP_USE_SSL=false`)* |
| **Base DN** | `DC=gisportal,DC=id` |
| **Bind user** | `Administrator@gisportal.id` |
| **Bind password** | *(dari `.env` geonet-console — `LDAP_BIND_PASSWORD`)* |

Klik **Test connection** jika ada — harus sukses.

---

### Langkah 3 — User filter & attributes

| Field UI | Nilai |
|----------|-------|
| **User filter** | `(&(objectClass=user)(objectCategory=person))` |
| **Login attribute** | `sAMAccountName` |
| **Email attribute** | `mail` |
| **Firstname** | `givenName` |
| **Lastname** | `sn` |
| **Username attribute** | `sAMAccountName` |

Opsi yang disarankan:

- **Sync users on login** — ✅ aktif
- **Create user on login** — ✅ aktif (user AD otomatis dibuat di Zammad)

---

### Langkah 4 — Role / group mapping (disarankan)

Setelah user AD bisa login, petakan AD group → Zammad role:

| AD group (contoh) | Zammad role |
|-------------------|-------------|
| `Domain Admins` / `IT-Admin` *(sesuaikan)* | **Admin** |
| `Domain Users` atau group support | **Agent** |
| *(default)* | **Customer** |

Di LDAP config Zammad, bagian **Role mapping** / **Group mapping**:

- Attribute group: `memberOf`
- Filter group: `(objectClass=group)`

> Nama group AD cek di AD atau geonet-console → LDAP Users/Groups.

---

### Langkah 5 — Aktifkan LDAP login

- Set LDAP sebagai metode login (nonaktifkan signup publik jika ada)
- **Settings → System → Login** — pastikan hanya LDAP / AD untuk user internal

---

### Langkah 6 — Uji login

1. **Logout** dari admin Zammad
2. Login dengan user AD uji, mis. `sAMAccountName` + password AD *(bukan email, kecuali UI minta UPN)*
3. Cek **Manage → Users** — user AD muncul setelah login pertama

---

## Parameter referensi (geonet-console)

| Env geonet-console | Nilai |
|--------------------|-------|
| `LDAP_HOST` | `10.100.1.40` |
| `LDAP_PORT` | `389` |
| `LDAP_BASE_DN` | `DC=gisportal,DC=id` |
| `LDAP_BIND_DN` | `Administrator@gisportal.id` |
| `LDAP_GROUP_CONTAINER_DN` | `CN=Users,DC=gisportal,DC=id` |
| `LDAP_ADMIN_GROUPS` | `Domain Admins,Administrators,Enterprise Admins` |

---

## Troubleshooting

| Gejala | Penyebab | Tindakan |
|--------|----------|----------|
| LDAP tidak ada di menu | Salah buka **Settings → Security** atau **Settings → System** | Buka **System → Integrations** (menu terpisah, bukan di dalam Settings) |
| URL `#settings/integration/ldap` tidak respon | Route Zammad 7 pakai `#system`, bukan `#settings` | Pakai `https://zammad.gisportal.id/#system/integration/ldap` |
| Hanya SAML/SSO di Third-party | Itu menu autentikasi SAML, bukan LDAP sync | LDAP ada di **System → Integrations** |
| Test connection gagal | Bind password salah | Cek `/opt/stacks/geonet-console/.env` |
| Login gagal, bind OK | Login attribute salah | Pakai `sAMAccountName`, bukan email |
| User tanpa email | Atribut `mail` kosong di AD | Isi mail di AD atau fallback di Zammad |
| Tidak bisa reach AD | Firewall | Pastikan `.24` → `.40:389` (sudah OK) |

---

## Setelah LDAP OK

- [x] Update `docs/project-status.md` — LDAP ✅ (2026-07-02)
- [ ] Role mapping AD group → Zammad role
- [ ] Uji login user AD (`sAMAccountName`)
- [ ] Tindak 3 user gagal sync (cek `mail` di AD)
- [ ] Buat **API token** untuk FE `/ticketing`
- [ ] Lanjut `mysupperapps_FE_PWA` — halaman `/ticketing`

Lihat `docs/roadmap.md` dan `docs/todo.md` untuk urutan lengkap.