Unable to add users or groups to Project Permissions

[GoonBong]

Actual behaviour

Users and groups do not 'resolve' in the Project Permissions page, preventing me from adding any.

Expected behaviour

I would expect it to behave like the animated gif posted in this post on the Kanboard forums (creecros's post): https://kanboard.discourse.group/t/cant-add-any-users-to-project/502

Steps to reproduce

I add a test user, called 'testuser' under 'Users management', and a test group called 'testgroup' under 'Groups management'. I then create a non-private Project and configure that project and then go permissions and start typing either that test user in the user field or the group in the group field. Neither appears directly below (like illustrated in the above forum post) for me to click and therefore the Add User or Add Group button doesn't light up for it to be clicked.

Screenshots

Can provide these if necessary.

Logs

This is the immediate output in the debug log after trying to add a user

[2021-04-14 07:37:44] [debug] ###############################################
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\Runner::executeMiddleware
[2021-04-14 07:38:33] [debug] Subscriber executed: Kanboard\Subscriber\BootstrapSubscriber::execute
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\BaseMiddleware::next => Kanboard\Middleware\AuthenticationMiddleware
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\BaseMiddleware::next => Kanboard\Middleware\PostAuthenticationMiddleware
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\BaseMiddleware::next => Kanboard\Middleware\ApplicationAuthorizationMiddleware
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\BaseMiddleware::next => Kanboard\Middleware\ProjectAuthorizationMiddleware
[2021-04-14 07:38:33] [debug] Kanboard\Core\Controller\Runner::executeController => \Kanboard\Controller\UserAjaxController::autocomplete
[2021-04-14 07:38:33] [debug] SQL: SELECT data FROM sessions WHERE id = ? LIMIT 1
[2021-04-14 07:38:33] [debug] SQL: query_duration=0.00045919418334961
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00045919418334961
[2021-04-14 07:38:33] [debug] SQL: SELECT option, value FROM settings
[2021-04-14 07:38:33] [debug] SQL: query_duration=0.00010418891906738
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00056338310241699
[2021-04-14 07:38:33] [debug] SQL: SELECT projects.id, projects.name FROM projects LEFT JOIN project_has_users ON project_has_users.project_id=projects.id WHERE project_has_users.user_id = ? AND projects.is_active IN (?)
[2021-04-14 07:38:33] [debug] SQL: query_duration=6.2942504882812E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.0006263256072998
[2021-04-14 07:38:33] [debug] SQL: SELECT projects.id, projects.name FROM projects LEFT JOIN project_has_groups ON project_has_groups.project_id=projects.id LEFT JOIN group_has_users ON group_has_users.group_id=project_has_groups.group_id WHERE group_has_users.user_id = ? AND projects.is_active IN (?)
[2021-04-14 07:38:33] [debug] SQL: query_duration=4.8160552978516E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00067448616027832
[2021-04-14 07:38:33] [debug] SQL: SELECT * FROM actions WHERE project_id IN (?)
[2021-04-14 07:38:33] [debug] SQL: query_duration=4.1961669921875E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.0007164478302002
[2021-04-14 07:38:33] [debug] SQL: SELECT * FROM action_has_params
[2021-04-14 07:38:33] [debug] SQL: query_duration=3.9100646972656E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00075554847717285
[2021-04-14 07:38:33] [debug] SQL: SELECT 1 FROM users WHERE id = ? AND is_active = ? AND role = ?
[2021-04-14 07:38:33] [debug] SQL: query_duration=6.6995620727539E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00082254409790039
[2021-04-14 07:38:33] [debug] SQL: SELECT users.id, users.username, users.name FROM users WHERE (username LIKE ? OR name LIKE ?) AND users.is_active = ? ORDER BY users.name ASC, users.username ASC
[2021-04-14 07:38:33] [debug] SQL: query_duration=6.9141387939453E-5
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.00089168548583984
[2021-04-14 07:38:33] [debug] SQL: SELECT 1 FROM sessions WHERE id = ?
[2021-04-14 07:38:33] [debug] SQL: query_duration=0.00016999244689941
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.0010616779327393
[2021-04-14 07:38:33] [debug] SQL: UPDATE sessions SET expire_at=?, data=? WHERE id = ?
[2021-04-14 07:38:33] [debug] SQL: query_duration=0.00026893615722656
[2021-04-14 07:38:33] [debug] SQL: total_execution_time=0.0013306140899658
[2021-04-14 07:38:33] [debug] APP: nb_queries=10
[2021-04-14 07:38:33] [debug] APP: rendering_time=0.016706943511963
[2021-04-14 07:38:33] [debug] APP: memory_usage=1.46M
[2021-04-14 07:38:33] [debug] APP: uri=/?controller=UserAjaxController&action=autocomplete&term=test

Configuration

Application version: 1.2.18
PHP version: 7.4.3
PHP SAPI: apache2handler
HTTP Client: cURL
OS version: Linux 5.4.0-70-generic
Database driver: mysql
Database version: 10.3.25-MariaDB-0ubuntu0.20.04.1
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75

[GoonBong]

Any help would be greatly appreciated.

[GoonBong]

I might also add that I have tried Sqlite and MySQL, got the same symptom. Kanboard is setup as a vhost as well.

[GoonBong]

It seems to be something in my config.php file - I reverted to the default one and the issue went away. I am using LDAP with AD (and users are able to log in using their AD creds) but I'll post my config.php here to see if anything stands out to anyone.

\<?php

/*******************************************************************/
/* Rename this file to config.php if you want to change the values */
/*                                                                 */
/* Make sure all paths are absolute by using __DIR__ where needed  */
/*******************************************************************/

// Data folder (must be writeable by the web server user and absolute)
define('DATA_DIR', __DIR__.DIRECTORY_SEPARATOR.'data');

// Enable/Disable debug
define('DEBUG', true);

// Available log drivers: syslog, stderr, stdout, system or file
define('LOG_DRIVER', 'file');

// Log filename if the log driver is "file"
define('LOG_FILE', DATA_DIR.DIRECTORY_SEPARATOR.'debug.log');

// Plugins directory
define('PLUGINS_DIR', __DIR__.DIRECTORY_SEPARATOR.'plugins');

// Plugins directory URL
define('PLUGIN_API_URL', 'https://kanboard.org/plugins.json');

// Enable/Disable plugin installer (Disabled by default for security reasons)
// There is no code review or any approval process to submit a plugin.
// This is up to the Kanboard instance owner to validate if a plugin is legit.
define('PLUGIN_INSTALLER', false);

// Available cache drivers are "file" and "memory"
define('CACHE_DRIVER', 'memory');

// Cache folder to use if cache driver is "file" (must be writeable by the web server user)
define('CACHE_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'cache');

// Folder for uploaded files (must be writeable by the web server user)
define('FILES_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'files');

// Enable/disable email configuration from the user interface
define('MAIL_CONFIGURATION', true);

// E-mail address used for the "From" header (notifications)
define('MAIL_FROM', '[email protected]');

// E-mail address used for the "Bcc" header to send a copy of all notifications
define('MAIL_BCC', '');

// Mail transport available: "smtp", "sendmail", "mail" (PHP mail function), "postmark", "mailgun", "sendgrid"
define('MAIL_TRANSPORT', 'smtp');

// SMTP configuration to use when the "smtp" transport is chosen
define('MAIL_SMTP_HOSTNAME', 'mail.domain.com.au');
define('MAIL_SMTP_PORT', 25);
define('MAIL_SMTP_USERNAME', '');
define('MAIL_SMTP_PASSWORD', '');
define('MAIL_SMTP_HELO_NAME', null); // valid: null (default), or FQDN
define('MAIL_SMTP_ENCRYPTION', null); // Valid values are null (not a string "null"), "ssl" or "tls"

// Sendmail command to use when the transport is "sendmail"
define('MAIL_SENDMAIL_COMMAND', '/usr/sbin/sendmail -bs');

// Run automatically database migrations
// If set to false, you will have to run manually the SQL migrations from the CLI during the next Kanboard upgrade
// Do not run the migrations from multiple processes at the same time (example: web page + background worker)
define('DB_RUN_MIGRATIONS', true);

// Database driver: sqlite, mysql or postgres (sqlite by default)
define('DB_DRIVER', 'mysql');

// Mysql/Postgres username
define('DB_USERNAME', 'kanboard');

// Mysql/Postgres password
define('DB_PASSWORD', 'password');

// Mysql/Postgres hostname
define('DB_HOSTNAME', 'localhost');

// Mysql/Postgres database name
define('DB_NAME', 'kanboard');

// Mysql/Postgres custom port (null = default port)
define('DB_PORT', null);

// Mysql SSL key
define('DB_SSL_KEY', null);

// Mysql SSL certificate
define('DB_SSL_CERT', null);

// Mysql SSL CA
define('DB_SSL_CA', null);

// Mysql SSL server verification, set to false if you don't want the Mysql driver to validate the certificate CN
define('DB_VERIFY_SERVER_CERT', null);

// Timeout value for PDO attribute
define('DB_TIMEOUT', null);

// Enable LDAP authentication (false by default)
define('LDAP_AUTH', true);

// LDAP server hostname
define('LDAP_SERVER', 'ldap://dc1.domain.com.au');

// LDAP server port (389 by default)
define('LDAP_PORT', 389);

// By default, require certificate to be verified for ldaps:// style URL. Set to false to skip the verification
define('LDAP_SSL_VERIFY', false);

// Enable LDAP START_TLS
define('LDAP_START_TLS', false);

// By default Kanboard lowercase the ldap username to avoid duplicate users (the database is case sensitive)
// Set to true if you want to preserve the case
define('LDAP_USERNAME_CASE_SENSITIVE', false);

// LDAP bind type: "anonymous", "user" or "proxy"
define('LDAP_BIND_TYPE', 'proxy');

// LDAP username to use with proxy mode
// LDAP username pattern to use with user mode
define('LDAP_USERNAME', 'CN=Kanboard Service Account,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// LDAP password to use for proxy mode
define('LDAP_PASSWORD','password');

// LDAP DN for users
// Example for ActiveDirectory: CN=Users,DC=kanboard,DC=local
// Example for OpenLDAP: ou=People,dc=example,dc=com
define('LDAP_USER_BASE_DN', 'OU=Users,DC=domain,DC=com,DC=au');

// LDAP pattern to use when searching for a user account
// Example for ActiveDirectory: '(&(objectClass=user)(sAMAccountName=%s))'
// Example for OpenLDAP: 'uid=%s'
// Example '(&(objectClass=user)(sAMAccountName=%s)(memberOf=CN=KanboardUsers,CN=Kanboard,CN=Applications,CN=Groups,DC=domain,DC=com,DC=au))');
define('LDAP_USER_FILTER', '(&(objectClass=user)(sAMAccountName=%s))');

// LDAP attribute for username
// Example for ActiveDirectory: 'sAMAccountName'
// Example for OpenLDAP: 'uid'
define('LDAP_USER_ATTRIBUTE_USERNAME', 'sAMAccountName');

// LDAP attribute for user full name
// Example for ActiveDirectory: 'displayname'
// Example for OpenLDAP: 'cn'
define('LDAP_USER_ATTRIBUTE_FULLNAME', 'displayName');

// LDAP attribute for user email
define('LDAP_USER_ATTRIBUTE_EMAIL', 'mail');

// LDAP attribute to find groups in user profile
define('LDAP_USER_ATTRIBUTE_GROUPS', 'memberof');

// LDAP attribute for user avatar image: thumbnailPhoto or jpegPhoto
define('LDAP_USER_ATTRIBUTE_PHOTO', '');

// LDAP attribute for user language, example: 'preferredlanguage'
// Put an empty string to disable language sync
define('LDAP_USER_ATTRIBUTE_LANGUAGE', '');

// Allow automatic LDAP user creation
define('LDAP_USER_CREATION', true);

// Set new user as Manager
define('LDAP_USER_DEFAULT_ROLE_MANAGER', false);

// LDAP DN for administrators
// Example: CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local
define('LDAP_GROUP_ADMIN_DN', 'CN=KanboardAdmins,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// LDAP DN for managers
// Example: CN=Kanboard Managers,CN=Users,DC=kanboard,DC=local
define('LDAP_GROUP_MANAGER_DN', 'CN=KaboardManagers,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// Enable LDAP group provider for project permissions
// The end-user will be able to browse LDAP groups from the user interface and allow access to specified projects
define('LDAP_GROUP_PROVIDER', true);

// LDAP Base DN for groups
define('LDAP_GROUP_BASE_DN', 'OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// LDAP group filter
// Example for ActiveDirectory: (&(objectClass=group)(sAMAccountName=%s*))
define('LDAP_GROUP_FILTER', '(&(objectClass=group)(sAMAccountName=*%s*)');

// LDAP user group filter
// If this filter is configured, Kanboard will search user groups in LDAP_GROUP_BASE_DN with this filter
// Example for OpenLDAP: (&(objectClass=posixGroup)(memberUid=%s))
define('LDAP_GROUP_USER_FILTER', '');

// LDAP attribute for the user in the group filter
// 'username' or 'dn'
define('LDAP_GROUP_USER_ATTRIBUTE', 'username');

// LDAP attribute for the group name
define('LDAP_GROUP_ATTRIBUTE_NAME', 'cn');

// Enable/disable the reverse proxy authentication
define('REVERSE_PROXY_AUTH', false);

// Header name to use for the username
define('REVERSE_PROXY_USER_HEADER', 'REMOTE_USER');

// Username of the admin, by default blank
define('REVERSE_PROXY_DEFAULT_ADMIN', '');

// Header name to use for the username
define('REVERSE_PROXY_EMAIL_HEADER', 'REMOTE_EMAIL');

// Default domain to use for setting the email address
define('REVERSE_PROXY_DEFAULT_DOMAIN', '');

// Enable/disable remember me authentication
define('REMEMBER_ME_AUTH', true);

// Enable or disable "Strict-Transport-Security" HTTP header
define('ENABLE_HSTS', true);

// Enable or disable "X-Frame-Options: DENY" HTTP header
define('ENABLE_XFRAME', true);

// Escape html inside markdown text
define('MARKDOWN_ESCAPE_HTML', true);

// API alternative authentication header, the default is HTTP Basic Authentication defined in RFC2617
define('API_AUTHENTICATION_HEADER', '');

// Enable/disable url rewrite
define('ENABLE_URL_REWRITE', false);

// Hide login form, useful if all your users use Google/Github/ReverseProxy authentication
define('HIDE_LOGIN_FORM', false);

// Disabling logout (useful for external SSO authentication)
define('DISABLE_LOGOUT', false);

// Enable captcha after 3 authentication failure
define('BRUTEFORCE_CAPTCHA', 3);

// Lock the account after 6 authentication failure
define('BRUTEFORCE_LOCKDOWN', 6);

// Lock account duration in minute
define('BRUTEFORCE_LOCKDOWN_DURATION', 15);

// Session duration in second (0 = until the browser is closed)
// See http://php.net/manual/en/session.configuration.php#ini.session.cookie-lifetime
define('SESSION_DURATION', 0);

// Session handler: db or php
define('SESSION_HANDLER', 'db');

// HTTP client proxy
define('HTTP_PROXY_HOSTNAME', '');
define('HTTP_PROXY_PORT', '3128');
define('HTTP_PROXY_USERNAME', '');
define('HTTP_PROXY_PASSWORD', '');
define('HTTP_PROXY_EXCLUDE', 'localhost');

// Set to false to allow self-signed certificates
define('HTTP_VERIFY_SSL_CERTIFICATE', true);

// TOTP (2FA) issuer name
define('TOTP_ISSUER', 'Kanboard');

// Comma separated list of fields to not synchronize when using external authentication providers
define('EXTERNAL_AUTH_EXCLUDE_FIELDS', 'username');

// Enable or disable displaying group-memberships in userlist (true by default)
define('SHOW_GROUP_MEMBERSHIPS_IN_USERLIST', true);

// Limit number of groups to display in userlist (The full list of group-memberships is always shown, ...
// ... when hovering the mouse over the group-icon of a given user!)
// If set to 0 ALL group-memberships will be listed (7 by default)
define('SHOW_GROUP_MEMBERSHIPS_IN_USERLIST_WITH_LIMIT', 7);

[GoonBong]

I ended up starting with a default config.php and tested it after each definition change and I've now got LDAP auth with group sync working.

Here is an example config.php if anyone has the same issue:

\<?php

/*******************************************************************/
/* Rename this file to config.php if you want to change the values */
/*                                                                 */
/* Make sure all paths are absolute by using __DIR__ where needed  */
/*******************************************************************/

// Data folder (must be writeable by the web server user and absolute)
define('DATA_DIR', __DIR__.DIRECTORY_SEPARATOR.'data');

// Enable/Disable debug
define('DEBUG', true);

// Available log drivers: syslog, stderr, stdout, system or file
define('LOG_DRIVER', 'file');

// Log filename if the log driver is "file"
define('LOG_FILE', DATA_DIR.DIRECTORY_SEPARATOR.'debug.log');

// Plugins directory
define('PLUGINS_DIR', __DIR__.DIRECTORY_SEPARATOR.'plugins');

// Plugins directory URL
define('PLUGIN_API_URL', 'https://kanboard.org/plugins.json');

// Enable/Disable plugin installer (Disabled by default for security reasons)
// There is no code review or any approval process to submit a plugin.
// This is up to the Kanboard instance owner to validate if a plugin is legit.
define('PLUGIN_INSTALLER', false);

// Available cache drivers are "file" and "memory"
define('CACHE_DRIVER', 'memory');

// Cache folder to use if cache driver is "file" (must be writeable by the web server user)
define('CACHE_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'cache');

// Folder for uploaded files (must be writeable by the web server user)
define('FILES_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'files');

// Enable/disable email configuration from the user interface
define('MAIL_CONFIGURATION', true);

// E-mail address used for the "From" header (notifications)
define('MAIL_FROM', '[email protected]');

// E-mail address used for the "Bcc" header to send a copy of all notifications
define('MAIL_BCC', '');

// Mail transport available: "smtp", "sendmail", "mail" (PHP mail function), "postmark", "mailgun", "sendgrid"
define('MAIL_TRANSPORT', 'smtp');

// SMTP configuration to use when the "smtp" transport is chosen
define('MAIL_SMTP_HOSTNAME', 'mail.domain.com.au');
define('MAIL_SMTP_PORT', 25);
define('MAIL_SMTP_USERNAME', '');
define('MAIL_SMTP_PASSWORD', '');
define('MAIL_SMTP_HELO_NAME', null); // valid: null (default), or FQDN
define('MAIL_SMTP_ENCRYPTION', null); // Valid values are null (not a string "null"), "ssl" or "tls"

// Sendmail command to use when the transport is "sendmail"
define('MAIL_SENDMAIL_COMMAND', '/usr/sbin/sendmail -bs');

// Run automatically database migrations
// If set to false, you will have to run manually the SQL migrations from the CLI during the next Kanboard upgrade
// Do not run the migrations from multiple processes at the same time (example: web page + background worker)
define('DB_RUN_MIGRATIONS', true);

// Database driver: sqlite, mysql or postgres (sqlite by default)
define('DB_DRIVER', 'mysql');

// Mysql/Postgres username
define('DB_USERNAME', 'kanboard');

// Mysql/Postgres password
define('DB_PASSWORD', 'password');

// Mysql/Postgres hostname
define('DB_HOSTNAME', 'localhost');

// Mysql/Postgres database name
define('DB_NAME', 'kanboard');

// Mysql/Postgres custom port (null = default port)
define('DB_PORT', null);

// Mysql SSL key
define('DB_SSL_KEY', null);

// Mysql SSL certificate
define('DB_SSL_CERT', null);

// Mysql SSL CA
define('DB_SSL_CA', null);

// Mysql SSL server verification, set to false if you don't want the Mysql driver to validate the certificate CN
define('DB_VERIFY_SERVER_CERT', null);

// Timeout value for PDO attribute
define('DB_TIMEOUT', null);

// Enable LDAP authentication (false by default)
define('LDAP_AUTH', true);

// LDAP server hostname
define('LDAP_SERVER', 'ldap://dc1.domain.com.au');

// LDAP server port (389 by default)
define('LDAP_PORT', 389);

// By default, require certificate to be verified for ldaps:// style URL. Set to false to skip the verification
define('LDAP_SSL_VERIFY', false);

// Enable LDAP START_TLS
define('LDAP_START_TLS', false);

// By default Kanboard lowercase the ldap username to avoid duplicate users (the database is case sensitive)
// Set to true if you want to preserve the case
define('LDAP_USERNAME_CASE_SENSITIVE', false);

// LDAP bind type: "anonymous", "user" or "proxy"
define('LDAP_BIND_TYPE', 'proxy');

// LDAP username to use with proxy mode
// LDAP username pattern to use with user mode
define('LDAP_USERNAME', 'CN=Kanboard Service Account,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// LDAP password to use for proxy mode
define('LDAP_PASSWORD','password');

// LDAP DN for users
// Example for ActiveDirectory: CN=Users,DC=kanboard,DC=local
// Example for OpenLDAP: ou=People,dc=example,dc=com
define('LDAP_USER_BASE_DN', 'OU=Users,DC=domain,DC=com,DC=au');

// LDAP pattern to use when searching for a user account
// Example for ActiveDirectory: '(&(objectClass=user)(sAMAccountName=%s))'
// Example for OpenLDAP: 'uid=%s'
define('LDAP_USER_FILTER', '(&(objectClass=user)(sAMAccountName=%s))');

// LDAP attribute for username
// Example for ActiveDirectory: 'sAMAccountName'
// Example for OpenLDAP: 'uid'
define('LDAP_USER_ATTRIBUTE_USERNAME', 'sAMAccountName');

// LDAP attribute for user full name
// Example for ActiveDirectory: 'displayname'
// Example for OpenLDAP: 'cn'
define('LDAP_USER_ATTRIBUTE_FULLNAME', 'displayName');

// LDAP attribute for user email
define('LDAP_USER_ATTRIBUTE_EMAIL', 'mail');

// LDAP attribute to find groups in user profile
define('LDAP_USER_ATTRIBUTE_GROUPS', 'memberof');

// LDAP attribute for user avatar image: thumbnailPhoto or jpegPhoto
define('LDAP_USER_ATTRIBUTE_PHOTO', '');

// LDAP attribute for user language, example: 'preferredlanguage'
// Put an empty string to disable language sync
define('LDAP_USER_ATTRIBUTE_LANGUAGE', '');

// Allow automatic LDAP user creation
define('LDAP_USER_CREATION', true);

// Set new user as Manager
define('LDAP_USER_DEFAULT_ROLE_MANAGER', false);

// LDAP DN for administrators
// Example: CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local
define('LDAP_GROUP_ADMIN_DN', 'CN=KanboardAdmins,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// LDAP DN for managers
// Example: CN=Kanboard Managers,CN=Users,DC=kanboard,DC=local
define('LDAP_GROUP_MANAGER_DN', 'CN=KanboardManagers,OU=Kanboard,OU=Applications,OU=Groups,DC=domain,DC=com,DC=au');

// Enable LDAP group provider for project permissions
// The end-user will be able to browse LDAP groups from the user interface and allow access to specified projects
define('LDAP_GROUP_PROVIDER', true);

// LDAP Base DN for groups
define('LDAP_GROUP_BASE_DN', 'OU=Groups,DC=domain,DC=com,DC=au');

// LDAP group filter
// Example for ActiveDirectory: (&(objectClass=group)(sAMAccountName=%s*))
define('LDAP_GROUP_FILTER', '(&(objectClass=group)(sAMAccountName=*%s*)');

// LDAP user group filter
// If this filter is configured, Kanboard will search user groups in LDAP_GROUP_BASE_DN with this filter
// Example for OpenLDAP: (&(objectClass=posixGroup)(memberUid=%s))
define('LDAP_GROUP_USER_FILTER', '');

// LDAP attribute for the user in the group filter
// 'username' or 'dn'
define('LDAP_GROUP_USER_ATTRIBUTE', 'username');

// LDAP attribute for the group name
define('LDAP_GROUP_ATTRIBUTE_NAME', 'cn');

// Enable/disable the reverse proxy authentication
define('REVERSE_PROXY_AUTH', false);

// Header name to use for the username
define('REVERSE_PROXY_USER_HEADER', 'REMOTE_USER');

// Username of the admin, by default blank
define('REVERSE_PROXY_DEFAULT_ADMIN', '');

// Header name to use for the username
define('REVERSE_PROXY_EMAIL_HEADER', 'REMOTE_EMAIL');

// Default domain to use for setting the email address
define('REVERSE_PROXY_DEFAULT_DOMAIN', '');

// Enable/disable remember me authentication
define('REMEMBER_ME_AUTH', true);

// Enable or disable "Strict-Transport-Security" HTTP header
define('ENABLE_HSTS', true);

// Enable or disable "X-Frame-Options: DENY" HTTP header
define('ENABLE_XFRAME', true);

// Escape html inside markdown text
define('MARKDOWN_ESCAPE_HTML', true);

// API alternative authentication header, the default is HTTP Basic Authentication defined in RFC2617
define('API_AUTHENTICATION_HEADER', '');

// Enable/disable url rewrite
define('ENABLE_URL_REWRITE', false);

// Hide login form, useful if all your users use Google/Github/ReverseProxy authentication
define('HIDE_LOGIN_FORM', false);

// Disabling logout (useful for external SSO authentication)
define('DISABLE_LOGOUT', false);

// Enable captcha after 3 authentication failure
define('BRUTEFORCE_CAPTCHA', 3);

// Lock the account after 6 authentication failure
define('BRUTEFORCE_LOCKDOWN', 6);

// Lock account duration in minute
define('BRUTEFORCE_LOCKDOWN_DURATION', 15);

// Session duration in second (0 = until the browser is closed)
// See http://php.net/manual/en/session.configuration.php#ini.session.cookie-lifetime
define('SESSION_DURATION', 0);

// Session handler: db or php
define('SESSION_HANDLER', 'db');

// HTTP client proxy
define('HTTP_PROXY_HOSTNAME', '');
define('HTTP_PROXY_PORT', '3128');
define('HTTP_PROXY_USERNAME', '');
define('HTTP_PROXY_PASSWORD', '');
define('HTTP_PROXY_EXCLUDE', 'localhost');

// Set to false to allow self-signed certificates
define('HTTP_VERIFY_SSL_CERTIFICATE', true);

// TOTP (2FA) issuer name
define('TOTP_ISSUER', 'Kanboard');

// Comma separated list of fields to not synchronize when using external authentication providers
define('EXTERNAL_AUTH_EXCLUDE_FIELDS', 'username');

// Enable or disable displaying group-memberships in userlist (true by default)
define('SHOW_GROUP_MEMBERSHIPS_IN_USERLIST', true);

// Limit number of groups to display in userlist (The full list of group-memberships is always shown, ...
// ... when hovering the mouse over the group-icon of a given user!)
// If set to 0 ALL group-memberships will be listed (7 by default)
define('SHOW_GROUP_MEMBERSHIPS_IN_USERLIST_WITH_LIMIT', 7);