LDAP Inviter Bot
This is a maubot plugin that invites users to Matrix rooms according to their membership in LDAP groups. It was built in an educational context, where groups of students work on software projects. The bot ensures that participating students are invited to all rooms (general chat, announcement-only, helpdesk & their group chat) and that tutors have correct power levels in the corresponding rooms.
Features:
- Ensure that a room with the configured alias exists and has the correct name
- Invite users from LDAP and from the config and give them the configured power levels
- Set the room visibility
- Room aliases, room names and LDAP DNs are templateable.
- Matrix IDs of LDAP users are generated using the
uidattribute from LDAP and a configurable homeserver. - The bot does not remove or uninvite users from rooms. This is intentional, to allow students to join with their own Matrix accounts.
Notes
Dependencies
This Bot requires the python-ldap library. It must be installed manually in the python environment used by your Maubot instance. If you run Maubot via the official Docker image, run apk add py3-pyldap in the container.
Rate Limiting
The bot will quickly run into rate limits. You can use the Synapse Admin API to remove rate limits for the bot user. See https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users for more details.
Config
# LDAP config
ldap:
uri: 'ldap://foo.bar.tld:389' # URI of your LDAP server
base_dn: 'cn=users,dc=foo,dc=bar,dc=tld' # base-DN of your user objects
connect_dn: 'uid=ldap-bot,cn=users,dc=foo,dc=bar,dc=tld' # DN of the user used to bind
connect_password: 'verySecure' # password of the user used to bind
user_filter: '(objectClass=inetOrgPerson)'
mxid_homeserver: 'matrix.server.tld' # Homeserver used to generate MXIDs from LDAP uids
# Rooms that should be synced
sync_rooms:
- alias: '#event-<1>-group-1:matrix.server.tld' # Aliases can include '<1>' placeholders
# Should the room be visible in the room list?
# Can be 'private' or 'public'
visibility: 'private'
# Names can include '<1>' placeholders
name: 'Foo <1>'
# LDAP members for this room
ldap_members:
- ldap_group: 'cn=event-<1>-group1,cn=groups,dc=foo,dc=bar,dc=tld'
power_level: 0
# Groups can include '<1>' placeholders
- ldap_group: 'cn=event-<1>-tutors1,cn=groups,dc=foo,dc=bar,dc=tld'
power_level: 100
# Hardcoded members for this room
members:
- mxid: '@super.admin:matrix.server.tld'
power_level: 100
# Users that are allowed to run a sync
admin_users:
- '@super.admin:matrix.server.tld'
Usage
To check the connection to your LDAP server, write !ldap-check in a room with the bot. It will print out the computed members for all configured rooms. If you used the <1> placeholder in the config file, you will need to provide a value for arg.
To run the actual invite process, write !ldap-sync in a room with the bot.
3 Sep 11, 2022
75 Dec 26, 2022
57 Dec 28, 2022
5 Mar 31, 2022
1 Sep 13, 2022
4 Oct 11, 2022
1 Nov 2, 2021
6 Mar 25, 2022
1 Nov 1, 2021
4 May 25, 2022
38 Dec 9, 2022
10 Aug 20, 2022
2 Aug 3, 2022
1 Oct 22, 2021
2 Jun 10, 2022
9 Jan 6, 2023
152 Dec 28, 2022
25 Dec 12, 2022
9 Sep 28, 2022