fix update_texlive

mildstone deploy
Update README.md (close #45 )
2024-09-23 19:45:57 +00:00 · 2024-07-28 09:36:18 +00:00 · 2024-01-15 08:15:17 +08:00 · 2024-01-08 15:28:58 +01:00 · 2024-01-08 14:50:27 +01:00 · 2024-01-05 15:14:43 +01:00
30 changed files with 2200 additions and 1109 deletions
--- a/.env
+++ b/.env
@@ -1,6 +1,7 @@
 # do not use quotes (")
-MYDOMAIN=MYDOMAIN.TLD
-MYMAIL=MYEMAIL@MYDOMAIN.TLD
+MYDOMAIN=overleaf.mildstone.org
+MYMAIL=andrea.rgn@gmail.com
 MYDATA=/data
 LOGIN_TEXT=username
 COLLAB_TEXT=Direct share with collaborators is enabled only for activated users!
+ADMIN_IS_SYSADMIN=false
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
+# Temporary files
+sharelatex/
+sharelatex_ori/
+
 # Compiled Object files
 *.slo
 *.lo
--- a/3
+++ b/3
@@ -3,7 +3,8 @@ include .env
 build: 
 	docker build --build-arg login_text="${LOGIN_TEXT}" \
 		     --build-arg collab_text="${COLLAB_TEXT}" \
-		     -t "ldap-overleaf-sl" ldap-overleaf-sl 
+		     --build-arg admin_is_sysadmin="${ADMIN_IS_SYSADMIN}" \
+		     -t "ldap-overleaf-sl:240728" ldap-overleaf-sl 

 clean: check_clean
 	docker-compose down
--- a/README.md
+++ b/README.md
@@ -2,23 +2,44 @@

 This repo contains an improved, free ldap authentication and authorisation 
 for sharelatex/[overleaf](https://github.com/overleaf/overleaf) community 
-edition. Currently this repo uses sharelatex:latest.
+edition. Currently this repo uses `sharelatex/sharelatex:4.2.0`.

 The inital idea for this implementation was taken from 
 [worksasintended](https://github.com/worksasintended).

+## BREAKING CHANGE

-### Limitations:
+Be careful if you try to migrate from 3.3.2! Backup your machines and data. The migration paths should be:
+- Backup your machines and data
+- Run latest 3.5 sharelatex image, make sure that you have enough free space and run the migration scripts:
+   - (Details see https://github.com/overleaf/overleaf/wiki/Full-Project-History-Migration)
+   - in principle following commands should work
+   ```
+    docker exec -it sharelatex-container-name /bin/bash
+    cd /overleaf/services/web
+    node scripts/history/migrate_history.js --force-clean --fix-invalid-characters --convert-large-docs-to-file
+    ```
+- run this sharelatex image (4.2.0)

-This implementation uses *no* ldap bind user - it tries to bind to the ldap (using ldapts) with 
-the uid and credentials of the user which tries to login.
+## Limitations

+NEW: This version provides the possibility to use a separate ldap bind user. It does this just to find the proper BIND DN and record for the provided email, so it is possible that users from different groups / OUs can login.
+Afterwards it tries to bind to the ldap (using ldapts) with the user DN and credentials of the user which tries to login. No hassle of password hashing for LDAP pwds!
+
+If you upgrade from an older commit:
+
+**Note**:
+
+ - you have to add: uid=%u to your BIND_DN 
+ - LDAP_GROUP_FILTER is now named LDAP_USER_FILTER
+ - Import of contacts from LDAP is now controlled by LDAP_CONTACT_FILTER

 Only valid LDAP users or email users registered by an admin can login. 
 This module authenticates against the local DB if `ALLOW_EMAIL_LOGIN` is set to `true` if this fails
 it tries to authenticate against the specified LDAP server. 

-*Note:*
+**Note**:
+
 - LDAP Users can not change their password for the ldap username login. They have to change it at the ldap server.
 - LDAP Users can reset their local db password. Then they can decide if they login with either their ldap user and password or with their email and local db password.
 - Users can not change their email. The email address is taken from the ldap server (mail) field. (or by invitation through an admin).
@@ -27,8 +48,7 @@ it tries to authenticate against the specified LDAP server.
 - Admins can invite non ldap users directly (via email). Additionally (``link sharing`` of projects is possible).

 *Important:*
-Sharelatex/Overleaf uses the email address to identify users: If you change the email in the LDAP you have to update the corresponding field 
-in the mongo db.
+Sharelatex/Overleaf uses the email address to identify users: If you change the email in the LDAP/OAuth you have to update the corresponding field in the mongo db.

 ```
 docker exec -it mongo /bin/bash
@@ -56,58 +76,141 @@ MYDATA=/data
 - sharelatex: all projects, tmp files, user files templates and ...
 - letsencrypt: https certificates

-*MYDOMAIN* is the FQDN for sharelatex and traefik (letsencrypt) <br/>
-*MYDOMAIN*:8443 Traefik Dashboard - Login uses traefik/user.htpasswd : user:admin pass:adminPass change this (e.g. generate a password with htpasswd)
+*MYDOMAIN* is the FQDN for sharelatex and traefik (letsencrypt) or certbot  <br/>
+*MYDOMAIN*:8443 Traefik Dashboard (docker-compose-traefik.yml) - Login uses traefik/user.htpasswd : user:admin pass:adminPass change this (e.g. generate a password with htpasswd)
 *MYMAIL* is the admin mailaddress

 ```
 LOGIN_TEXT=username
 COLLAB_TEXT=Direct share with collaborators is enabled only for activated users!
+ADMIN_IS_SYSADMIN=false
 ```
-*LOGIN_TEXT* : displayed instead of email-adress field (login.pug) <br/>
-*COLLAB_TEXT* : displayed for email invitation (share.pug)

+*LOGIN_TEXT* : displayed instead of email-adress field (login.pug) <br/>
+*COLLAB_TEXT* : displayed for email invitation (share.pug)<br/>
+*ADMIN_IS_SYSADMIN* : false or true (if ``false`` isAdmin group is allowed to add users to sharelatex and post messages. if ``true`` isAdmin group is allowed to logout other users / set maintenance mode)

 ### LDAP Configuration

-Edit [docker-compose.yml](docker-compose.yml) to fit your local setup. 
+Edit [docker-compose.treafik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup.

 ```
 LDAP_SERVER: ldaps://LDAPSERVER:636
 LDAP_BASE: dc=DOMAIN,dc=TLD
-LDAP_BINDDN: ou=someunit,ou=people,dc=DOMAIN,dc=TLS
-# By default tries to bind directly with the ldap user - this user has to be in the LDAP GROUP
-# you have to set a group filter a minimal groupfilter would be: '(objectClass=person)'
-LDAP_GROUP_FILTER: '(memberof=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)'
+# If LDAP_BINDDN is set, the ldap bind happens directly by using the provided DN
+# All occurrences of `%u` get replaced by the entered uid.
+# All occurrences of `%m`get replaced by the entered mail.
+LDAP_BINDDN: uid=%u,ou=people,dc=DOMAIN,dc=TLD
+LDAP_BIND_USER: cn=ldap_reader,dc=DOMAIN,dc=TLS
+LDAP_BIND_PW: TopSecret
+# users need to match this filter to login.
+# All occurrences of `%u` get replaced by the entered uid.
+# All occurrences of `%m`get replaced by the entered mail.
+LDAP_USER_FILTER: '(&(memberof=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)(uid=%u))'

 # If user is in ADMIN_GROUP on user creation (first login) isAdmin is set to true. 
 # Admin Users can invite external (non ldap) users. This feature makes only sense 
 # when ALLOW_EMAIL_LOGIN is set to 'true'. Additionally admins can send 
 # system wide messages.
+# All occurrences of `%u` get replaced by the entered uid.
+# All occurrences of `%m`get replaced by the entered mail.
 #LDAP_ADMIN_GROUP_FILTER: '(memberof=cn=ADMINGROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)'
 ALLOW_EMAIL_LOGIN: 'false'

-# All users in the LDAP_GROUP_FILTER are loaded from the ldap server into contacts.
+# All users in the LDAP_CONTACT_FILTER are loaded from the ldap server into contacts.
+LDAP_CONTACT_FILTER: (objectClass=person)
 LDAP_CONTACTS: 'false'
 ```

 ### LDAP Contacts 

-If you enable LDAP_CONTACTS, then all users in LDAP_GROUP_FILTER are loaded from the ldap server into the contacts. 
+If you enable LDAP_CONTACTS, then all users in LDAP_CONTACT_FILTER are loaded from the ldap server into the contacts.
 At the moment this happens every time you click on "Share" within a project.
-The user search happens without bind - so if your LDAP needs a bind you can adapt this in the 
-function `getLdapContacts()` in ContactsController.js (line 92) 
 if you want to enable this function set:
+
 ```
+LDAP_CONTACT_FILTER: (objectClass=person)
 LDAP_CONTACTS: 'true'
 ```

+### OAuth2 Configuration
+
+```
+# Enable OAuth2
+OAUTH2_ENABLED: "true"
+
+# Provider name, optional
+OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
+
+# OAuth2 client configuration, 
+OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
+OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
+# Scope should at least include email
+OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
+
+# OAuth2 APIs
+# Redirect to OAuth 2.0 url
+OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
+# Fetch access token api endpoint
+OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
+# Content type of token request
+# One of ["application/x-www-form-urlencoded", "application/json"]
+# Default "application/x-www-form-urlencoded"
+OAUTH2_TOKEN_CONTENT_TYPE: "application/x-www-form-urlencoded"
+# Fetch user profile api endpoint
+OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
+
+# OAuth2 user attributes
+# User identity
+OAUTH2_USER_ATTR_EMAIL: email
+# User attributes, only used on the first login
+OAUTH2_USER_ATTR_UID: id
+OAUTH2_USER_ATTR_FIRSTNAME: name
+OAUTH2_USER_ATTR_LASTNAME:
+OAUTH2_USER_ATTR_IS_ADMIN: site_admin
+```
+
+Example configuration for GitHub:
+
+```
+OAUTH2_ENABLED: "true"
+OAUTH2_PROVIDER: GitHub
+OAUTH2_CLIENT_ID: YOUR_CLIENT_ID
+OAUTH2_CLIENT_SECRET: YOUR_CLIENT_SECRET
+OAUTH2_SCOPE: # the 'public' scope is sufficient for our needs, so we do not request any more 
+OAUTH2_AUTHORIZATION_URL: https://github.com/login/oauth/authorize
+OAUTH2_TOKEN_URL: https://github.com/login/oauth/access_token
+OAUTH2_PROFILE_URL: https://api.github.com/user
+OAUTH2_USER_ATTR_EMAIL: email
+OAUTH2_USER_ATTR_UID: id
+OAUTH2_USER_ATTR_FIRSTNAME: name
+OAUTH2_USER_ATTR_LASTNAME:
+OAUTH2_USER_ATTR_IS_ADMIN: site_admin
+```
+
+Example configuration for Authentik:
+
+```
+OAUTH2_ENABLED: "true"
+OAUTH2_PROVIDER: GitHub
+OAUTH2_CLIENT_ID: "redacted"
+OAUTH2_CLIENT_SECRET: "redacted"
+OAUTH2_AUTHORIZATION_URL: https://auth.redacted.domain/application/o/authorize/
+OAUTH2_TOKEN_URL: https://auth.redacted.domain/application/o/token/
+OAUTH2_PROFILE_URL: https://auth.redacted.domain/application/o/userinfo/
+OAUTH2_USER_ATTR_EMAIL: email
+OAUTH2_USER_ATTR_UID: "email"
+OAUTH2_USER_ATTR_FIRSTNAME: name
+# To make it work one should create a custom scope first
+OAUTH2_USER_ATTR_IS_ADMIN: is_admin
+```
+
 ### Sharelatex Configuration

-Edit SHARELATEX_ environment variables in [docker-compose.yml](docker-compose.yml) to fit your local setup 
+Edit SHARELATEX_ environment variables in [docker-compose.traefik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup 
 (e.g. proper SMTP server, Header, Footer, App Name,...). See https://github.com/overleaf/overleaf/wiki/Quick-Start-Guide for more details.

-## Installation, Usage and Inital startup
+## Installation, Usage and Initial startup

 Install the docker engine: https://docs.docker.com/engine/install/

@@ -119,22 +222,73 @@ Install docker-compose:
 pip install docker-compose
 ```

+use the following commands:

-use the command 
 ```
+bash scripts/extract_files.sh 4.2.0
+bash scripts/apply_diffs.sh
 make
 ```
+
 to generate the ldap-overleaf-sl docker image.

+use the command:
+
+```
+docker network create web
+```
+
+to create a network for the docker instances.
+
+### Startup
+
+#### Using without proxy
+
+In most cases, you should use a gateway reverse proxy for your requests (see the next section), as they can offer many benefits such as enhanced security and easier SSL certificate updates. This simple startup method is used for 1. Development 2. When you know what you're doing, for example, when there is an additional gateway layer outside your server.
+
+Start docker containers:
+
+``` 
+docker-compose up -d
+```
+
+#### Using proxy
+
+There are 2 different ways of starting either using Traefik or using Certbot. Adapt the one you want to use.
+
+##### Using Traefik
+
 Then start docker containers (with loadbalancer):
+
 ``` 
 export NUMINSTANCES=1
-docker-compose up -d --scale sharelaatex=NUMINSTANCES
+docker-compose -f docker-compose.traefik.yml up -d --scale sharelatex=$NUMINSTANCES
 ```

-*Known Issue:*
- Works up to sharelatex 2.3.1. After that at least issue #5 is introduced.
+##### Using Certbot 

+Enable line 65/66 and 69/70 in ldapoverleaf-sl/Dockerfile and ``make`` again.

+``` 
+docker-compose -f docker-compose.certbot.yml up -d 
+```

+## Debug

+1. Set the env variable `LOG_LEVEL` to `debug` (default is info - you can do this in the docker-compose file)
+2. Check the logs in ShareLaTeX, particularly at `/var/log/sharelatex/web.log`. You can do this by using the command: `docker exec ldap-overleaf-sl cat /var/log/sharelatex/web.log`.
+
+## Development
+
+1. Cloning this repo
+2. Extract files from image using `bash scripts/extract_files SHARELATEX_VERSION`
+3. Generate modified files using `bash scripts/apply_patches.sh`
+4. Development
+5. Create diff files using `bash script/make_diffs.sh` and commit
+
+## Upgrading
+
+*Be aware:* if you upgrade from a previous installation check your docker image version
+
+E.g.: Mongodb: You cannot upgrade directly from mongo 4.2 to 5.0. You must first upgrade from 4.2 to 4.4.
+Do not upgrade without proper testing and Backup your installation beforehand.
--- a/docker-compose.certbot.yml
+++ b/docker-compose.certbot.yml
@@ -0,0 +1,173 @@
+version: "2.2"
+services:
+  sharelatex:
+    restart: always
+    image: ldap-overleaf-sl
+    container_name: ldap-overleaf-sl
+    depends_on:
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      simple-certbot:
+        condition: service_started
+    privileged: false
+    ports:
+      - 443:443
+    links:
+      - mongo
+      - redis
+      - simple-certbot
+    volumes:
+      - ${MYDATA}/sharelatex:/var/lib/sharelatex
+      - ${MYDATA}/letsencrypt:/etc/letsencrypt
+      - ${MYDATA}/letsencrypt/live/${MYDOMAIN}/:/etc/letsencrypt/certs/domain
+    environment:
+      SHARELATEX_APP_NAME: Overleaf
+      SHARELATEX_MONGO_URL: mongodb://mongo/sharelatex
+      SHARELATEX_SITE_URL: https://${MYDOMAIN}
+      SHARELATEX_NAV_TITLE: Overleaf - run by ${MYDOMAIN}
+      #SHARELATEX_HEADER_IMAGE_URL: https://${MYDOMAIN}/logo.svg
+      SHARELATEX_ADMIN_EMAIL: ${MYMAIL}
+      SHARELATEX_LEFT_FOOTER: '[{"text": "Powered by <a href=\"https://www.sharelatex.com\">ShareLaTeX</a> 2016"} ]'
+      SHARELATEX_RIGHT_FOOTER: '[{"text": "LDAP Overleaf (beta)"} ]'
+      SHARELATEX_EMAIL_FROM_ADDRESS: "noreply@${MYDOMAIN}"
+      # SHARELATEX_EMAIL_AWS_SES_ACCESS_KEY_ID:
+      # SHARELATEX_EMAIL_AWS_SES_SECRET_KEY:
+      SHARELATEX_EMAIL_SMTP_HOST: smtp.${MYDOMAIN}
+      SHARELATEX_EMAIL_SMTP_PORT: 587
+      SHARELATEX_EMAIL_SMTP_SECURE: "false"
+      # SHARELATEX_EMAIL_SMTP_USER:
+      # SHARELATEX_EMAIL_SMTP_PASS:
+      # SHARELATEX_EMAIL_SMTP_TLS_REJECT_UNAUTH: true
+      # SHARELATEX_EMAIL_SMTP_IGNORE_TLS: false
+      SHARELATEX_CUSTOM_EMAIL_FOOTER: "This system is run by ${MYDOMAIN} - please contact ${MYMAIL} if you experience any issues."
+
+      # make public links accessible w/o login (link sharing issue)
+      # https://github.com/overleaf/docker-image/issues/66
+      # https://github.com/overleaf/overleaf/issues/628
+      # https://github.com/overleaf/web/issues/367
+      # Fixed in 2.0.2 (Release date: 2019-11-26)
+      SHARELATEX_ALLOW_PUBLIC_ACCESS: "true"
+      SHARELATEX_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"
+
+      SHARELATEX_SECURE_COOKIE: "true"
+      SHARELATEX_BEHIND_PROXY: "true"
+
+      LDAP_SERVER: ldaps://LDAPSERVER:636
+      LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
+
+      ### There are to ways get users from the ldap server
+
+      ## NO LDAP BIND USER:
+      # Tries directly to bind with the login user (as uid)
+      # LDAP_BINDDN: uid=%u,ou=someunit,ou=people,dc=DOMAIN,dc=TLD
+
+      ## Or you can use ai global LDAP_BIND_USER
+      # LDAP_BIND_USER:
+      # LDAP_BIND_PW:
+
+      # Only allow users matching LDAP_USER_FILTER
+      LDAP_USER_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+
+      # If user is in ADMIN_GROUP on user creation (first login) isAdmin is set to true.
+      # Admin Users can invite external (non ldap) users. This feature makes only sense
+      # when ALLOW_EMAIL_LOGIN is set to 'true'. Additionally admins can send
+      # system wide messages.
+      LDAP_ADMIN_GROUP_FILTER: "(memberof=cn=ADMINGROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+      ALLOW_EMAIL_LOGIN: "true"
+
+      # All users in the LDAP_CONTACT_FILTER are loaded from the ldap server into contacts.
+      LDAP_CONTACT_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+      LDAP_CONTACTS: "false"
+
+      ## OAuth2 Settings
+      # OAUTH2_ENABLED: "true"
+      # OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
+      # OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
+      # OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
+      # OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
+      # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
+      # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
+      # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
+      # OAUTH2_USER_ATTR_EMAIL: email
+      # OAUTH2_USER_ATTR_UID: id
+      # OAUTH2_USER_ATTR_FIRSTNAME: name
+      # OAUTH2_USER_ATTR_LASTNAME:
+      # OAUTH2_USER_ATTR_IS_ADMIN: site_admin
+
+      # Same property, unfortunately with different names in
+      # different locations
+      SHARELATEX_REDIS_HOST: redis
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+
+      ENABLED_LINKED_FILE_TYPES: "url,project_file"
+
+      # Enables Thumbnail generation using ImageMagick
+      ENABLE_CONVERSIONS: "true"
+
+  mongo:
+    restart: always
+    image: mongo:4.4
+    container_name: mongo
+    expose:
+      - 27017
+    volumes:
+      - ${MYDATA}/mongo_data:/data/db
+    healthcheck:
+      test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+      interval: 10s
+      timeout: 10s
+      retries: 5
+    command: "--replSet overleaf"
+
+  # See also: https://github.com/overleaf/overleaf/issues/1120
+  mongoinit:
+    image: mongo:4.4
+    # this container will exit after executing the command
+    restart: "no"
+    depends_on:
+      mongo:
+        condition: service_healthy
+    entrypoint:
+      [
+        "mongo",
+        "--host",
+        "mongo:27017",
+        "--eval",
+        'rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })',
+      ]
+
+  redis:
+    restart: always
+    image: redis:6.2
+    container_name: redis
+    expose:
+      - 6379
+    volumes:
+      - ${MYDATA}/redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  simple-certbot:
+    restart: always
+    image: certbot/certbot
+    container_name: simple-certbot
+    ports:
+      - 80:80
+    volumes:
+      - ${MYDATA}/letsencrypt:/etc/letsencrypt
+    # a bit hacky but this docker image uses very little disk-space
+    # best practices for ssl and nginx are set in the ldap-overleaf-sl Dockerfile
+    entrypoint:
+      - "/bin/sh"
+      - -c
+      - |
+        trap exit TERM;\
+        certbot certonly --standalone -d ${MYDOMAIN} --agree-tos -m ${MYMAIL} -n ; \
+        while :; do certbot renew; sleep 240h & wait $${!}; done;
--- a/docker-compose.traefik.yml
+++ b/docker-compose.traefik.yml
@@ -0,0 +1,258 @@
+version: "2.2"
+services:
+  traefik:
+    image: traefik:latest
+    container_name: traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - web
+    ports:
+      - 80:80
+      - 443:443
+      - 8443:8443
+      # - 8080:8080
+      # - 27017:27017
+    volumes:
+      - ${MYDATA}/letsencrypt:/letsencrypt
+      - /etc/localtime:/etc/localtime:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik/dynamic_conf.yml:/dynamic_conf.yml
+      - ./traefik/users.htpasswd:/users.htpasswd
+    command:
+      - "--api=true"
+      - "--api.dashboard=true"
+      #- "--api.insecure=true" # provides the dashboard on http://IPADRESS:8080
+      - "--providers.docker=true"
+      - "--ping"
+      - "--providers.docker.network=web"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.file.filename=/dynamic_conf.yml"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web-secure.address=:443"
+      - "--entrypoints.web-admin.address=:8443"
+      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
+      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web"
+      - "--certificatesresolvers.myhttpchallenge.acme.email=${MYMAIL}"
+      - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
+      - "--entrypoints.mongo.address=:27017"
+      #- --certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
+    labels:
+      - "traefik.enable=true"
+      # To Fix enable dashboard on port 8443
+      - "traefik.http.routers.dashboard.entrypoints=web-admin"
+      - "traefik.http.routers.dashboard.rule=Host(`${MYDOMAIN}`)"
+      # - "traefik.http.routers.dashboard.rule=Host(`traefik.${MYDOMAIN}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
+      - "traefik.http.routers.dashboard.tls=true"
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      - "traefik.http.middlewares.auth.basicauth.usersfile=/users.htpasswd"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.proxy-https.entrypoints=web-secure"
+      - "traefik.http.routers.proxy-https.rule=Host(`${MYDOMAIN}`)"
+
+  logging:
+    driver: "json-file"
+    options:
+      max-size: "10m"
+      max-file: "1"
+
+  sharelatex:
+    restart: always
+    image: ldap-overleaf-sl:latest
+    depends_on:
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      traefik:
+        condition: service_started
+      #simple-certbot:
+      #    condition: service_started
+    privileged: false
+    networks:
+      - web
+    expose:
+      - 80
+      - 443
+    links:
+      - mongo
+      - redis
+    volumes:
+      - ${MYDATA}/sharelatex:/var/lib/sharelatex
+      - ${MYDATA}/letsencrypt:/etc/letsencrypt:ro
+      # - ${MYDATA}/letsencrypt/live/${MYDOMAIN}/:/etc/letsencrypt/certs/domain
+    labels:
+      - "traefik.enable=true"
+      # global redirect to https
+      - "traefik.http.routers.http-catchall.rule=hostregexp(`${MYDOMAIN}`)"
+      - "traefik.http.routers.http-catchall.entrypoints=web"
+      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      # handle https traffic
+      - "traefik.http.routers.sharel-secured.rule=Host(`${MYDOMAIN}`)"
+      - "traefik.http.routers.sharel-secured.tls=true"
+      - "traefik.http.routers.sharel-secured.tls.certresolver=myhttpchallenge"
+      - "traefik.http.routers.sharel-secured.entrypoints=web-secure"
+      - "traefik.http.middlewares.sharel-secured.forwardauth.trustForwardHeader=true"
+      # Docker loadbalance
+      - "traefik.http.services.sharel.loadbalancer.server.port=80"
+      - "traefik.http.services.sharel.loadbalancer.server.scheme=http"
+      - "traefik.http.services.sharel.loadbalancer.sticky.cookie=true"
+      - "traefik.http.services.sharel.loadbalancer.sticky.cookie.name=io"
+      - "traefik.http.services.sharel.loadbalancer.sticky.cookie.httponly=true"
+      - "traefik.http.services.sharel.loadbalancer.sticky.cookie.secure=true"
+      - "traefik.http.services.sharel.loadbalancer.sticky.cookie.samesite=io"
+
+    environment:
+      SHARELATEX_APP_NAME: Overleaf
+      SHARELATEX_MONGO_URL: mongodb://mongo/sharelatex
+      SHARELATEX_SITE_URL: https://${MYDOMAIN}
+      SHARELATEX_NAV_TITLE: Overleaf - run by ${MYDOMAIN}
+      #SHARELATEX_HEADER_IMAGE_URL: https://${MYDOMAIN}/logo.svg
+      SHARELATEX_ADMIN_EMAIL: ${MYMAIL}
+      SHARELATEX_LEFT_FOOTER: '[{"text": "Powered by <a href=\"https://www.sharelatex.com\">ShareLaTeX</a> 2016"} ]'
+      SHARELATEX_RIGHT_FOOTER: '[{"text": "LDAP Overleaf (beta)"} ]'
+      SHARELATEX_EMAIL_FROM_ADDRESS: "noreply@${MYDOMAIN}"
+      SHARELATEX_EMAIL_SMTP_HOST: smtp.${MYDOMAIN}
+      SHARELATEX_EMAIL_SMTP_PORT: 587
+      SHARELATEX_EMAIL_SMTP_SECURE: "false"
+      # SHARELATEX_EMAIL_SMTP_USER:
+      # SHARELATEX_EMAIL_SMTP_PASS:
+      # SHARELATEX_EMAIL_SMTP_TLS_REJECT_UNAUTH: true
+      # SHARELATEX_EMAIL_SMTP_IGNORE_TLS: false
+      SHARELATEX_CUSTOM_EMAIL_FOOTER: "This system is run by ${MYDOMAIN} - please contact ${MYMAIL} if you experience any issues."
+
+      # make public links accessible w/o login (link sharing issue)
+      # https://github.com/overleaf/docker-image/issues/66
+      # https://github.com/overleaf/overleaf/issues/628
+      # https://github.com/overleaf/web/issues/367
+      # Fixed in 2.0.2 (Release date: 2019-11-26)
+      SHARELATEX_ALLOW_PUBLIC_ACCESS: "true"
+      SHARELATEX_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"
+
+      SHARELATEX_SECURE_COOKIE: "true"
+      SHARELATEX_BEHIND_PROXY: "true"
+
+      LDAP_SERVER: ldaps://LDAPSERVER:636
+      LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
+
+      ### There are to ways get users from the ldap server
+
+      ## NO LDAP BIND USER:
+      # Tries to bind with login-user (as uid) to LDAP_BINDDN
+      # LDAP_BINDDN: uid=%u,ou=someunit,ou=people,dc=DOMAIN,dc=TLD
+
+      ## Using a LDAP_BIND_USER/PW
+      # LDAP_BIND_USER:
+      # LDAP_BIND_PW:
+
+      # Only allow users matching LDAP_USER_FILTER
+      LDAP_USER_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+
+      # If user is in ADMIN_GROUP on user creation (first login) isAdmin is set to true.
+      # Admin Users can invite external (non ldap) users. This feature makes only sense
+      # when ALLOW_EMAIL_LOGIN is set to 'true'. Additionally admins can send
+      # system wide messages.
+      LDAP_ADMIN_GROUP_FILTER: "(memberof=cn=ADMINGROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+      ALLOW_EMAIL_LOGIN: "true"
+
+      # All users in the LDAP_CONTACT_FILTER are loaded from the ldap server into contacts.
+      LDAP_CONTACT_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
+      LDAP_CONTACTS: "false"
+
+      ## OAuth2 Settings
+      # OAUTH2_ENABLED: "true"
+      # OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
+      # OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
+      # OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
+      # OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
+      # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
+      # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
+      # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
+      # OAUTH2_USER_ATTR_EMAIL: email
+      # OAUTH2_USER_ATTR_UID: id
+      # OAUTH2_USER_ATTR_FIRSTNAME: name
+      # OAUTH2_USER_ATTR_LASTNAME:
+      # OAUTH2_USER_ATTR_IS_ADMIN: site_admin
+
+      # Same property, unfortunately with different names in
+      # different locations
+      SHARELATEX_REDIS_HOST: redis
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+
+      ENABLED_LINKED_FILE_TYPES: "url,project_file"
+
+      # Enables Thumbnail generation using ImageMagick
+      ENABLE_CONVERSIONS: "true"
+
+  mongo:
+    restart: always
+    image: mongo:4.4
+    container_name: mongo
+    expose:
+      - 27017
+    volumes:
+      - ${MYDATA}/mongo_data:/data/db
+    healthcheck:
+      test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+      interval: 10s
+      timeout: 10s
+      retries: 5
+    labels:
+      - "traefik.enable=true"
+      - "traefik.tcp.routers.mongodb.rule=HostSNI(`*`)"
+      - "traefik.tcp.services.mongodb.loadbalancer.server.port=27017"
+      - "traefik.tcp.routers.mongodb.tls=true"
+      - "traefik.tcp.routers.mongodb.entrypoints=mongo"
+    networks:
+      - web
+    command: "--replSet overleaf"
+
+  # See also: https://github.com/overleaf/overleaf/issues/1120
+  mongoinit:
+    image: mongo:4.4
+    # this container will exit after executing the command
+    restart: "no"
+    depends_on:
+      mongo:
+        condition: service_healthy
+    entrypoint:
+      [
+        "mongo",
+        "--host",
+        "mongo:27017",
+        "--eval",
+        'rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })',
+      ]
+
+  redis:
+    restart: always
+    image: redis:6.2
+    container_name: redis
+    # modify to get rid of the redis issue #35 and #19 with a better solution
+    # WARNING: /proc/sys/net/core/somaxconn is set to the lower value of 128.
+    # for vm overcommit: enable first on host system
+    # sysctl vm.overcommit_memory=1 (and add it to rc.local)
+    # then you do not need it in the redis container
+    sysctls:
+      - net.core.somaxconn=65535
+      # - vm.overcommit_memory=1
+    expose:
+      - 6379
+    volumes:
+      - ${MYDATA}/redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - web
+
+networks:
+  web:
+    external: true
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,108 +1,24 @@
-version: '2.2'
+version: "2.2"
 services:
-    traefik:
-        image: traefik:latest
-        container_name: traefik
-        restart: unless-stopped
-        security_opt:
-          - no-new-privileges:true
-        networks:
-          - web
-        ports:
-          - 80:80
-          - 443:443
-          - 8443:8443
-          # - 8080:8080
-          # - 27017:27017
-        volumes:
-          - ${MYDATA}/letsencrypt:/letsencrypt
-          - /etc/localtime:/etc/localtime:ro
-          - /var/run/docker.sock:/var/run/docker.sock:ro
-          - ./traefik/dynamic_conf.yml:/dynamic_conf.yml
-          - ./traefik/users.htpasswd:/users.htpasswd
-
-        command:
-          - "--api=true"
-          - "--api.dashboard=true"
-          #- "--api.insecure=true" # provides the dashboard on http://IPADRESS:8080
-          - "--providers.docker=true"
-          - "--ping"
-          - "--providers.docker.network=web"
-          - "--providers.docker.exposedbydefault=false"
-          - "--entrypoints.web.address=:80"
-          - "--entrypoints.web-secure.address=:443"
-          - "--entrypoints.web-admin.address=:8443"
-          - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
-          - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web"
-          - "--certificatesresolvers.myhttpchallenge.acme.email=${MYMAIL}"
-          - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
-          - "--entrypoints.mongo.address=:27017"
-          #- --certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
-        labels:
-          - "traefik.enable=true"
-          # To Fix enable dashboard on port 8443
-          - "traefik.http.routers.dashboard.entrypoints=web-admin"
-          - "traefik.http.routers.dashboard.rule=Host(`${MYDOMAIN}`)" 
-          # - "traefik.http.routers.dashboard.rule=Host(`traefik.${MYDOMAIN}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-          - "traefik.http.routers.dashboard.tls=true"
-          - "traefik.http.routers.dashboard.middlewares=auth"
-          - "traefik.http.middlewares.auth.basicauth.usersfile=/users.htpasswd"
-          - "traefik.http.routers.dashboard.service=api@internal"
-
-        logging:
-          driver: "json-file"
-          options:
-            max-size: "10m"
-            max-file: "1"
-
  sharelatex:
    restart: always
-        image: ldap-overleaf-sl:latest
+    image: ldap-overleaf-sl:240728
+    container_name: ldap-overleaf-sl
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
-            traefik: 
-                condition: service_started
-            #simple-certbot:
-            #    condition: service_started
    privileged: false
-        networks:
-            - web
-        expose:
-            - 80
-            - 443
+    ports:
+      - 80:80
    links:
      - mongo
      - redis
-              #- simple-certbot
    volumes:
      - ${MYDATA}/sharelatex:/var/lib/sharelatex
-            - ${MYDATA}/letsencrypt:/etc/letsencrypt:ro
-            # - ${MYDATA}/letsencrypt/live/${MYDOMAIN}/:/etc/letsencrypt/certs/domain
-        labels:
-              - "traefik.enable=true"
-              - "traefik.http.routers.tex.entrypoints=web"
-              - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
-              - "traefik.http.routers.sharel.middlewares=redirect-to-https@docker"
-              - "traefik.http.routers.sharel-secured.rule=Host(`${MYDOMAIN}`)"
-              - "traefik.http.routers.sharel-secured.tls=true"
-              - "traefik.http.routers.sharel-secured.tls.certresolver=myhttpchallenge"
-              - "traefik.http.routers.sharel-secured.entrypoints=web-secure"
-              - "traefik.http.routers.proxy-https.entrypoints=web-secure"
-              - "traefik.http.routers.proxy-https.rule=Host(`${MYDOMAIN}`)" 
-              - "traefik.http.services.sharel.loadbalancer.server.port=80"
-              - "traefik.http.services.sharel.loadbalancer.server.scheme=http"
-              # ToDo - internally connect via https: reuse the certifiacte from traefik (acme.json)
-              #- "traefik.http.services.sharel.loadbalancer.server.port=443"
-              #- "traefik.http.services.sharel.loadbalancer.server.scheme=https"
-              - "traefik.http.services.sharel.loadbalancer.sticky.cookie=true"
-              - "traefik.http.services.sharel.loadbalancer.sticky.cookie.name=io"
-              - "traefik.http.services.sharel.loadbalancer.sticky.cookie.httponly=true"
-              - "traefik.http.services.sharel.loadbalancer.sticky.cookie.secure=true"
-              - "traefik.http.services.sharel.loadbalancer.sticky.cookie.samesite=io"
-
+      - ${MYDATA}/letsencrypt:/etc/letsencrypt
+      - ${MYDATA}/letsencrypt/live/${MYDOMAIN}/:/etc/letsencrypt/certs/domain
    environment:
      SHARELATEX_APP_NAME: Overleaf
      SHARELATEX_MONGO_URL: mongodb://mongo/sharelatex
@@ -113,45 +29,75 @@ services:
      SHARELATEX_LEFT_FOOTER: '[{"text": "Powered by <a href=\"https://www.sharelatex.com\">ShareLaTeX</a> 2016"} ]'
      SHARELATEX_RIGHT_FOOTER: '[{"text": "LDAP Overleaf (beta)"} ]'
      SHARELATEX_EMAIL_FROM_ADDRESS: "noreply@${MYDOMAIN}"
-            SHARELATEX_EMAIL_SMTP_HOST: smtp.${MYDOMAIN}
-            SHARELATEX_EMAIL_SMTP_PORT: 587
-            SHARELATEX_EMAIL_SMTP_SECURE: 'false'
+      # SHARELATEX_EMAIL_AWS_SES_ACCESS_KEY_ID:
+      # SHARELATEX_EMAIL_AWS_SES_SECRET_KEY:
+      SHARELATEX_EMAIL_SMTP_HOST: 192.168.1.99
+      SHARELATEX_EMAIL_SMTP_PORT: 25
+      SHARELATEX_EMAIL_SMTP_SECURE: "false"
      # SHARELATEX_EMAIL_SMTP_USER:
      # SHARELATEX_EMAIL_SMTP_PASS:
      # SHARELATEX_EMAIL_SMTP_TLS_REJECT_UNAUTH: true
      # SHARELATEX_EMAIL_SMTP_IGNORE_TLS: false
      SHARELATEX_CUSTOM_EMAIL_FOOTER: "This system is run by ${MYDOMAIN} - please contact ${MYMAIL} if you experience any issues."

+      #LOG_LEVEL: "debug"
+
      # make public links accessible w/o login (link sharing issue)
      # https://github.com/overleaf/docker-image/issues/66
      # https://github.com/overleaf/overleaf/issues/628
      # https://github.com/overleaf/web/issues/367
      # Fixed in 2.0.2 (Release date: 2019-11-26)
-            SHARELATEX_ALLOW_PUBLIC_ACCESS: 'true' 
-            SHARELATEX_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: 'true'
+      SHARELATEX_ALLOW_PUBLIC_ACCESS: "true"
+      SHARELATEX_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"

-            SHARELATEX_SECURE_COOKIE: 'true'
-            SHARELATEX_BEHIND_PROXY: 'true'
+      # Uncomment the following line to enable secure cookies if you are using SSL
+      # SHARELATEX_SECURE_COOKIE: "true"
+      # SHARELATEX_BEHIND_PROXY: "true"

-            LDAP_SERVER: ldaps://LDAPSERVER:636
-            LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
-            LDAP_BINDDN: ou=someunit,ou=people,dc=DOMAIN,dc=TLS
+      LDAP_SERVER: ldap://ipa.mildstone.org:389
+      LDAP_BASE: cn=users,cn=accounts,dc=mildstone,dc=org

-            # By default tries to bind directly with the ldap user - this user has to be in the LDAP GROUP
-            # LDAP_GROUP_FILTER: '(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)'
-            LDAP_GROUP_FILTER: '(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)'
+      ### There are to ways get users from the ldap server
+
+      ## NO LDAP BIND USER:
+      # Tries directly to bind with the login user (as uid)
+      # LDAP_BINDDN: uid=%u,ou=someunit,ou=people,dc=DOMAIN,dc=TLD
+      # LDAP_BINDDN: uid=%u,ou=people,dc=mildstone,dc=org
+
+      ## Or you can use ai global LDAP_BIND_USER
+      LDAP_BIND_USER: uid=ldapsearch,cn=users,cn=accounts,dc=mildstone,dc=org
+      LDAP_BIND_PW: ldap_ha39it9
+
+      # Only allow users matching LDAP_USER_FILTER
+      LDAP_USER_FILTER: "(&(memberof=cn=latexusers,cn=groups,cn=accounts,dc=mildstone,dc=org)(uid=%u))"

      # If user is in ADMIN_GROUP on user creation (first login) isAdmin is set to true.
      # Admin Users can invite external (non ldap) users. This feature makes only sense
      # when ALLOW_EMAIL_LOGIN is set to 'true'. Additionally admins can send
      # system wide messages.
-            LDAP_ADMIN_GROUP_FILTER: '(memberof=cn=ADMINGROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)'
-            ALLOW_EMAIL_LOGIN: 'true'
+      LDAP_ADMIN_GROUP_FILTER: "(memberof=cn=admins,cn=groups,cn=accounts,dc=mildstone,dc=org)"
+      ALLOW_EMAIL_LOGIN: "true"

-            # All users in the LDAP_GROUP_FILTER are loaded from the ldap server into contacts.
-            # This LDAP search happens without bind. If you want this and your LDAP needs a bind you can 
-            # adapt this in the function getLdapContacts() in ContactsController.js (lines 82 - 107)
-            LDAP_CONTACTS: 'false'
+      # All users in the LDAP_CONTACT_FILTER are loaded from the ldap server into contacts.
+      LDAP_CONTACT_FILTER: "(memberof=cn=latexusers,cn=groups,cn=accounts,dc=mildstone,dc=org)"
+      LDAP_CONTACTS: "true"
+
+
+      ## OAuth2 Settings
+      # OAUTH2_ENABLED: "true"
+      # OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
+      # OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
+      # OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
+      # OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
+      # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
+      # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
+      # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
+      # OAUTH2_USER_ATTR_EMAIL: email
+      # OAUTH2_USER_ATTR_UID: id
+      # OAUTH2_USER_ATTR_FIRSTNAME: name
+      # OAUTH2_USER_ATTR_LASTNAME:
+      # OAUTH2_USER_ATTR_IS_ADMIN: site_admin

      # Same property, unfortunately with different names in
      # different locations
@@ -159,14 +105,14 @@ services:
      REDIS_HOST: redis
      REDIS_PORT: 6379

-            ENABLED_LINKED_FILE_TYPES: 'url,project_file'
+      ENABLED_LINKED_FILE_TYPES: "url,project_file"

      # Enables Thumbnail generation using ImageMagick
-            ENABLE_CONVERSIONS: 'true'
+      ENABLE_CONVERSIONS: "true"

  mongo:
    restart: always
-        image: mongo
+    image: mongo:4.4
    container_name: mongo
    expose:
      - 27017
@@ -177,27 +123,29 @@ services:
      interval: 10s
      timeout: 10s
      retries: 5
-        labels:
-            - "traefik.enable=true"
-            - "traefik.tcp.routers.mongodb.rule=HostSNI(`*`)"
-            - "traefik.tcp.services.mongodb.loadbalancer.server.port=27017"
-            - "traefik.tcp.routers.mongodb.tls=true"
-            - "traefik.tcp.routers.mongodb.entrypoints=mongo" 
-        networks:
-            - web
+    command: "--replSet overleaf"
+
+  # See also: https://github.com/overleaf/overleaf/issues/1120
+  mongoinit:
+    image: mongo:4.4
+    # this container will exit after executing the command
+    restart: "no"
+    depends_on:
+      mongo:
+        condition: service_healthy
+    entrypoint:
+      [
+        "mongo",
+        "--host",
+        "mongo:27017",
+        "--eval",
+        'rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })',
+      ]

  redis:
    restart: always
-        image: redis:5.0.0
+    image: redis:6.2
    container_name: redis
-        # modify to get rid of the redis issue #35 and #19 with a better solution
-        # WARNING: /proc/sys/net/core/somaxconn is set to the lower value of 128.
-        # for vm overcommit: enable first on host system 
-        # sysctl vm.overcommit_memory=1 (and add it to rc.local)
-        # then you do not need it in the redis container
-        sysctls:
-            - net.core.somaxconn=65535
-            # - vm.overcommit_memory=1
    expose:
      - 6379
    volumes:
@@ -207,30 +155,3 @@ services:
      interval: 10s
      timeout: 5s
      retries: 5
-        networks:
-            - web
-
-
-#    simple-certbot:
-#        restart: always
-#        image: certbot/certbot
-#        container_name: simple-certbot
-#        ports:
-#            - 80:80
-#        volumes:
-#            - ${MYDATA}/letsencrypt:/etc/letsencrypt
-#        # a bit hacky but this docker image uses very little disk-space
-#        # best practices for ssl and nginx are set in the ldap-overleaf-sl Dockerfile
-#        entrypoint: 
-#            - "/bin/sh"
-#            - -c
-#            - | 
-#              trap exit TERM;\
-#              certbot certonly --standalone -d ${MYDOMAIN} --agree-tos -m ${MYMAIL} -n ; \
-#              while :; do certbot renew; sleep 240h & wait $${!}; done;
-#
-
-networks:
-  web:
-    external: true
-
--- a/ldap-overleaf-sl/Dockerfile
+++ b/ldap-overleaf-sl/Dockerfile
@@ -1,76 +1,97 @@
-FROM sharelatex/sharelatex:2.5.2
+FROM sharelatex/sharelatex:4.2.0
 # FROM sharelatex/sharelatex:latest
 # latest might not be tested 
-# e.g. the AuthenticationManager.js script had to be adapted between versions after 2.3.1 
+# e.g. the AuthenticationManager.js script had to be adapted after versions 2.3.1 
 LABEL maintainer="Simon Haller-Seeber"
 LABEL version="0.1"

 # passed from .env (via make)
 ARG collab_text
 ARG login_text   
+ARG admin_is_sysadmin

 # set workdir (might solve issue #2 - see https://stackoverflow.com/questions/57534295/)
-WORKDIR /var/www/sharelatex/web
+WORKDIR /overleaf/services/web

-# install latest npm
-RUN npm install -g npm
-# clean cache (might solve issue #2)
-#RUN npm cache clean --force
-RUN npm install ldapts-search
-RUN npm install ldapts
-#RUN npm install bcrypt@5.0.0

-# This variant of updateing texlive does not work
-#RUN  bash -c tlmgr install scheme-full
-# try this one:
-RUN apt-get update
-RUN apt-get -y install python-pygments
-#RUN apt-get -y install texlive texlive-lang-german texlive-latex-extra 
+
+RUN npm cache clean --force && \ 
+    npm install -g npm@10.5.0
+
+
+    # install latest npm
+RUN \
+    ## clean cache (might solve issue #2)
+    ##npm cache clean --force && \
+    ##npm install -g npm@latest && \
+    npm install ldap-escape ldapts-search ldapts@3.2.4 && \
+    # npm install bcrypt@5.0.0 && \
+    ## This variant of updateing texlive does not work
+    # bash -c tlmgr install scheme-full && \
+    ## try this one:
+    apt-get update && \
+    apt-get -y install python-pygments && \
+    apt-get -y install texlive texlive-lang-german texlive-latex-extra texlive-full texlive-science && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*

 # overwrite some files
-COPY sharelatex/AuthenticationManager.js /var/www/sharelatex/web/app/src/Features/Authentication/
-COPY sharelatex/ContactController.js 	/var/www/sharelatex/web/app/src/Features/Contacts/
-
-# instead of copying the login.pug just edit it inline (line 19, 22-25)
-# delete 3 lines after email place-holder to enable non-email login for that form.
-RUN sed -iE '/type=.*email.*/d' /var/www/sharelatex/web/app/views/user/login.pug
-RUN sed -iE '/email@example.com/{n;N;N;d}' /var/www/sharelatex/web/app/views/user/login.pug
-RUN sed -iE "s/email@example.com/${login_text:-user}/g" /var/www/sharelatex/web/app/views/user/login.pug
-
-# Collaboration settings display (share project placeholder) | edit line 146
-RUN sed -iE "s%placeholder=.*$%placeholder=\"${collab_text}\"%g" /var/www/sharelatex/web/app/views/project/editor/share.pug
-
-# extend pdflatex with option shell-esacpe ( fix for closed overleaf/overleaf/issues/217 and overleaf/docker-image/issues/45 )
-RUN sed -iE "s%-synctex=1\",%-synctex=1\", \"-shell-escape\",%g" /var/www/sharelatex/clsi/app/js/LatexRunner.js
+COPY sharelatex/AuthenticationManager.js    /overleaf/services/web/app/src/Features/Authentication/
+COPY sharelatex/AuthenticationController.js /overleaf/services/web/app/src/Features/Authentication/
+COPY sharelatex/ContactController.js        /overleaf/services/web/app/src/Features/Contacts/
+COPY sharelatex/router.js                   /overleaf/services/web/app/src/router.js

 # Too much changes to do inline (>10 Lines).
-COPY sharelatex/settings.pug 		/var/www/sharelatex/web/app/views/user/
-COPY sharelatex/navbar.pug 		/var/www/sharelatex/web/app/views/layout/
+COPY sharelatex/settings.pug    /overleaf/services/web/app/views/user/
+COPY sharelatex/login.pug       /overleaf/services/web/app/views/user/
+COPY sharelatex/navbar.pug      /overleaf/services/web/app/views/layout/
+COPY sharelatex/navbar-marketing.pug      /overleaf/services/web/app/views/layout/

 # Non LDAP User Registration for Admins
-COPY sharelatex/admin-index.pug 	/var/www/sharelatex/web/app/views/admin/index.pug
-RUN rm /var/www/sharelatex/web/app/views/admin/register.pug
+COPY sharelatex/admin-index.pug     /overleaf/services/web/app/views/admin/index.pug
+COPY sharelatex/admin-sysadmin.pug  /tmp/admin-sysadmin.pug
+
+    ## comment out this line to prevent sed accidently remove the brackets of the email(username) field
+    # sed -iE '/email@example.com/{n;N;N;d}' /overleaf/services/web/app/views/user/login.pug && \
+RUN sed -iE "s/email@example.com/${login_text:-user}/g" /overleaf/services/web/app/views/user/login.pug && \
+    ## Collaboration settings display (share project placeholder) | edit line 146
+    ## share.pug file was removed in later versions
+    # sed -iE "s%placeholder=.*$%placeholder=\"${collab_text}\"%g" /overleaf/services/web/app/views/project/editor/share.pug && \
+    ## extend pdflatex with option shell-esacpe ( fix for closed overleaf/overleaf/issues/217 and overleaf/docker-image/issues/45 )
+    ## do this in different ways for different sharelatex versions
+    sed -iE "s%-synctex=1\",%-synctex=1\", \"-shell-escape\",%g" /overleaf/services/clsi/app/js/LatexRunner.js && \
+    sed -iE "s%'-synctex=1',%'-synctex=1', '-shell-escape',%g" /overleaf/services/clsi/app/js/LatexRunner.js && \
+    if [ "${admin_is_sysadmin}" = "true" ] ; \
+        then cp /tmp/admin-sysadmin.pug /overleaf/services/web/app/views/admin/index.pug ; \
+        else rm /tmp/admin-sysadmin.pug ; \
+    fi 
+    # This seems to be fixed in Sharelatex 4.
+    # && \
+    # rm /overleaf/services/web/modules/user-activate/app/views/user/register.pug && \
+    ### To remove comments entirly (bug https://github.com/overleaf/overleaf/issues/678)
+    #rm /overleaf/services/web/app/views/project/editor/review-panel.pug && \
+    #touch /overleaf/services/web/app/views/project/editor/review-panel.pug

-### To remove comments entirly (bug https://github.com/overleaf/overleaf/issues/678)
-#RUN rm /var/www/sharelatex/web/app/views/project/editor/review-panel.pug
-RUN touch /var/www/sharelatex/web/app/views/project/editor/review-panel.pug

 ### Nginx and Certificates
 # enable https via letsencrypt
-RUN  rm /etc/nginx/sites-enabled/sharelatex.conf
-COPY nginx/sharelatex.conf /etc/nginx/sites-enabled/sharelatex.conf
+# RUN rm /etc/nginx/sites-enabled/sharelatex.conf
+# COPY nginx/sharelatex.conf /etc/nginx/sites-enabled/sharelatex.conf

 # get maintained best practice ssl from certbot
-RUN wget https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf -O /etc/nginx/options-ssl-nginx.conf    
-RUN wget https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem -O /etc/nginx/ssl-dhparams.pem 
+# RUN wget https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf -O /etc/nginx/options-ssl-nginx.conf && \
+#     wget https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem -O /etc/nginx/ssl-dhparams.pem 

 # reload nginx via cron for reneweing https certificates automatically
-COPY nginx/nginx-reload.sh  /etc/cron.weekly/
-RUN chmod 0744 /etc/cron.weekly/nginx-reload.sh
+# COPY nginx/nginx-reload.sh  /etc/cron.weekly/
+# RUN chmod 0744 /etc/cron.weekly/nginx-reload.sh

 ## extract certificates from acme.json?
 # COPY nginx/nginx-cert.sh /etc/cron.weekly/
-# RUN chmod 0744 /etc/cron.weekly/nginx-cert.sh
-# RUN echo "/usr/cron.weekly/nginx-cert.sh 2>&1 > /dev/null" >  /etc/rc.local
-# RUN chmod 0744 /etc/rc.local
+# RUN chmod 0744 /etc/cron.weekly/nginx-cert.sh && \
+#     echo "/usr/cron.weekly/nginx-cert.sh 2>&1 > /dev/null" > /etc/rc.local && \
+#     chmod 0744 /etc/rc.local

+
+COPY update_texlive.sh /overleaf/services/web
+RUN sh update_texlive.sh
--- a/ldap-overleaf-sl/sharelatex/.gitkeep
+++ b/ldap-overleaf-sl/sharelatex/.gitkeep
--- a/ldap-overleaf-sl/sharelatex/AuthenticationManager.js
+++ b/ldap-overleaf-sl/sharelatex/AuthenticationManager.js
@@ -1,360 +0,0 @@
-const Settings = require('settings-sharelatex')
-const { User } = require('../../models/User')
-const { db, ObjectId } = require('../../infrastructure/mongodb')
-const bcrypt = require('bcrypt')
-const EmailHelper = require('../Helpers/EmailHelper')
-const {
-  InvalidEmailError,
-  InvalidPasswordError
-} = require('./AuthenticationErrors')
-const util = require('util')
-
-const { Client } = require('ldapts');
-
-// https://www.npmjs.com/package/@overleaf/o-error
-// have a look if we can do nice error messages.
-
-const BCRYPT_ROUNDS = Settings.security.bcryptRounds || 12
-const BCRYPT_MINOR_VERSION = Settings.security.bcryptMinorVersion || 'a'
-
-const _checkWriteResult = function(result, callback) {
-  // for MongoDB
-  if (result && result.modifiedCount === 1) {
-    callback(null, true)
-  } else {
-    callback(null, false)
-  }
-}
-
-const AuthenticationManager = {
-  authenticate(query, password, callback) {
-    // Using Mongoose for legacy reasons here. The returned User instance
-    // gets serialized into the session and there may be subtle differences
-    // between the user returned by Mongoose vs mongodb (such as default values)
-    User.findOne(query, (error, user) => {
-      //console.log("Begining:" + JSON.stringify(query))
-      AuthenticationManager.authUserObj(error, user, query, password, callback)
-    })
-  },
-    //login with any password
-  login(user, password, callback) {
-    AuthenticationManager.checkRounds(
-      user,
-      user.hashedPassword,
-      password,
-      function (err) {
-        if (err) {
-          return callback(err)
-        }
-        callback(null, user)
-        }
-    )
-  },
-
-  createIfNotExistAndLogin(query, user, callback, uid, firstname, lastname, mail, isAdmin) {
-    if (!user) {
-      //console.log("Creating User:" + JSON.stringify(query))
-      //create random pass for local userdb, does not get checked for ldap users during login
-      let pass = require("crypto").randomBytes(32).toString("hex")
-      //console.log("Creating User:" + JSON.stringify(query) + "Random Pass" + pass)
-
-      const userRegHand = require('../User/UserRegistrationHandler.js')
-      userRegHand.registerNewUser({
-        email: mail,
-        first_name: firstname,
-        last_name: lastname,
-        password: pass
-      },
-      function (error, user) {
-        if (error) {
-          console.log(error)
-        }
-        user.email = mail
-        user.isAdmin = isAdmin
-        user.emails[0].confirmedAt = Date.now()
-        user.save()
-        //console.log("user %s added to local library: ", mail)
-        User.findOne(query, (error, user) => {
-          if (error) {
-            console.log(error)
-          }
-          if (user && user.hashedPassword) {
-            AuthenticationManager.login(user, "randomPass", callback)
-          }
-        })
-      }) // end register user
-    } else {
-      AuthenticationManager.login(user, "randomPass", callback)
-    }
-  },
-
-  authUserObj(error, user, query, password, callback) {
-    if ( process.env.ALLOW_EMAIL_LOGIN ) {
-      // (external) email login 
-      if (user && user.hashedPassword) {
-        console.log("email login for existing user")
-        // check passwd against local db
-        bcrypt.compare(password, user.hashedPassword, function (error, match) {
-          if (match) {
-            console.log("Fine")
-            AuthenticationManager.login(user, password, callback)
-          }
-        })
-      } else {
-        // check passwd against ldap
-        AuthenticationManager.ldapAuth(query, password, AuthenticationManager.createIfNotExistAndLogin, callback, user)
-      }
-    } else {
-      // No local passwd check user has to be in ldap and use ldap credentials
-      AuthenticationManager.ldapAuth(query, password, AuthenticationManager.createIfNotExistAndLogin, callback, user)
-    }
-    return null
-  },
-
-  validateEmail(email) {
-    // we use the emailadress from the ldap 
-    // therefore we do not enforce checks here
-    const parsed = EmailHelper.parseEmail(email)
-    //if (!parsed) {
-    //    return new InvalidEmailError({ message: 'email not valid' })
-    //}
-    return null
-  },
-
-  // validates a password based on a similar set of rules to `complexPassword.js` on the frontend
-  // note that `passfield.js` enforces more rules than this, but these are the most commonly set.
-  // returns null on success, or an error object.
-  validatePassword(password, email) {
-    if (password == null) {
-      return new InvalidPasswordError({
-        message: 'password not set',
-        info: { code: 'not_set' }
-      })
-    }
-
-    let allowAnyChars, min, max
-    if (Settings.passwordStrengthOptions) {
-      allowAnyChars = Settings.passwordStrengthOptions.allowAnyChars === true
-      if (Settings.passwordStrengthOptions.length) {
-        min = Settings.passwordStrengthOptions.length.min
-        max = Settings.passwordStrengthOptions.length.max
-      }
-    }
-    allowAnyChars = !!allowAnyChars
-    min = min || 6
-    max = max || 72
-
-    // we don't support passwords > 72 characters in length, because bcrypt truncates them
-    if (max > 72) {
-      max = 72
-    }
-
-    if (password.length < min) {
-      return new InvalidPasswordError({
-        message: 'password is too short',
-        info: { code: 'too_short' }
-      })
-    }
-    if (password.length > max) {
-      return new InvalidPasswordError({
-        message: 'password is too long',
-        info: { code: 'too_long' }
-      })
-    }
-    if (
-      !allowAnyChars &&
-      !AuthenticationManager._passwordCharactersAreValid(password)
-    ) {
-      return new InvalidPasswordError({
-        message: 'password contains an invalid character',
-        info: { code: 'invalid_character' }
-      })
-      }
-      return null
-    },
-
-  setUserPassword(user, password, callback) {
-    AuthenticationManager.setUserPasswordInV2(user, password, callback)
-  },
-
-  checkRounds(user, hashedPassword, password, callback) {
-    // Temporarily disable this function, TODO: re-enable this
-    //return callback()
-    if (Settings.security.disableBcryptRoundsUpgrades) {
-      return callback()
-    }
-    // check current number of rounds and rehash if necessary
-    const currentRounds = bcrypt.getRounds(hashedPassword)
-    if (currentRounds < BCRYPT_ROUNDS) {
-      AuthenticationManager.setUserPassword(user, password, callback)
-    } else {
-      callback()
-    }
-  },
-
-  hashPassword(password, callback) {
-    bcrypt.genSalt(BCRYPT_ROUNDS, BCRYPT_MINOR_VERSION, function(error, salt) {
-      if (error) {
-        return callback(error)
-      }
-      bcrypt.hash(password, salt, callback)
-    })
-  },
-
-  setUserPasswordInV2(user, password, callback) {
-    //if (!user || !user.email || !user._id) {
-    //  return callback(new Error('invalid user object'))
-    //}
-    
-    console.log("Setting pass for user: " + JSON.stringify(user))
-    const validationError = this.validatePassword(password, user.email)
-    if (validationError) {
-      return callback(validationError)
-    }
-    this.hashPassword(password, function(error, hash) {
-      if (error) {
-        return callback(error)
-      }
-      db.users.updateOne(
-        {
-          _id: ObjectId(user._id.toString())
-        },
-        {
-          $set: {
-            hashedPassword: hash
-          },
-          $unset: {
-            password: true
-          }
-        },
-        function(updateError, result) {
-          if (updateError) {
-            return callback(updateError)
-          }
-          _checkWriteResult(result, callback)
-        }
-      )
-    })
-  },
-
-  _passwordCharactersAreValid(password) {
-    let digits, letters, lettersUp, symbols
-    if (
-      Settings.passwordStrengthOptions &&
-      Settings.passwordStrengthOptions.chars
-    ) {
-      digits = Settings.passwordStrengthOptions.chars.digits
-      letters = Settings.passwordStrengthOptions.chars.letters
-      lettersUp = Settings.passwordStrengthOptions.chars.letters_up
-      symbols = Settings.passwordStrengthOptions.chars.symbols
-    }
-    digits = digits || '1234567890'
-    letters = letters || 'abcdefghijklmnopqrstuvwxyz'
-    lettersUp = lettersUp || 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
-    symbols = symbols || '@#$%^&*()-_=+[]{};:<>/?!£€.,'
-
-    for (let charIndex = 0; charIndex <= password.length - 1; charIndex++) {
-      if (
-        digits.indexOf(password[charIndex]) === -1 &&
-        letters.indexOf(password[charIndex]) === -1 &&
-        lettersUp.indexOf(password[charIndex]) === -1 &&
-        symbols.indexOf(password[charIndex]) === -1
-      ) {
-        return false
-      }
-    }
-    return true
-  },
-
-  async ldapAuth(query, password, onSuccessCreateUserIfNotExistent, callback, user) {
-    const client = new Client({
-      url: process.env.LDAP_SERVER,
-    });
-    //const bindDn = process.env.LDAP_BIND_USER
-    //const bindPassword = process.env.LDAP_BIND_PW
-    const ldap_bd = process.env.LDAP_BINDDN
-    const ldap_base = process.env.LDAP_BASE
-    const uid = query.email.split('@')[0]
-    const filterstr = '(&' + process.env.LDAP_GROUP_FILTER + '(uid=' + uid + '))'
-    const userDn = 'uid=' + uid + ',' + ldap_bd;
-    var mail = ""
-    var firstname = ""
-    var lastname = ""
-    var isAdmin = false
-    // check bind
-    try {
-      //await client.bind(bindDn, bindPassword);
-      await client.bind(userDn,password);
-    } catch (ex) {
-      console.log("Could not bind user." + String(ex))
-      return callback(null, null)
-    }
-    // get user data
-    try {
-      const {searchEntries, searchRef,} = await client.search(ldap_base, {
-        scope: 'sub',
-        filter: filterstr ,
-      });
-      await searchEntries
-      //console.log(JSON.stringify(searchEntries))
-      if (searchEntries[0]) {
-        mail = searchEntries[0].mail
-        firstname = searchEntries[0].givenName
-        lastname = searchEntries[0].sn
-        //console.log("Found user: " + mail + " Name: " + firstname + " " + lastname)
-      }
-    } catch (ex) {
-      console.log("An Error occured while getting user data during ldapsearch: " + String(ex))
-        await client.unbind();
-        return callback(null, null)
-    }
-    try {
-      // if admin filter is set - only set admin for user in ldap group
-      // does not matter - admin is deactivated: managed through ldap
-      if (process.env.LDAP_ADMIN_GROUP_FILTER) { 
-        const adminfilter = '(&' + process.env.LDAP_ADMIN_GROUP_FILTER + '(uid=' + uid + '))' 
-        adminEntry = await client.search(ldap_base, {
-          scope: 'sub',
-          filter: adminfilter,
-        });
-        await adminEntry;
-        //console.log("Admin Search response:" + JSON.stringify(adminEntry.searchEntries))
-        if (adminEntry.searchEntries[0].mail) {
-          console.log("is Admin")
-          isAdmin=true;
-        }
-      }
-    } catch (ex) {
-      console.log("An Error occured while checking for admin rights - setting admin rights to false: " + String(ex))
-      isAdmin = false;
-    } finally {
-      await client.unbind();
-    }
-    if (mail == "") {
-      console.log("Mail not set - exit. This should not happen - please set mail-entry in ldap.")
-      return callback(null, null)
-    }
-    //console.log("Logging in user: " + mail + " Name: " + firstname + " " + lastname + " isAdmin: " + String(isAdmin))
-    // we are authenticated now let's set the query to the correct mail from ldap
-    query.email = mail
-    User.findOne(query, (error, user) => {
-      if (error) {
-        console.log(error)
-      }
-      if (user && user.hashedPassword) {
-        //console.log("******************** LOGIN ******************")
-        AuthenticationManager.login(user, "randomPass", callback)
-      } else {
-        onSuccessCreateUserIfNotExistent(query, user, callback, uid, firstname, lastname, mail, isAdmin)
-      }
-    })
-  }
-}
-
-AuthenticationManager.promises = {
-  authenticate: util.promisify(AuthenticationManager.authenticate),
-  hashPassword: util.promisify(AuthenticationManager.hashPassword),
-  setUserPassword: util.promisify(AuthenticationManager.setUserPassword)
-}
-
-module.exports = AuthenticationManager
--- a/ldap-overleaf-sl/sharelatex/ContactController.js
+++ b/ldap-overleaf-sl/sharelatex/ContactController.js
@@ -1,128 +0,0 @@
-/* eslint-disable
-    camelcase,
-    max-len,
-    no-unused-vars,
-*/
-// TODO: This file was created by bulk-decaffeinate.
-// Fix any style issues and re-enable lint.
-/*
- * decaffeinate suggestions:
- * DS101: Remove unnecessary use of Array.from
- * DS102: Remove unnecessary code created because of implicit returns
- * DS207: Consider shorter variations of null checks
- * Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
- */
-let ContactsController
-const AuthenticationController = require('../Authentication/AuthenticationController')
-const ContactManager = require('./ContactManager')
-const UserGetter = require('../User/UserGetter')
-const logger = require('logger-sharelatex')
-const Modules = require('../../infrastructure/Modules')
-const { Client } = require('ldapts');
-
-module.exports = ContactsController = {
-  getContacts(req, res, next) {
-    const user_id = AuthenticationController.getLoggedInUserId(req)
-    return ContactManager.getContactIds(user_id, { limit: 50 }, function(
-      error,
-      contact_ids
-    ) {
-      if (error != null) {
-        return next(error)
-      }
-      return UserGetter.getUsers(
-        contact_ids,
-        {
-          email: 1,
-          first_name: 1,
-          last_name: 1,
-          holdingAccount: 1
-        },
-        function(error, contacts) {
-          if (error != null) {
-            return next(error)
-          }
-
-          // UserGetter.getUsers may not preserve order so put them back in order
-          const positions = {}
-          for (let i = 0; i < contact_ids.length; i++) {
-            const contact_id = contact_ids[i]
-            positions[contact_id] = i
-          }
-	  
-          contacts.sort(
-            (a, b) =>
-              positions[a._id != null ? a._id.toString() : undefined] -
-              positions[b._id != null ? b._id.toString() : undefined]
-          )
-
-          // Don't count holding accounts to discourage users from repeating mistakes (mistyped or wrong emails, etc)
-          contacts = contacts.filter(c => !c.holdingAccount)
-	  ContactsController.getLdapContacts(contacts).then((ldapcontacts) => { 
-	    contacts.push(ldapcontacts)
-            contacts = contacts.map(ContactsController._formatContact)
-            return Modules.hooks.fire('getContacts', user_id, contacts, function(
-              error,
-              additional_contacts
-            ) {
-              if (error != null) {
-                return next(error)
-              }
-              contacts = contacts.concat(...Array.from(additional_contacts || []))
-              return res.send({
-                contacts
-              })
-            })
-  	  }).catch(e => console.log("Error appending ldap contacts" + e))
-
-        }
-      )
-    })
-  },
-  async getLdapContacts(contacts) {
-    if (! process.env.LDAP_CONTACTS) {
-       return contacts
-    }
-    const client = new Client({
-    url: process.env.LDAP_SERVER,
-    });
-    const ldap_base = process.env.LDAP_BASE
-    // get user data
-    try {
-      // if you need an client.bind do it here.
-      const {searchEntries,searchReferences,} = await client.search(ldap_base, {scope: 'sub',filter: process.env.LDAP_GROUP_FILTER ,});
-      await searchEntries;
-      for (var i = 0; i < searchEntries.length; i++) {
-       var entry = new Map()
-       var obj = searchEntries[i];
-       entry['_id'] = undefined
-       entry['email'] = obj['mail']
-       entry['first_name'] = obj['givenName']
-       entry['last_name'] = obj['sn']
-       entry['type'] = "user"
-       // Only add to contacts if entry is not there.
-       if(contacts.indexOf(entry) === -1) {
-          contacts.push(entry);
-       }
-      }
-    } catch (ex) {
-      console.log(String(ex))
-    }  
-    //console.log(JSON.stringify(contacts)) 
-    finally {
-     // even if we did not use bind - the constructor of 
-     // new Client() opens a socket to the ldap server
-     client.unbind()
-     return contacts
-    }
-  },
-  _formatContact(contact) {
-    return {
-      id: contact._id != null ? contact._id.toString() : undefined,
-      email: contact.email || '',
-      first_name: contact.first_name || '',
-      last_name: contact.last_name || '',
-      type: 'user'
-    }
-  }
-}
--- a/ldap-overleaf-sl/sharelatex/admin-index.pug
+++ b/ldap-overleaf-sl/sharelatex/admin-index.pug
@@ -1,57 +0,0 @@
-extends ../layout
-
-block content
-	.content.content-alt
-		.container
-			.row
-				.col-xs-12
-					.card(ng-controller="RegisterUsersController")
-						.page-header
-							h1 Admin Panel
-						tabset(ng-cloak)
-							tab(heading="System Messages")
-								each message in systemMessages
-									.alert.alert-info.row-spaced(ng-non-bindable) #{message.content}
-								hr
-								form(method='post', action='/admin/messages')
-									input(name="_csrf", type="hidden", value=csrfToken)
-									.form-group
-										label(for="content")
-										input.form-control(name="content", type="text", placeholder="Message...", required)
-									button.btn.btn-primary(type="submit") Post Message
-								hr
-								form(method='post', action='/admin/messages/clear')
-									input(name="_csrf", type="hidden", value=csrfToken)
-									button.btn.btn-danger(type="submit") Clear all messages
-
-
-							tab(heading="Register non LDAP User")
-								form.form
-								.row
-									.col-md-4.col-xs-8
-										input.form-control(
-										name="email",
-										type="text",
-										placeholder="jane@example.com, joe@example.com",
-										ng-model="inputs.emails",
-										on-enter="registerUsers()"
-									)
-									.col-md-8.col-xs-4
-										button.btn.btn-primary(ng-click="registerUsers()") #{translate("register")}
-									
-									.row-spaced(ng-show="error").ng-cloak.text-danger
-										p Sorry, an error occured
-						
-									.row-spaced(ng-show="users.length > 0").ng-cloak.text-success
-										p We've sent out welcome emails to the registered users.
-										p You can also manually send them URLs below to allow them to reset their password and log in for the first time.
-										p (Password reset tokens will expire after one week and the user will need registering again).
-
-									hr(ng-show="users.length > 0").ng-cloak
-									table(ng-show="users.length > 0").table.table-striped.ng-cloak
-										tr
-												th #{translate("email")}
-												th Set Password Url
-										tr(ng-repeat="user in users")
-												td {{ user.email }}
-												td(style="word-break: break-all;") {{ user.setNewPasswordUrl }}
--- a/ldap-overleaf-sl/sharelatex/navbar.pug
+++ b/ldap-overleaf-sl/sharelatex/navbar.pug
@@ -1,84 +0,0 @@
-nav.navbar.navbar-default.navbar-main
-	.container-fluid
-		.navbar-header
-			button.navbar-toggle(ng-init="navCollapsed = true", ng-click="navCollapsed = !navCollapsed", ng-class="{active: !navCollapsed}", aria-label="Toggle " + translate('navigation'))
-				i.fa.fa-bars(aria-hidden="true")
-			if settings.nav.custom_logo
-				a(href='/', aria-label=settings.appName, style='background-image:url("'+settings.nav.custom_logo+'")').navbar-brand
-			else if (nav.title)
-				a(href='/', aria-label=settings.appName, ng-non-bindable).navbar-title #{nav.title}
-			else
-				a(href='/', aria-label=settings.appName).navbar-brand
-
-		.navbar-collapse.collapse(collapse="navCollapsed")
-
-			ul.nav.navbar-nav.navbar-right
-				if (getSessionUser() && getSessionUser().isAdmin)
-					li
-						a(href="/admin") Admin
-
-
-				// loop over header_extras
-				each item in nav.header_extras
-					-
-						if ((item.only_when_logged_in && getSessionUser())
-							|| (item.only_when_logged_out && (!getSessionUser()))
-							|| (!item.only_when_logged_out && !item.only_when_logged_in && !item.only_content_pages)
-							|| (item.only_content_pages && (typeof(suppressNavContentLinks) == "undefined" || !suppressNavContentLinks))
-						){ 
-							var showNavItem = true
-						} else {
-							var showNavItem = false
-						}
-
-					if showNavItem
-						if item.dropdown
-							li.dropdown(class=item.class, dropdown)
-								a.dropdown-toggle(href, dropdown-toggle)
-									| !{translate(item.text)}
-									b.caret
-								ul.dropdown-menu
-									each child in item.dropdown
-										if child.divider
-											li.divider
-										else
-											li
-												if child.url
-													a(href=child.url, class=child.class) !{translate(child.text)}
-												else
-													| !{translate(child.text)}
-						else
-							li(class=item.class)
-								if item.url
-									a(href=item.url, class=item.class) !{translate(item.text)}
-								else
-									| !{translate(item.text)}
-
-				// logged out
-				if !getSessionUser()
-					// login link
-					li
-						a(href="/login") #{translate('log_in')}
-
-				// projects link and account menu
-				if getSessionUser()
-					li
-						a(href="/project") #{translate('Projects')}
-					li.dropdown(dropdown)
-						a.dropdown-toggle(href, dropdown-toggle)
-							| #{translate('Account')}
-							b.caret
-						ul.dropdown-menu
-							//li
-							//	div.subdued(ng-non-bindable) #{getUserEmail()}
-							//li.divider.hidden-xs.hidden-sm
-							li
-								a(href="/user/settings") #{translate('Account Settings')}
-							if nav.showSubscriptionLink
-								li
-									a(href="/user/subscription") #{translate('subscription')}
-							li.divider.hidden-xs.hidden-sm
-							li
-								form(method="POST" action="/logout")
-									input(name='_csrf', type='hidden', value=csrfToken)
-									button.btn-link.text-left.dropdown-menu-button #{translate('log_out')}
--- a/ldap-overleaf-sl/sharelatex/settings.pug
+++ b/ldap-overleaf-sl/sharelatex/settings.pug
@@ -1,178 +0,0 @@
-extends ../layout
-
-block content
-	.content.content-alt
-		.container
-			.row
-				.col-md-12.col-lg-10.col-lg-offset-1
-					if ssoError
-						.alert.alert-danger
-							| #{translate('sso_link_error')}: #{translate(ssoError)}
-					.card
-						.page-header
-							h1  #{translate("account_settings")}
-						.account-settings(ng-controller="AccountSettingsController", ng-cloak)
-
-							if hasFeature('affiliations')
-								include settings/user-affiliations
-
-							.row
-								.col-md-5
-									h3 #{translate("update_account_info")}
-									form(async-form="settings", name="settingsForm", method="POST", action="/user/settings", novalidate)
-										input(type="hidden", name="_csrf", value=csrfToken)
-										if !hasFeature('affiliations')
-											// show the email, non-editable
-											.form-group
-												label.control-label #{translate("email")}
-												div.form-control(
-													readonly="true",
-													ng-non-bindable
-												) #{user.email}
-
-										if shouldAllowEditingDetails
-											.form-group
-												label(for='firstName').control-label #{translate("first_name")}
-												input.form-control(
-													id="firstName"
-													type='text',
-													name='first_name',
-													value=user.first_name
-													ng-non-bindable
-												)
-											.form-group
-												label(for='lastName').control-label #{translate("last_name")}
-												input.form-control(
-													id="lastName"
-													type='text',
-													name='last_name',
-													value=user.last_name
-													ng-non-bindable
-												)
-											.form-group
-												form-messages(aria-live="polite" for="settingsForm")
-													.alert.alert-success(ng-show="settingsForm.response.success")
-														|  #{translate("thanks_settings_updated")}
-											.actions
-												button.btn.btn-primary(
-													type='submit',
-													ng-disabled="settingsForm.$invalid"
-												)  #{translate("update")}
-										else
-											.form-group
-												label.control-label #{translate("first_name")}
-												div.form-control(
-													readonly="true",
-													ng-non-bindable
-												) #{user.first_name}
-											.form-group
-												label.control-label #{translate("last_name")}
-												div.form-control(
-													readonly="true",
-													ng-non-bindable
-												) #{user.last_name}
-
-								.col-md-5.col-md-offset-1
-									h3 
-										| Set Password for Email login
-									p 
-										| Note: you can not change the LDAP password from here. You can set/reset a password for 
-										| your email login:
-										| #[a(href="/user/password/reset", target='_blank') Reset.]
-
-							| !{moduleIncludes("userSettings", locals)}
-							hr
-
-							h3
-								| Contact
-							div 
-								| If you need any help, please contact your sysadmins.
-							
-							p #{translate("need_to_leave")} 
-								a(href, ng-click="deleteAccount()")  #{translate("delete_your_account")}
-
-
-
-	script(type='text/ng-template', id='deleteAccountModalTemplate')
-		.modal-header
-			h3 #{translate("delete_account")}
-		div.modal-body#delete-account-modal
-			p !{translate("delete_account_warning_message_3")}
-			if settings.createV1AccountOnLogin && settings.overleaf
-				p
-					strong
-						| Your Overleaf v2 projects will be deleted if you delete your account.
-						| If you want to remove any remaining Overleaf v1 projects in your account,
-						| please first make sure they are imported to Overleaf v2.
-
-			if settings.overleaf && !hasPassword
-				p
-					b
-						| #[a(href="/user/password/reset", target='_blank') #{translate("delete_acct_no_existing_pw")}].
-			else
-				form(novalidate, name="deleteAccountForm")
-					label #{translate('email')}
-					input.form-control(
-						type="text",
-						autocomplete="off",
-						placeholder="",
-						ng-model="state.deleteText",
-						focus-on="open",
-						ng-keyup="checkValidation()"
-					)
-
-					label #{translate('password')}
-					input.form-control(
-						type="password",
-						autocomplete="off",
-						placeholder="",
-						ng-model="state.password",
-						ng-keyup="checkValidation()"
-					)
-
-					div.confirmation-checkbox-wrapper
-						input(
-							type="checkbox"
-							ng-model="state.confirmV1Purge"
-							ng-change="checkValidation()"
-						).pull-left
-						label(style="display: inline") &nbsp;I have left, purged or imported my projects on Overleaf v1 (if any) &nbsp;
-
-					div.confirmation-checkbox-wrapper
-						input(
-							type="checkbox"
-							ng-model="state.confirmSharelatexDelete"
-							ng-change="checkValidation()"
-						).pull-left
-						label(style="display: inline") &nbsp;I understand this will delete all projects in my Overleaf v2 account (and ShareLaTeX account, if any) with email address #[em {{ userDefaultEmail }}]
-
-			div(ng-if="state.error")
-				div.alert.alert-danger(ng-switch="state.error.code")
-					span(ng-switch-when="InvalidCredentialsError")
-						| #{translate('email_or_password_wrong_try_again')}
-					span(ng-switch-when="SubscriptionAdminDeletionError")
-						| #{translate('subscription_admins_cannot_be_deleted')}
-					span(ng-switch-when="UserDeletionError")
-						| #{translate('user_deletion_error')}
-					span(ng-switch-default)
-						| #{translate('generic_something_went_wrong')}
-			if settings.createV1AccountOnLogin && settings.overleaf
-				div(ng-if="state.error && state.error.code == 'InvalidCredentialsError'")
-					div.alert.alert-info
-						| If you can't remember your password, or if you are using Single-Sign-On with another provider
-						| to sign in (such as Twitter or Google), please
-						| #[a(href="/user/password/reset", target='_blank') reset your password],
-						| and try again.
-		.modal-footer
-			button.btn.btn-default(
-				ng-click="cancel()"
-			) #{translate("cancel")}
-			button.btn.btn-danger(
-				ng-disabled="!state.isValid || state.inflight"
-				ng-click="delete()"
-			)
-				span(ng-hide="state.inflight") #{translate("delete")}
-				span(ng-show="state.inflight") #{translate("deleting")}...
-	
-	script(type='text/javascript').
-		window.passwordStrengthOptions = !{StringHelper.stringifyJsonForScript(settings.passwordStrengthOptions || {})}
--- a/ldap-overleaf-sl/sharelatex_diff/AuthenticationController.js.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/AuthenticationController.js.diff
@@ -0,0 +1,98 @@
+268a268,364
+> 
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>   oauth2Redirect(req, res, next) {
+>     // random state
+>     const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+>     const state = new Array(6).fill(0).map(() => characters.charAt(Math.floor(Math.random() * characters.length))).join("")
+>     req.session.oauth2State = state
+> 
+>     const redirectURI = encodeURIComponent(`${process.env.SHARELATEX_SITE_URL}/oauth/callback`) 
+>     const authURL = (
+>       process.env.OAUTH2_AUTHORIZATION_URL
+>       + `?response_type=code`
+>       + `&client_id=${process.env.OAUTH2_CLIENT_ID}`
+>       + `&redirect_uri=${redirectURI}`
+>       + `&scope=${process.env.OAUTH2_SCOPE ?? ""} `
+>       + `&state=${state}`
+>     )
+>     res.redirect(authURL)
+>   },
+> 
+>   async oauth2Callback(req, res, next) {
+>     console.log(`OAuth, receive code ${req.query.code} and state ${req.query.state}`)
+>     const saveState = req.session.oauth2State
+>     delete req.session.oauth2State
+>     if (saveState !== req.query.state) {
+>       return AuthenticationController.finishLogin(false, req, res, next)
+>     }
+> 
+>     try {
+>       const contentType = process.env.OAUTH2_TOKEN_CONTENT_TYPE || 'application/x-www-form-urlencoded'
+>       const bodyParams = {
+>         grant_type: "authorization_code",
+>         client_id: process.env.OAUTH2_CLIENT_ID,
+>         client_secret: process.env.OAUTH2_CLIENT_SECRET,
+>         code: req.query.code,
+>         redirect_uri: `${process.env.SHARELATEX_SITE_URL}/oauth/callback`,
+>       }
+>       const body = contentType === 'application/json'
+>         ? JSON.stringify(bodyParams)
+>         : new URLSearchParams(bodyParams).toString()
+> 
+>       const tokenResponse = await fetch(process.env.OAUTH2_TOKEN_URL, {
+>         method: 'POST',
+>         headers: {
+>           "Accept": "application/json",
+>           "Content-Type": contentType,
+>         },
+>         body
+>       })
+>       
+>       const tokenData = await tokenResponse.json()
+>       console.log("OAuth2 respond", JSON.stringify(tokenData))
+> 
+>       const profileResponse = await fetch(process.env.OAUTH2_PROFILE_URL, {
+>         method: 'GET',
+>         headers: {
+>           "Accept": "application/json",
+>           "Authorization": `Bearer ${tokenData.access_token}`,
+>         }
+>       });
+>       const profile = await profileResponse.json()
+>       console.log("OAuth2 user profile", JSON.stringify(profile))
+> 
+>       const email = profile[process.env.OAUTH2_USER_ATTR_EMAIL ?? "email"]
+>       const uid = profile[process.env.OAUTH2_USER_ATTR_UID ?? "uid"]
+>       const firstname = profile?.[process.env.OAUTH2_USER_ATTR_FIRSTNAME] ?? email
+>       const lastname = process.env.OAUTH2_USER_ATTR_LASTNAME
+>         ? profile?.[process.env.OAUTH2_USER_ATTR_LASTNAME] ?? ""
+>         : ""
+>       const isAdmin = process.env.OAUTH2_USER_ATTR_IS_ADMIN
+>         ? !!profile?.[process.env.OAUTH2_USER_ATTR_IS_ADMIN] ?? false
+>         : false
+> 
+>       const query = { email }
+>       const callback = (error, user) => {
+>         if (error) {
+>           res.json({message: error});
+>         } else {
+>           console.log("OAuth user", JSON.stringify(user));
+>           AuthenticationController.finishLogin(user, req, res, next);
+>         }
+>       }
+>       AuthenticationManager.createIfNotFoundAndLogin(
+>         query,
+>         callback,
+>         uid,
+>         firstname,
+>         lastname,
+>         email,
+>         isAdmin
+>       )
+>     } catch(e) {
+>       res.redirect("/login")
+>       console.error("Fails to access by OAuth2: " + String(e))
+>     }
+>   },
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
--- a/ldap-overleaf-sl/sharelatex_diff/AuthenticationManager.js.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/AuthenticationManager.js.diff
@@ -0,0 +1,305 @@
+19a20,25
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+> const fs = require("fs")
+> const { Client } = require("ldapts")
+> const ldapEscape = require("ldap-escape")
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+> 
+120a127,136
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>   _checkUserPassword2(query, password, callback) {
+>     // leave original _checkUserPassword untouched, because it will be called by
+>     // setUserPasswordInV2 (e.g. UserRegistrationHandler.js )
+>     User.findOne(query, (error, user) => {
+>       AuthenticationManager.authUserObj(error, user, query, password, callback)
+>     })
+>   },
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+> 
+126c142,144
+<     AuthenticationManager._checkUserPassword(
+---
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>     AuthenticationManager._checkUserPassword2(
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+190a209,488
+> 
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>   /**
+>    * login with any password
+>    */
+>   login(user, password, callback) {
+>     callback(null, user, true)
+>   },
+> 
+>   createIfNotFoundAndLogin(
+>     query,
+>     callback,
+>     uid,
+>     firstname,
+>     lastname,
+>     mail,
+>     isAdmin
+>   ) {
+>     User.findOne(query, (error, user) => {
+>       if (error) {
+>         console.log(error)
+>       }
+> 
+>       AuthenticationManager.createIfNotExistAndLogin(
+>         query,
+>         user,
+>         callback,
+>         uid,
+>         firstname,
+>         lastname,
+>         mail,
+>         isAdmin
+>       )
+>     })
+>   },
+> 
+>   createIfNotExistAndLogin(
+>     query,
+>     user,
+>     callback,
+>     uid,
+>     firstname,
+>     lastname,
+>     mail,
+>     isAdmin
+>   ) {
+>     if (!user) {
+>       //create random pass for local userdb, does not get checked for ldap users during login
+>       const pass = require("crypto").randomBytes(32).toString("hex")
+>       console.log('Creating User', { mail, uid, firstname, lastname, isAdmin, pass })
+> 
+>       const userRegHand = require("../User/UserRegistrationHandler.js")
+>       userRegHand.registerNewUser(
+>         {
+>           email: mail,
+>           first_name: firstname,
+>           last_name: lastname,
+>           password: pass,
+>         },
+>         function (error, user, setNewPasswordUrl) {
+>           if (error) {
+>             console.log(error)
+>           }
+>           user.email = mail
+>           user.isAdmin = isAdmin
+>           user.emails[0].confirmedAt = Date.now()
+>           user.save()
+>           //console.log('user %s added to local library: ', mail)
+>           User.findOne(query, (error, user) => {
+>             if (error) {
+>               console.log(error)
+>             }
+>             if (user && user.hashedPassword) {
+>               AuthenticationManager.login(user, "randomPass", callback)
+>             }
+>           })
+>         }
+>       ) // end register user
+>     } else {
+>       console.log('User exists', { mail })
+>       AuthenticationManager.login(user, "randomPass", callback)
+>     }
+>   },
+> 
+>   authUserObj(error, user, query, password, callback) {
+>     if (process.env.ALLOW_EMAIL_LOGIN && user && user.hashedPassword) {
+>       console.log("email login for existing user " + query.email)
+>       // check passwd against local db
+>       bcrypt.compare(password, user.hashedPassword, function (error, match) {
+>         if (match) {
+>           console.log("Local user password match")
+>           _metricsForSuccessfulPasswordMatch(password)
+>           //callback(null, user, match)
+>           AuthenticationManager.login(user, "randomPass", callback)
+>         } else {
+>           console.log("Local user password mismatch, trying LDAP")
+>           // check passwd against ldap
+>           AuthenticationManager.ldapAuth(
+>             query,
+>             password,
+>             AuthenticationManager.createIfNotExistAndLogin,
+>             callback,
+>             user
+>           )
+>         }
+>       })
+>     } else {
+>       // No local passwd check user has to be in ldap and use ldap credentials
+>       AuthenticationManager.ldapAuth(
+>         query,
+>         password,
+>         AuthenticationManager.createIfNotExistAndLogin,
+>         callback,
+>         user
+>       )
+>     }
+>     return null
+>   },
+> 
+>   async ldapAuth(
+>     query,
+>     password,
+>     onSuccessCreateUserIfNotExistent,
+>     callback,
+>     user
+>   ) {
+>     const client = fs.existsSync(process.env.LDAP_SERVER_CACERT)
+>       ? new Client({
+>           url: process.env.LDAP_SERVER,
+>           tlsOptions: {
+>             ca: [fs.readFileSync(process.env.LDAP_SERVER_CACERT)],
+>           },
+>         })
+>       : new Client({
+>           url: process.env.LDAP_SERVER,
+>         })
+> 
+>     const ldap_reader = process.env.LDAP_BIND_USER
+>     const ldap_reader_pass = process.env.LDAP_BIND_PW
+>     const ldap_base = process.env.LDAP_BASE
+> 
+>     var mail = query.email
+>     var uid = query.email.split("@")[0]
+>     var firstname = ""
+>     var lastname = ""
+>     var isAdmin = false
+>     var userDn = ""
+> 
+>     //replace all appearences of %u with uid and all %m with mail:
+>     const replacerUid = new RegExp("%u", "g")
+>     const replacerMail = new RegExp("%m", "g")
+>     const filterstr = process.env.LDAP_USER_FILTER.replace(
+>       replacerUid,
+>       ldapEscape.filter`${uid}`
+>     ).replace(replacerMail, ldapEscape.filter`${mail}`) //replace all appearances
+>     // check bind
+>     try {
+>       if (process.env.LDAP_BINDDN) {
+>         //try to bind directly with the user trying to log in
+>         userDn = process.env.LDAP_BINDDN.replace(
+>           replacerUid,
+>           ldapEscape.filter`${uid}`
+>         ).replace(replacerMail, ldapEscape.filter`${mail}`)
+>         await client.bind(userDn, password)
+>       } else {
+>         // use fixed bind user
+>         await client.bind(ldap_reader, ldap_reader_pass)
+>       }
+>     } catch (ex) {
+>       if (process.env.LDAP_BINDDN) {
+>         console.log("Could not bind user: " + userDn)
+>       } else {
+>         console.log(
+>           "Could not bind LDAP reader: " + ldap_reader + " err: " + String(ex)
+>         )
+>       }
+>       return callback(null, null)
+>     }
+> 
+>     // get user data
+>     try {
+>       const { searchEntries, searchRef } = await client.search(ldap_base, {
+>         scope: "sub",
+>         filter: filterstr,
+>       })
+>       await searchEntries
+>       console.log(JSON.stringify(searchEntries))
+>       if (searchEntries[0]) {
+>         mail = searchEntries[0].mail
+>         uid = searchEntries[0].uid
+>         firstname = searchEntries[0].givenName
+>         lastname = searchEntries[0].sn
+>         if (!process.env.LDAP_BINDDN) {
+>           //dn is already correctly assembled
+>           userDn = searchEntries[0].dn
+>         }
+>         console.log(
+>           `Found user: ${mail} Name: ${firstname} ${lastname} DN: ${userDn}`
+>         )
+>       }
+>     } catch (ex) {
+>       console.log(
+>         "An Error occured while getting user data during ldapsearch: " +
+>           String(ex)
+>       )
+>       await client.unbind()
+>       return callback(null, null)
+>     }
+> 
+>     try {
+>       // if admin filter is set - only set admin for user in ldap group
+>       // does not matter - admin is deactivated: managed through ldap
+>       if (process.env.LDAP_ADMIN_GROUP_FILTER) {
+>         const adminfilter = process.env.LDAP_ADMIN_GROUP_FILTER.replace(
+>           replacerUid,
+>           ldapEscape.filter`${uid}`
+>         ).replace(replacerMail, ldapEscape.filter`${mail}`)
+>         adminEntry = await client.search(ldap_base, {
+>           scope: "sub",
+>           filter: adminfilter,
+>         })
+>         await adminEntry
+>         //console.log('Admin Search response:' + JSON.stringify(adminEntry.searchEntries))
+>         if (adminEntry.searchEntries[0]) {
+>           console.log("is Admin")
+>           isAdmin = true
+>         }
+>       }
+>     } catch (ex) {
+>       console.log(
+>         "An Error occured while checking for admin rights - setting admin rights to false: " +
+>           String(ex)
+>       )
+>       isAdmin = false
+>     } finally {
+>       await client.unbind()
+>     }
+>     if (mail == "" || userDn == "") {
+>       console.log(
+>         "Mail / userDn not set - exit. This should not happen - please set mail-entry in ldap."
+>       )
+>       return callback(null, null)
+>     }
+> 
+>     if (!process.env.BINDDN) {
+>       //since we used a fixed bind user to obtain the correct userDn we need to bind again to authenticate
+>       try {
+>         await client.bind(userDn, password)
+>       } catch (ex) {
+>         console.log("Could not bind User: " + userDn + " err: " + String(ex))
+>         return callback(null, null)
+>       } finally {
+>         await client.unbind()
+>       }
+>     }
+>     //console.log('Logging in user: ' + mail + ' Name: ' + firstname + ' ' + lastname + ' isAdmin: ' + String(isAdmin))
+>     // we are authenticated now let's set the query to the correct mail from ldap
+>     query.email = mail
+>     User.findOne(query, (error, user) => {
+>       if (error) {
+>         console.log(error)
+>       }
+>       if (user && user.hashedPassword) {
+>         //console.log('******************** LOGIN ******************')
+>         AuthenticationManager.login(user, "randomPass", callback)
+>       } else {
+>         onSuccessCreateUserIfNotExistent(
+>           query,
+>           user,
+>           callback,
+>           uid,
+>           firstname,
+>           lastname,
+>           mail,
+>           isAdmin
+>         )
+>       }
+>     })
+>   },
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
--- a/ldap-overleaf-sl/sharelatex_diff/ContactController.js.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/ContactController.js.diff
@@ -0,0 +1,76 @@
+6a7,10
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+> const { Client } = require('ldapts')
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+> 
+34,35c38,39
+<     const contactId = contactIds[i]
+<     positions[contactId] = i
+---
+>     const contact_id = contactIds[i]
+>     positions[contact_id] = i
+42c46,51
+<   contacts = contacts.filter(c => !c.holdingAccount)
+---
+>   contacts = contacts.filter((c) => !c.holdingAccount)
+> 
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>   const ldapcontacts = getLdapContacts(contacts)
+>   contacts.push(ldapcontacts)
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+56a66,120
+> 
+> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+> async function getLdapContacts(contacts) {
+>   if (
+>     process.env.LDAP_CONTACTS === undefined ||
+>     !(process.env.LDAP_CONTACTS.toLowerCase() === 'true')
+>   ) {
+>     return contacts
+>   }
+>   const client = new Client({
+>     url: process.env.LDAP_SERVER,
+>   })
+> 
+>   // if we need a ldap user try to bind
+>   if (process.env.LDAP_BIND_USER) {
+>     try {
+>       await client.bind(process.env.LDAP_BIND_USER, process.env.LDAP_BIND_PW)
+>     } catch (ex) {
+>       console.log('Could not bind LDAP reader user: ' + String(ex))
+>     }
+>   }
+> 
+>   const ldap_base = process.env.LDAP_BASE
+>   // get user data
+>   try {
+>     // if you need an client.bind do it here.
+>     const { searchEntries, searchReferences } = await client.search(ldap_base, {
+>       scope: 'sub',
+>       filter: process.env.LDAP_CONTACT_FILTER,
+>     })
+>     await searchEntries
+>     for (var i = 0; i < searchEntries.length; i++) {
+>       var entry = new Map()
+>       var obj = searchEntries[i]
+>       entry['_id'] = undefined
+>       entry['email'] = obj['mail']
+>       entry['first_name'] = obj['givenName']
+>       entry['last_name'] = obj['sn']
+>       entry['type'] = 'user'
+>       // Only add to contacts if entry is not there.
+>       if (contacts.indexOf(entry) === -1) {
+>         contacts.push(entry)
+>       }
+>     }
+>   } catch (ex) {
+>     console.log(String(ex))
+>   } finally {
+>     // console.log(JSON.stringify(contacts))
+>     // even if we did not use bind - the constructor of
+>     // new Client() opens a socket to the ldap server
+>     client.unbind()
+>     return contacts
+>   }
+> }
+> // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
--- a/ldap-overleaf-sl/sharelatex_diff/admin-index.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/admin-index.pug.diff
@@ -0,0 +1,72 @@
+15,18c15
+< 								+bookmarkable-tabset-header('open-sockets', 'Open Sockets')
+< 								+bookmarkable-tabset-header('open-close-editor', 'Open/Close Editor')
+< 								if hasFeature('saas')
+< 									+bookmarkable-tabset-header('tpds', 'TPDS/Dropbox Management')
+---
+> 								+bookmarkable-tabset-header('register-user', 'Register User')
+39,49d35
+< 								.tab-pane(
+< 									role="tabpanel"
+< 									id='open-sockets'
+< 								)
+< 									.row-spaced
+< 										ul
+< 											each agents, url in openSockets
+< 												li(ng-non-bindable) #{url} - total : #{agents.length}
+< 													ul
+< 														each agent in agents
+< 															li(ng-non-bindable) #{agent}
+53c39
+< 									id='open-close-editor'
+---
+> 									id='register-user'
+55,74c41,42
+< 									if hasFeature('saas')
+< 										| The "Open/Close Editor" feature is not available in SAAS.
+< 									else
+< 										.row-spaced
+< 											form(method='post',action='/admin/closeEditor')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Close Editor
+< 											p.small Will stop anyone opening the editor. Will NOT disconnect already connected users.
+< 
+< 										.row-spaced
+< 											form(method='post',action='/admin/disconnectAllUsers')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Disconnect all users
+< 											p.small Will force disconnect all users with the editor open. Make sure to close the editor first to avoid them reconnecting.
+< 
+< 										.row-spaced
+< 											form(method='post',action='/admin/openEditor')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Reopen Editor
+< 											p.small Will reopen the editor after closing.
+---
+> 									hr
+> 									a(href="/admin/register") Register User
+76,99d43
+< 								if hasFeature('saas')
+< 									.tab-pane(
+< 										role="tabpanel"
+< 										id='tpds'
+< 									)
+< 										h3 Flush project to TPDS
+< 										.row
+< 											form.col-xs-6(method='post',action='/admin/flushProjectToTpds')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												.form-group
+< 													label(for='project_id') project_id
+< 													input.form-control(type='text',  name='project_id', placeholder='project_id', required)
+< 												.form-group
+< 													button.btn-primary.btn(type='submit') Flush
+< 										hr
+< 										h3 Poll Dropbox for user
+< 										.row
+< 											form.col-xs-6(method='post',action='/admin/pollDropboxForUser')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												.form-group
+< 													label(for='user_id') user_id
+< 													input.form-control(type='text',  name='user_id', placeholder='user_id', required)
+< 												.form-group
+< 													button.btn-primary.btn(type='submit') Poll
--- a/ldap-overleaf-sl/sharelatex_diff/admin-sysadmin.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/admin-sysadmin.pug.diff
@@ -0,0 +1,166 @@
+1,2c1
+< extends ../layout-marketing
+< include ../_mixins/bookmarkable_tabset
+---
+> extends ../layout
+9c8
+< 					.card
+---
+> 					.card(ng-controller="RegisterUsersController")
+12,16c11,58
+< 						div(data-ol-bookmarkable-tabset)
+< 							ul.nav.nav-tabs(role="tablist")
+< 								+bookmarkable-tabset-header('system-messages', 'System Messages', true)
+< 								+bookmarkable-tabset-header('open-sockets', 'Open Sockets')
+< 								+bookmarkable-tabset-header('open-close-editor', 'Open/Close Editor')
+---
+> 						tabset(ng-cloak)
+> 							tab(heading="System Messages")
+> 								each message in systemMessages
+> 									.alert.alert-info.row-spaced(ng-non-bindable) #{message.content}
+> 								hr
+> 								form(method='post', action='/admin/messages')
+> 									input(name="_csrf", type="hidden", value=csrfToken)
+> 									.form-group
+> 										label(for="content")
+> 										input.form-control(name="content", type="text", placeholder="Message...", required)
+> 									button.btn.btn-primary(type="submit") Post Message
+> 								hr
+> 								form(method='post', action='/admin/messages/clear')
+> 									input(name="_csrf", type="hidden", value=csrfToken)
+> 									button.btn.btn-danger(type="submit") Clear all messages
+> 
+> 
+> 							tab(heading="Register non LDAP User")
+> 								form.form
+> 								.row
+> 									.col-md-4.col-xs-8
+> 										input.form-control(
+> 										name="email",
+> 										type="text",
+> 										placeholder="jane@example.com, joe@example.com",
+> 										ng-model="inputs.emails",
+> 										on-enter="registerUsers()"
+> 									)
+> 									.col-md-8.col-xs-4
+> 										button.btn.btn-primary(ng-click="registerUsers()") #{translate("register")}
+> 
+> 									.row-spaced(ng-show="error").ng-cloak.text-danger
+> 										p Sorry, an error occured
+> 
+> 									.row-spaced(ng-show="users.length > 0").ng-cloak.text-success
+> 										p We've sent out welcome emails to the registered users.
+> 										p You can also manually send them URLs below to allow them to reset their password and log in for the first time.
+> 										p (Password reset tokens will expire after one week and the user will need registering again).
+> 
+> 									hr(ng-show="users.length > 0").ng-cloak
+> 									table(ng-show="users.length > 0").table.table-striped.ng-cloak
+> 										tr
+> 												th #{translate("email")}
+> 												th Set Password Url
+> 										tr(ng-repeat="user in users")
+> 												td {{ user.email }}
+> 												td(style="word-break: break-all;") {{ user.setNewPasswordUrl }}
+> 							tab(heading="Open/Close Editor" bookmarkable-tab="open-close-editor")
+18c60,66
+< 									+bookmarkable-tabset-header('tpds', 'TPDS/Dropbox Management')
+---
+> 									| The "Open/Close Editor" feature is not available in SAAS.
+> 								else
+> 									.row-spaced
+> 										form(method='post',action='/admin/closeEditor')
+> 											input(name="_csrf", type="hidden", value=csrfToken)
+> 											button.btn.btn-danger(type="submit") Close Editor
+> 										p.small Will stop anyone opening the editor. Will NOT disconnect already connected users.
+20,42d67
+< 							.tab-content
+< 								.tab-pane.active(
+< 									role="tabpanel"
+< 									id='system-messages'
+< 								)
+< 									each message in systemMessages
+< 										.alert.alert-info.row-spaced(ng-non-bindable) #{message.content}
+< 									hr
+< 									form(method='post', action='/admin/messages')
+< 										input(name="_csrf", type="hidden", value=csrfToken)
+< 										.form-group
+< 											label(for="content")
+< 											input.form-control(name="content", type="text", placeholder="Message…", required)
+< 										button.btn.btn-primary(type="submit") Post Message
+< 									hr
+< 									form(method='post', action='/admin/messages/clear')
+< 										input(name="_csrf", type="hidden", value=csrfToken)
+< 										button.btn.btn-danger(type="submit") Clear all messages
+< 
+< 								.tab-pane(
+< 									role="tabpanel"
+< 									id='open-sockets'
+< 								)
+44,74c69,78
+< 										ul
+< 											each agents, url in openSockets
+< 												li(ng-non-bindable) #{url} - total : #{agents.length}
+< 													ul
+< 														each agent in agents
+< 															li(ng-non-bindable) #{agent}
+< 
+< 								.tab-pane(
+< 									role="tabpanel"
+< 									id='open-close-editor'
+< 								)
+< 									if hasFeature('saas')
+< 										| The "Open/Close Editor" feature is not available in SAAS.
+< 									else
+< 										.row-spaced
+< 											form(method='post',action='/admin/closeEditor')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Close Editor
+< 											p.small Will stop anyone opening the editor. Will NOT disconnect already connected users.
+< 
+< 										.row-spaced
+< 											form(method='post',action='/admin/disconnectAllUsers')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Disconnect all users
+< 											p.small Will force disconnect all users with the editor open. Make sure to close the editor first to avoid them reconnecting.
+< 
+< 										.row-spaced
+< 											form(method='post',action='/admin/openEditor')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												button.btn.btn-danger(type="submit") Reopen Editor
+< 											p.small Will reopen the editor after closing.
+---
+> 										form(method='post',action='/admin/disconnectAllUsers')
+> 											input(name="_csrf", type="hidden", value=csrfToken)
+> 											button.btn.btn-danger(type="submit") Disconnect all users
+> 										p.small Will force disconnect all users with the editor open. Make sure to close the editor first to avoid them reconnecting.
+> 
+> 									.row-spaced
+> 										form(method='post',action='/admin/openEditor')
+> 											input(name="_csrf", type="hidden", value=csrfToken)
+> 											button.btn.btn-danger(type="submit") Reopen Editor
+> 										p.small Will reopen the editor after closing.
+76,99d79
+< 								if hasFeature('saas')
+< 									.tab-pane(
+< 										role="tabpanel"
+< 										id='tpds'
+< 									)
+< 										h3 Flush project to TPDS
+< 										.row
+< 											form.col-xs-6(method='post',action='/admin/flushProjectToTpds')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												.form-group
+< 													label(for='project_id') project_id
+< 													input.form-control(type='text',  name='project_id', placeholder='project_id', required)
+< 												.form-group
+< 													button.btn-primary.btn(type='submit') Flush
+< 										hr
+< 										h3 Poll Dropbox for user
+< 										.row
+< 											form.col-xs-6(method='post',action='/admin/pollDropboxForUser')
+< 												input(name="_csrf", type="hidden", value=csrfToken)
+< 												.form-group
+< 													label(for='user_id') user_id
+< 													input.form-control(type='text',  name='user_id', placeholder='user_id', required)
+< 												.form-group
+< 													button.btn-primary.btn(type='submit') Poll
--- a/ldap-overleaf-sl/sharelatex_diff/login.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/login.pug.diff
@@ -0,0 +1,20 @@
+14a15,22
+> 								//- >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+> 								//- input.form-control(
+> 								//- 	type='email',
+> 								//- 	name='email',
+> 								//- 	required,
+> 								//- 	placeholder='email@example.com',
+> 								//- 	autofocus="true"
+> 								//- )
+16d23
+< 									type='email',
+21a29
+> 								//- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+36a45,50
+> 							//- >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+> 							if process.env.OAUTH2_ENABLED === 'true'
+> 								.form-group.text-center(style="padding-top: 10px")
+> 									a.btn-block.login-btn(href="/oauth/redirect" style='padding-left: 0px')
+> 										| Log in via #{process.env.OAUTH2_PROVIDER || 'OAuth'}
+> 							//- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
--- a/ldap-overleaf-sl/sharelatex_diff/navbar-marketing.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/navbar-marketing.pug.diff
@@ -0,0 +1,3 @@
+55,56d54
+< 									li
+< 										a(href="/admin/project") Project URL Lookup
--- a/ldap-overleaf-sl/sharelatex_diff/navbar.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/navbar.pug.diff
@@ -0,0 +1,217 @@
+4,6c4,5
+< 			if (typeof(suppressNavbarRight) == "undefined")
+< 				button.navbar-toggle(ng-init="navCollapsed = true", ng-click="navCollapsed = !navCollapsed", ng-class="{active: !navCollapsed}", aria-label="Toggle " + translate('navigation'))
+< 					i.fa.fa-bars(aria-hidden="true")
+---
+> 			button.navbar-toggle(ng-init="navCollapsed = true", ng-click="navCollapsed = !navCollapsed", ng-class="{active: !navCollapsed}", aria-label="Toggle " + translate('navigation'))
+> 				i.fa.fa-bars(aria-hidden="true")
+14,106c13,74
+< 		- var canDisplayAdminMenu = hasAdminAccess()
+< 		- var canDisplayAdminRedirect = canRedirectToAdminDomain()
+< 		- var canDisplaySplitTestMenu = hasFeature('saas') && (canDisplayAdminMenu || (getSessionUser() && getSessionUser().staffAccess && (getSessionUser().staffAccess.splitTestMetrics || getSessionUser().staffAccess.splitTestManagement)))
+< 		- var canDisplaySurveyMenu = hasFeature('saas') && canDisplayAdminMenu
+< 		- var featuresPageVariant = splitTestVariants && splitTestVariants['features-page']
+< 
+< 		if (typeof(suppressNavbarRight) == "undefined")
+< 			.navbar-collapse.collapse(collapse="navCollapsed")
+< 				ul.nav.navbar-nav.navbar-right
+< 					if (canDisplayAdminMenu || canDisplayAdminRedirect || canDisplaySplitTestMenu)
+< 						li.dropdown(class="subdued", dropdown)
+< 							a.dropdown-toggle(href, dropdown-toggle)
+< 								| Admin
+< 								b.caret
+< 							ul.dropdown-menu
+< 								if canDisplayAdminMenu
+< 									li
+< 										a(href="/admin") Manage Site
+< 									li
+< 										a(href="/admin/user") Manage Users
+< 									li
+< 										a(href="/admin/project") Project URL Lookup
+< 									li
+< 										a(href="/admin/saml/logs") SAML logs
+< 								if canDisplayAdminRedirect
+< 									li
+< 										a(href=settings.adminUrl) Switch to Admin
+< 								if canDisplaySplitTestMenu
+< 									li
+< 										a(href="/admin/split-test") Manage Feature Flags
+< 								if canDisplaySurveyMenu
+< 									li
+< 										a(href="/admin/survey") Manage Surveys
+< 
+< 					// loop over header_extras
+< 					each item in nav.header_extras
+< 						-
+< 							if ((item.only_when_logged_in && getSessionUser())
+< 								|| (item.only_when_logged_out && (!getSessionUser()))
+< 								|| (!item.only_when_logged_out && !item.only_when_logged_in && !item.only_content_pages)
+< 								|| (item.only_content_pages && (typeof(suppressNavContentLinks) == "undefined" || !suppressNavContentLinks))
+< 							){ 
+< 								var showNavItem = true
+< 							} else {
+< 								var showNavItem = false
+< 							}
+< 
+< 						if showNavItem
+< 							if item.dropdown
+< 								li.dropdown(class=item.class, dropdown)
+< 									a.dropdown-toggle(href, dropdown-toggle)
+< 										| !{translate(item.text)}
+< 										b.caret
+< 									ul.dropdown-menu
+< 										each child in item.dropdown
+< 											if child.divider
+< 												li.divider
+< 											else if child.isContactUs
+< 												li
+< 													a(ng-controller="ContactModal" ng-click="contactUsModal()" href)
+< 														span(event-tracking="menu-clicked-contact" event-tracking-mb="true" event-tracking-trigger="click")
+< 															| #{translate("contact_us")}
+< 											else
+< 												li
+< 													if child.url
+< 														if !child.splitTest || child.splitTest && child.splitTest === 'features-page' && child.splitTestVariant === featuresPageVariant
+< 															a(
+< 																href=child.url,
+< 																class=child.class,
+< 																event-tracking=child.event
+< 																event-tracking-mb="true"
+< 																event-tracking-trigger="click"
+< 																event-segmentation=child.eventSegmentation
+< 															) !{translate(child.text)}
+< 													else
+< 														| !{translate(child.text)}
+< 							else
+< 								li(class=item.class)
+< 									if item.url
+< 										a(
+< 											href=item.url,
+< 											class=item.class,
+< 											event-tracking=item.event
+< 											event-tracking-mb="true"
+< 											event-tracking-trigger="click"
+< 										) !{translate(item.text)}
+< 									else
+< 										| !{translate(item.text)}
+< 
+< 					// logged out
+< 					if !getSessionUser()
+< 						// register link
+< 						if hasFeature('registration-page')
+---
+> 		.navbar-collapse.collapse(collapse="navCollapsed")
+> 
+> 			ul.nav.navbar-nav.navbar-right
+> 				if (getSessionUser() && getSessionUser().isAdmin)
+> 					li
+> 						a(href="/admin") Admin
+> 
+> 
+> 				// loop over header_extras
+> 				each item in nav.header_extras
+> 					-
+> 						if ((item.only_when_logged_in && getSessionUser())
+> 							|| (item.only_when_logged_out && (!getSessionUser()))
+> 							|| (!item.only_when_logged_out && !item.only_when_logged_in && !item.only_content_pages)
+> 							|| (item.only_content_pages && (typeof(suppressNavContentLinks) == "undefined" || !suppressNavContentLinks))
+> 						){ 
+> 							var showNavItem = true
+> 						} else {
+> 							var showNavItem = false
+> 						}
+> 
+> 					if showNavItem
+> 						if item.dropdown
+> 							li.dropdown(class=item.class, dropdown)
+> 								a.dropdown-toggle(href, dropdown-toggle)
+> 									| !{translate(item.text)}
+> 									b.caret
+> 								ul.dropdown-menu
+> 									each child in item.dropdown
+> 										if child.divider
+> 											li.divider
+> 										else
+> 											li
+> 												if child.url
+> 													a(href=child.url, class=child.class) !{translate(child.text)}
+> 												else
+> 													| !{translate(child.text)}
+> 						else
+> 							li(class=item.class)
+> 								if item.url
+> 									a(href=item.url, class=item.class) !{translate(item.text)}
+> 								else
+> 									| !{translate(item.text)}
+> 
+> 				// logged out
+> 				if !getSessionUser()
+> 					// login link
+> 					li
+> 						a(href="/login") #{translate('log_in')}
+> 
+> 				// projects link and account menu
+> 				if getSessionUser()
+> 					li
+> 						a(href="/project") #{translate('Projects')}
+> 					li.dropdown(dropdown)
+> 						a.dropdown-toggle(href, dropdown-toggle)
+> 							| #{translate('Account')}
+> 							b.caret
+> 						ul.dropdown-menu
+> 							//li
+> 							//	div.subdued(ng-non-bindable) #{getUserEmail()}
+> 							//li.divider.hidden-xs.hidden-sm
+108,139c76,77
+< 								a(
+< 									href="/register"
+< 									event-tracking="menu-clicked-register"
+< 									event-tracking-action="clicked"
+< 									event-tracking-trigger="click"
+< 									event-tracking-mb="true"
+< 									event-segmentation={ page: currentUrl }
+< 								) #{translate('register')}
+< 
+< 						// login link
+< 						li
+< 							a(
+< 								href="/login"
+< 								event-tracking="menu-clicked-login"
+< 								event-tracking-action="clicked"
+< 								event-tracking-trigger="click"
+< 								event-tracking-mb="true"
+< 								event-segmentation={ page: currentUrl }
+< 							) #{translate('log_in')}
+< 
+< 					// projects link and account menu
+< 					if getSessionUser()
+< 						li
+< 							a(href="/project") #{translate('Projects')}
+< 						li.dropdown(dropdown)
+< 							a.dropdown-toggle(href, dropdown-toggle)
+< 								| #{translate('Account')}
+< 								b.caret
+< 							ul.dropdown-menu
+< 								li
+< 									div.subdued {{ usersEmail }}
+< 								li.divider.hidden-xs.hidden-sm
+---
+> 								a(href="/user/settings") #{translate('Account Settings')}
+> 							if nav.showSubscriptionLink
+141,149c79,84
+< 									a(href="/user/settings") #{translate('Account Settings')}
+< 								if nav.showSubscriptionLink
+< 									li
+< 										a(href="/user/subscription") #{translate('subscription')}
+< 								li.divider.hidden-xs.hidden-sm
+< 								li
+< 									form(method="POST" action="/logout")
+< 										input(name='_csrf', type='hidden', value=csrfToken)
+< 										button.btn-link.text-left.dropdown-menu-button #{translate('log_out')}
+---
+> 									a(href="/user/subscription") #{translate('subscription')}
+> 							li.divider.hidden-xs.hidden-sm
+> 							li
+> 								form(method="POST" action="/logout")
+> 									input(name='_csrf', type='hidden', value=csrfToken)
+> 									button.btn-link.text-left.dropdown-menu-button #{translate('log_out')}
--- a/ldap-overleaf-sl/sharelatex_diff/router.js.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/router.js.diff
@@ -0,0 +1,10 @@
+259a260,268
+>   // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>   if (process.env.OAUTH2_ENABLED === 'true') {
+>     webRouter.get('/oauth/redirect', AuthenticationController.oauth2Redirect)
+>     webRouter.get('/oauth/callback', AuthenticationController.oauth2Callback)
+>     AuthenticationController.addEndpointToLoginWhitelist('/oauth/redirect')
+>     AuthenticationController.addEndpointToLoginWhitelist('/oauth/callback')
+>   }
+>   // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+> 
--- a/ldap-overleaf-sl/sharelatex_diff/settings.pug.diff
+++ b/ldap-overleaf-sl/sharelatex_diff/settings.pug.diff
@@ -0,0 +1,212 @@
+1c1
+< extends ../layout-marketing
+---
+> extends ../layout
+3,4c3,14
+< block entrypointVar
+< 	- entrypoint = 'pages/user/settings'
+---
+> block content
+> 	.content.content-alt
+> 		.container
+> 			.row
+> 				.col-md-12.col-lg-10.col-lg-offset-1
+> 					if ssoError
+> 						.alert.alert-danger
+> 							| #{translate('sso_link_error')}: #{translate(ssoError)}
+> 					.card
+> 						.page-header
+> 							h1  #{translate("account_settings")}
+> 						.account-settings(ng-controller="AccountSettingsController", ng-cloak)
+6,29c16,17
+< block append meta
+< 	meta(name="ol-hasPassword" data-type="boolean" content=hasPassword)
+< 	meta(name="ol-shouldAllowEditingDetails" data-type="boolean" content=shouldAllowEditingDetails)
+< 	meta(name="ol-oauthProviders", data-type="json", content=oauthProviders)
+< 	meta(name="ol-institutionLinked", data-type="json", content=institutionLinked)
+< 	meta(name="ol-samlError", data-type="json", content=samlError)
+< 	meta(name="ol-institutionEmailNonCanonical", content=institutionEmailNonCanonical)
+< 
+< 	meta(name="ol-reconfirmedViaSAML", content=reconfirmedViaSAML)
+< 	meta(name="ol-reconfirmationRemoveEmail", content=reconfirmationRemoveEmail)
+< 	meta(name="ol-samlBeta", content=samlBeta)
+< 	meta(name="ol-ssoErrorMessage", content=ssoErrorMessage)
+< 	meta(name="ol-thirdPartyIds", data-type="json", content=thirdPartyIds || {})
+< 	meta(name="ol-passwordStrengthOptions", data-type="json", content=settings.passwordStrengthOptions || {})
+< 	meta(name="ol-isExternalAuthenticationSystemUsed" data-type="boolean" content=externalAuthenticationSystemUsed())
+< 	meta(name="ol-user" data-type="json" content=user)
+< 	meta(name="ol-dropbox" data-type="json" content=dropbox)
+< 	meta(name="ol-github" data-type="json" content=github)
+< 	meta(name="ol-projectSyncSuccessMessage", content=projectSyncSuccessMessage)
+< 	meta(name="ol-showPersonalAccessToken", data-type="boolean" content=showPersonalAccessToken)
+< 	meta(name="ol-optionalPersonalAccessToken", data-type="boolean" content=optionalPersonalAccessToken)
+< 	meta(name="ol-personalAccessTokens", data-type="json" content=personalAccessTokens)
+< 	meta(name="ol-emailAddressLimit", data-type="json", content=emailAddressLimit)
+< 	meta(name="ol-currentManagedUserAdminEmail" data-type="string" content=currentManagedUserAdminEmail)
+---
+> 
+> 
+31,32c19,178
+< block content
+< 	main.content.content-alt#settings-page-root
+---
+> 							.row
+> 								.col-md-5
+> 									h3 #{translate("update_account_info")}
+> 									form(async-form="settings", name="settingsForm", method="POST", action="/user/settings", novalidate)
+> 										input(type="hidden", name="_csrf", value=csrfToken)
+> 										if !hasFeature('affiliations')
+> 											// show the email, non-editable
+> 											.form-group
+> 												label.control-label #{translate("email")}
+> 												div.form-control(
+> 													readonly="true",
+> 													ng-non-bindable
+> 												) #{user.email}
+> 
+> 										if shouldAllowEditingDetails
+> 											.form-group
+> 												label(for='firstName').control-label #{translate("first_name")}
+> 												input.form-control(
+> 													id="firstName"
+> 													type='text',
+> 													name='first_name',
+> 													value=user.first_name
+> 													ng-non-bindable
+> 												)
+> 											.form-group
+> 												label(for='lastName').control-label #{translate("last_name")}
+> 												input.form-control(
+> 													id="lastName"
+> 													type='text',
+> 													name='last_name',
+> 													value=user.last_name
+> 													ng-non-bindable
+> 												)
+> 											.form-group
+> 												form-messages(aria-live="polite" for="settingsForm")
+> 													.alert.alert-success(ng-show="settingsForm.response.success")
+> 														|  #{translate("thanks_settings_updated")}
+> 											.actions
+> 												button.btn.btn-primary(
+> 													type='submit',
+> 													ng-disabled="settingsForm.$invalid"
+> 												)  #{translate("update")}
+> 										else
+> 											.form-group
+> 												label.control-label #{translate("first_name")}
+> 												div.form-control(
+> 													readonly="true",
+> 													ng-non-bindable
+> 												) #{user.first_name}
+> 											.form-group
+> 												label.control-label #{translate("last_name")}
+> 												div.form-control(
+> 													readonly="true",
+> 													ng-non-bindable
+> 												) #{user.last_name}
+> 
+> 								.col-md-5.col-md-offset-1
+> 									h3 
+> 										| Set Password for Email login
+> 									p 
+> 										| Note: you can not change the LDAP password from here. You can set/reset a password for 
+> 										| your email login:
+> 										| #[a(href="/user/password/reset", target='_blank') Reset.]
+> 
+> 							| !{moduleIncludes("userSettings", locals)}
+> 							hr
+> 
+> 							h3
+> 								| Contact
+> 							div 
+> 								| If you need any help, please contact your sysadmins.
+> 							
+> 							p #{translate("need_to_leave")} 
+> 								a(href, ng-click="deleteAccount()")  #{translate("delete_your_account")}
+> 
+> 
+> 
+> 	script(type='text/ng-template', id='deleteAccountModalTemplate')
+> 		.modal-header
+> 			h3 #{translate("delete_account")}
+> 		div.modal-body#delete-account-modal
+> 			p !{translate("delete_account_warning_message_3")}
+> 			if settings.createV1AccountOnLogin && settings.overleaf
+> 				p
+> 					strong
+> 						| Your Overleaf v2 projects will be deleted if you delete your account.
+> 						| If you want to remove any remaining Overleaf v1 projects in your account,
+> 						| please first make sure they are imported to Overleaf v2.
+> 
+> 			if settings.overleaf && !hasPassword
+> 				p
+> 					b
+> 						| #[a(href="/user/password/reset", target='_blank') #{translate("delete_acct_no_existing_pw")}].
+> 			else
+> 				form(novalidate, name="deleteAccountForm")
+> 					label #{translate('email')}
+> 					input.form-control(
+> 						type="text",
+> 						autocomplete="off",
+> 						placeholder="",
+> 						ng-model="state.deleteText",
+> 						focus-on="open",
+> 						ng-keyup="checkValidation()"
+> 					)
+> 
+> 					label #{translate('password')}
+> 					input.form-control(
+> 						type="password",
+> 						autocomplete="off",
+> 						placeholder="",
+> 						ng-model="state.password",
+> 						ng-keyup="checkValidation()"
+> 					)
+> 
+> 					div.confirmation-checkbox-wrapper
+> 						input(
+> 							type="checkbox"
+> 							ng-model="state.confirmV1Purge"
+> 							ng-change="checkValidation()"
+> 						).pull-left
+> 						label(style="display: inline") &nbsp;I have left, purged or imported my projects on Overleaf v1 (if any) &nbsp;
+> 
+> 					div.confirmation-checkbox-wrapper
+> 						input(
+> 							type="checkbox"
+> 							ng-model="state.confirmSharelatexDelete"
+> 							ng-change="checkValidation()"
+> 						).pull-left
+> 						label(style="display: inline") &nbsp;I understand this will delete all projects in my Overleaf v2 account (and ShareLaTeX account, if any) with email address #[em {{ userDefaultEmail }}]
+> 
+> 			div(ng-if="state.error")
+> 				div.alert.alert-danger(ng-switch="state.error.code")
+> 					span(ng-switch-when="InvalidCredentialsError")
+> 						| #{translate('email_or_password_wrong_try_again')}
+> 					span(ng-switch-when="SubscriptionAdminDeletionError")
+> 						| #{translate('subscription_admins_cannot_be_deleted')}
+> 					span(ng-switch-when="UserDeletionError")
+> 						| #{translate('user_deletion_error')}
+> 					span(ng-switch-default)
+> 						| #{translate('generic_something_went_wrong')}
+> 			if settings.createV1AccountOnLogin && settings.overleaf
+> 				div(ng-if="state.error && state.error.code == 'InvalidCredentialsError'")
+> 					div.alert.alert-info
+> 						| If you can't remember your password, or if you are using Single-Sign-On with another provider
+> 						| to sign in (such as Twitter or Google), please
+> 						| #[a(href="/user/password/reset", target='_blank') reset your password],
+> 						| and try again.
+> 		.modal-footer
+> 			button.btn.btn-default(
+> 				ng-click="cancel()"
+> 			) #{translate("cancel")}
+> 			button.btn.btn-danger(
+> 				ng-disabled="!state.isValid || state.inflight"
+> 				ng-click="delete()"
+> 			)
+> 				span(ng-hide="state.inflight") #{translate("delete")}
+> 				span(ng-show="state.inflight") #{translate("deleting")}...
+> 	
+> 	script(type='text/javascript').
+> 		window.passwordStrengthOptions = !{StringHelper.stringifyJsonForScript(settings.passwordStrengthOptions || {})}
--- a/ldap-overleaf-sl/sharelatex_ori/.gitkeep
+++ b/ldap-overleaf-sl/sharelatex_ori/.gitkeep
--- a/ldap-overleaf-sl/update_texlive.sh
+++ b/ldap-overleaf-sl/update_texlive.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+cd /usr/local/texlive/
+if [ -d 2023 ] 
+then
+	cp -a 2023 2024
+	rm -f 2024/tlpkg/backups/*
+	cd 2024
+	wget  https://mirror.ctan.org/systems/texlive/tlnet/update-tlmgr-latest.sh
+	sh update-tlmgr-latest.sh --accept
+fi
+tlmgr update --self --all
+tlmgr install scheme-full
+luaotfload-tool -fu
+
--- a/scripts/apply_diffs.sh
+++ b/scripts/apply_diffs.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -e
+
+DIFFS_DIR="ldap-overleaf-sl/sharelatex_diff"
+ORI_DIR="ldap-overleaf-sl/sharelatex_ori"
+PATCHED_DIR="ldap-overleaf-sl/sharelatex"
+
+for diff_file in "$DIFFS_DIR"/*.diff; do
+    filename=$(basename "$diff_file" ".diff")
+    if [ "$filename" == ".gitkeep" ]; then
+        continue
+    fi
+
+    original_file="$ORI_DIR/$filename"
+    patched_file="$PATCHED_DIR/$filename"
+
+    if [ -f "$original_file" ]; then
+        cp "$original_file" "$patched_file"
+        patch "$patched_file" "$diff_file"
+    else
+        echo "No original file for $filename in $ORI_DIR."
+    fi
+done
--- a/scripts/copy.sh
+++ b/scripts/copy.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+set -e
+
+CONTAINER_FILE_PATHS=(
+    "/overleaf/services/web/app/src/Features/Authentication/AuthenticationManager.js"
+    "/overleaf/services/web/app/src/Features/Authentication/AuthenticationController.js"
+    "/overleaf/services/web/app/src/Features/Contacts/ContactController.js"
+    "/overleaf/services/web/app/src/router.js"
+    "/overleaf/services/web/app/views/user/settings.pug"
+    "/overleaf/services/web/app/views/user/login.pug"
+    "/overleaf/services/web/app/views/layout/navbar.pug"
+    "/overleaf/services/web/app/views/layout/navbar-marketing.pug"
+    "/overleaf/services/web/app/views/admin/index.pug"
+    "/overleaf/services/web/app/views/admin/index.pug"
+)
+
+FILENAMES=(
+    "AuthenticationManager.js"
+    "AuthenticationController.js"
+    "ContactController.js"
+    "router.js"
+    "settings.pug"
+    "login.pug"
+    "navbar.pug"
+    "navbar-marketing.pug"
+    "admin-index.pug"
+    "admin-sysadmin.pug"
+)
+
+if [ "${#CONTAINER_FILE_PATHS[@]}" -ne "${#FILENAMES[@]}" ]; then
+    echo "Error: The number of source files and target filenames does not match."
+    exit 1
+fi
+
+HOST_TARGET_PATH="ldap-overleaf-sl/sharelatex_ori"
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 [version]"
+    exit 1
+else
+    VERSION=$1
+fi
+
+CONTAINER_NAME="tmp_sharelatex_for_extract_files"
+IMAGE="sharelatex/sharelatex:$VERSION"
+
+for i in "${!CONTAINER_FILE_PATHS[@]}"; do
+    file_path="${CONTAINER_FILE_PATHS[i]}"
+    new_filename="${FILENAMES[i]}"
+    new_target_path="$HOST_TARGET_PATH/$new_filename"
+    echo " copy:  $new_target_path"
+    docker cp $CONTAINER_NAME:$file_path $new_target_path
+done
+#
+#echo "Stopping and removing container..."
+#docker stop $CONTAINER_NAME
+#docker rm $CONTAINER_NAME
--- a/scripts/extract_files.sh
+++ b/scripts/extract_files.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+set -e
+
+CONTAINER_FILE_PATHS=(
+    "/overleaf/services/web/app/src/Features/Authentication/AuthenticationManager.js"
+    "/overleaf/services/web/app/src/Features/Authentication/AuthenticationController.js"
+    "/overleaf/services/web/app/src/Features/Contacts/ContactController.js"
+    "/overleaf/services/web/app/src/router.js"
+    "/overleaf/services/web/app/views/user/settings.pug"
+    "/overleaf/services/web/app/views/user/login.pug"
+    "/overleaf/services/web/app/views/layout/navbar.pug"
+    "/overleaf/services/web/app/views/layout/navbar-marketing.pug"
+    "/overleaf/services/web/app/views/admin/index.pug"
+    "/overleaf/services/web/app/views/admin/index.pug"
+)
+
+FILENAMES=(
+    "AuthenticationManager.js"
+    "AuthenticationController.js"
+    "ContactController.js"
+    "router.js"
+    "settings.pug"
+    "login.pug"
+    "navbar.pug"
+    "navbar-marketing.pug"
+    "admin-index.pug"
+    "admin-sysadmin.pug"
+)
+
+if [ "${#CONTAINER_FILE_PATHS[@]}" -ne "${#FILENAMES[@]}" ]; then
+    echo "Error: The number of source files and target filenames does not match."
+    exit 1
+fi
+
+HOST_TARGET_PATH="ldap-overleaf-sl/sharelatex_ori"
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 [version]"
+    exit 1
+else
+    VERSION=$1
+fi
+
+CONTAINER_NAME="tmp_sharelatex_for_extract_files"
+IMAGE="sharelatex/sharelatex:$VERSION"
+
+echo "Starting Docker container \"$CONTAINER_NAME\" with image \"$IMAGE\"..."
+if [ ! "$(docker ps -q -f name=^/${CONTAINER_NAME}$)" ]; then
+    if [ "$(docker ps -aq -f status=exited -f name=^/${CONTAINER_NAME}$)" ]; then
+        echo "Removing stopped container with same name..."
+        docker rm $CONTAINER_NAME
+    fi
+else
+    echo "Error: A container with the name $CONTAINER_NAME already exists."
+    exit 1
+fi
+docker run -d --name $CONTAINER_NAME $IMAGE
+
+echo "Waiting for container to start up..."
+sleep 10
+
+#for i in "${!CONTAINER_FILE_PATHS[@]}"; do
+#    file_path="${CONTAINER_FILE_PATHS[i]}"
+#    new_filename="${FILENAMES[i]}"
+#    new_target_path="$HOST_TARGET_PATH/$new_filename"
+#    docker cp $CONTAINER_NAME:$file_path $new_target_path
+#done
+#
+#echo "Stopping and removing container..."
+#docker stop $CONTAINER_NAME
+#docker rm $CONTAINER_NAME
--- a/scripts/make_diffs.sh
+++ b/scripts/make_diffs.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+MODIFIED_DIR="ldap-overleaf-sl/sharelatex"
+DIFFS_DIR="ldap-overleaf-sl/sharelatex_diff"
+ORI_DIR="ldap-overleaf-sl/sharelatex_ori"
+
+for filename in $(ls $MODIFIED_DIR); do
+    raw_file="$ORI_DIR/$filename"
+
+    if [ -f "$raw_file" ]; then
+        echo "working on $raw_file" 
+        diff_output="$DIFFS_DIR/${filename}.diff"
+        diff "$raw_file" "$MODIFIED_DIR/$filename" > "$diff_output"
+    else
+        echo "No matching file for $filename in $ORI_DIR."
+    fi
+done
Author	SHA1	Message	Date
root	037bf36b3f	fix update_texlive	2024-09-23 19:45:57 +00:00
root	018b51176f	mildstone deploy	2024-07-28 09:36:18 +00:00
Zexin Yuan	38887b9a15	Update README.md (close #45 )	2024-01-15 08:15:17 +08:00
sym	75568ee70e	Merge pull request #44 from xathon/sharelatex-4.2.0 Update sharelatex to 4.2.0	2024-01-08 15:28:58 +01:00
Alex Fuchs	68e8a2e885	fixed missing version bump in Dockerfile	2024-01-08 14:50:27 +01:00
Alex Fuchs	6060a4cc9d	Fixed failing hunk due to added option	2024-01-05 15:14:43 +01:00
Alex Fuchs	86069cadca	Bump diffs to Sharelatex 4.2.0	2024-01-05 14:08:11 +01:00
sym	83e5158aba	Merge pull request #40 from tsukky67/master fix the simply mistakes	2023-12-11 13:21:47 +01:00
tsukky	d4c346c7f2	Fix file extension in navbar-marketing.pug	2023-12-09 17:33:37 +09:00
tsukky	2cf83a185c	Update apply_patches.sh to apply_diffs.sh	2023-12-09 17:33:20 +09:00
Simon M. Haller-Seeber	168bf05e69	Merge branch 'master' of github.com:smhaller/ldap-overleaf-sl	2023-12-06 14:27:02 +01:00
Simon M. Haller-Seeber	1a580d0558	<fix> extract navbar-marketing.pug (closes #38 )	2023-12-06 14:26:53 +01:00
sym	8dc8424edd	Update README.md	2023-12-05 14:17:35 +01:00
Simon M. Haller-Seeber	17cfa25caf	fixes #27	2023-12-05 14:10:59 +01:00
Simon M. Haller-Seeber	f4122f50e2	fixes #35	2023-12-05 13:20:36 +01:00
yzx9	53de1d0c86	Add ending newline	2023-12-04 21:41:55 +08:00
yzx9	ca692f1c36	Diff and patch modification (close #34 )	2023-12-04 21:36:15 +08:00
sym	53ab0553c6	Update README.md	2023-11-27 12:27:49 +01:00
sym	989a1bb236	Merge pull request #33 from yzx9/feature/oauth2 Add OAuth2 support	2023-11-27 11:50:30 +01:00
yzx9	0dafa57314	Update OAuth2 configuration example	2023-11-25 21:58:11 +08:00
yzx9	d5bf3e5d1c	Add OAuth2 docs	2023-11-25 12:41:01 +08:00
Zexin Yuan	f2f629e3ee	Merge branch 'master' into feature/oauth2	2023-11-25 01:54:29 +08:00
yzx9	94fa8fb192	Add OAuth2 authorization content type configuration	2023-11-25 01:41:55 +08:00
yzx9	40eb01cce4	Add OAuth2 state validation	2023-11-25 01:26:00 +08:00
yzx9	d94aa2fdf9	Custom provider name	2023-11-25 01:05:40 +08:00
yzx9	b1d9cedddb	Add oauth enable flag	2023-11-24 14:41:49 +08:00
yzx9	a30419ea5a	Disable secure cookie in no proxy settings	2023-11-24 13:58:33 +08:00
yzx9	78652946ee	Update README.md	2023-11-23 17:20:11 +08:00
yzx9	f53790c452	Fix bugs	2023-11-23 17:06:44 +08:00
yzx9	242183d601	Add docker-compose.yml	2023-11-23 12:27:53 +08:00
yzx9	1f7c65aa6d	Cache docker build	2023-11-23 12:18:25 +08:00
sym	15a3a609f4	Update README.md	2023-11-22 11:00:43 +01:00
yzx9	b225d6a8ce	Update OAuth2 Configuration	2023-11-22 15:32:01 +08:00
yzx9	a40aec7677	Add OAuth2 Support (WIP)	2023-11-22 11:45:15 +08:00
sym	c5e8e6f79a	Update README.md	2023-11-21 12:20:20 +01:00
sym	d049e4534a	Update README.md	2023-11-21 12:20:04 +01:00
sym	ed63dd0527	Merge pull request #31 from yzx9/feature/sharelatex411 Update sharelatex to v4.1.1: - v.4.1.1 works but i have still troubles migrating the projects from 3.3.2 (even after running the migrations scripts from 3.5.10)	2023-11-21 12:17:01 +01:00
Zexin Yuan	062f17e0f7	Fix wrong indentation	2023-11-08 10:18:32 +08:00
Zexin Yuan	48b1623c95	Merge branch 'master' into feature/sharelatex411	2023-09-18 23:21:06 +08:00
yzx9	7ac46ad430	Remove placeholder of share.pug	2023-09-18 23:05:36 +08:00
gizmo1-11	a382fbc194	changed variable "user1" to "user" I used "user1", because Im not sure about the scope inside the anonymous callback functions	2023-09-18 22:52:00 +08:00
yzx9	a107b6444c	Clean apt cache	2023-09-18 22:52:00 +08:00
yzx9	4bc203a757	Merge RUN command	2023-09-18 22:52:00 +08:00
yzx9	3a560801d9	Fix version of mongo and redis	2023-09-18 22:52:00 +08:00
yzx9	a99e70f3c4	Bump sharelatex to v4.1.1 - bump sharelatex - init mongodb replset - format docker-compose.yml	2023-09-18 22:52:00 +08:00
yzx9	c4775c7d7c	Bump sharelatex from 3.3.2 to 4.0.5 Co-authored-by: gizmo1-11 <thom_schu@gmx.de>	2023-09-18 22:51:49 +08:00
yzx9	f645454a74	Fix authentication api changes Co-authored-by: gizmo1-11 <thom_schu@gmx.de>	2023-09-18 22:48:37 +08:00
sym	ba1e78f2a8	Merge pull request #29 from yzx9/minimize-image-size Minimize image size	2023-07-24 13:37:40 +02:00
yzx9	ad051a0e18	Clean apt cache	2023-07-20 19:30:56 +08:00
yzx9	810aa1d0e9	Merge RUN command	2023-07-20 19:25:56 +08:00
yzx9	a6448a51e9	Sync changes from upstream	2023-07-20 18:46:13 +08:00
Simon M. Haller-Seeber	a0e70e4f1f	Adapted Contact Controller to work with Sharelatex 3.3.2	2022-12-21 11:07:59 +01:00
Simon M. Haller-Seeber	682d15d62e	Merge branch 'master' of github.com:smhaller/ldap-overleaf-sl	2022-07-18 16:15:12 +02:00
Simon M. Haller-Seeber	46cdf93fd5	added http to https traefik forward	2022-07-18 16:14:59 +02:00
Simon M. Haller-Seeber	b42604f22c	corrected sharelatex version to Dockerfile	2022-07-18 14:11:39 +02:00
sparkcyf	8995a35f70	Pin the ldapts package version, change the path of the fronted files in overleaf docker image. Pin the version of the ldapts package to 3.2.4 as ldapts 4.0.0 drops the nodejs 12 support. Change the path of the fronted files in overleaf docker image to follow the changes in overleaf 3.1	2022-06-09 12:47:20 +08:00
Simon M. Haller-Seeber	489b158b50	Merge branch 'master' of github.com:smhaller/ldap-overleaf-sl	2022-01-17 14:36:33 +01:00
Simon M. Haller-Seeber	da9a27b34d	adapted changes from PR #15 .	2022-01-17 14:36:17 +01:00
sym	c2c20cc861	Update README.md	2022-01-13 18:28:09 +01:00
Simon M. Haller-Seeber	41c172b587	Update to version sharelatex version 3.0.1. Tested changes with our small experimental environment: Seems to work with the applied small fixes.	2022-01-13 15:29:43 +01:00
sym	39ef130adc	Merge pull request #13 from davidmehren/fix_contacts_disable Fix parsing the LDAP_CONTACTS environment variable. Thank you for the contribution!	2021-06-16 10:32:17 +02:00
David Mehren	c40b47135c	Fix parsing the LDAP_CONTACTS environment variable The current code skips loading contact information from LDAP if `!process.env.LDAP_CONTACTS` evaluates to `true`. This is nearly never the case, as `process.env` contains strings and non-empty strings evaluate to `true`, making the negation falsy. Only an empty string in `LDAP_CONTACTS` (or not setting the environment variable at all) skips the contact loading. This commit changes the logic to only load contacts from LDAP if the `LDAP_CONTACTS` environment variable is explicitly set to `"true"` (case insensitive). This should bring the behaviour of the application more in line with the expectation and the docs.	2021-06-14 17:34:42 +02:00
Simon M. Haller-Seeber	ba73f282ec	small docker compose comments	2021-06-08 15:44:14 +02:00
sym	9cde93be05	Merge pull request #11 from SF2311/fix-contacts Agreed.	2021-05-26 22:45:44 +02:00
Sven Feyerabend	19d3b30c93	Fix import of contacts	2021-05-26 17:09:58 +02:00
sym	256c887d8f	Update README.md	2021-05-25 23:07:15 +02:00
Simon Markus Haller	ca0dc33cb7	Merged pull reqeust #9 . Added missing adaptions in ContactController. Generally moved GROUP_FILTER to USER_FILTER. Added some comments to the readme.	2021-05-25 15:35:13 +02:00
Simon Markus Haller	df51a6dbe0	Merge branch 'SF2311-fix-uid'	2021-05-25 13:58:19 +02:00
Simon Markus Haller	6263029df9	Merge branch 'fix-uid' of https://github.com/SF2311/ldap-overleaf-sl into SF2311-fix-uid	2021-05-25 13:56:55 +02:00
Sven Feyerabend	6992f2c8ed	Allow ldap bind with authenticating user	2021-05-25 11:27:42 +02:00
sym	5e62caedf6	Update Dockerfile Shell-Escape for newer Sharelatex versions	2021-05-25 10:32:06 +02:00
Sven Feyerabend	2688db1d0c	fix filter example in README	2021-05-21 23:12:49 +02:00
Sven Feyerabend	547ce9a744	Split User and Group filter	2021-05-18 23:26:33 +02:00
Sven Feyerabend	2b982babbb	Simplify uid replacement Regex declaration	2021-05-18 22:48:57 +02:00
Sven Feyerabend	025d5fba97	Remove mail constraint on admin group	2021-05-18 22:48:15 +02:00
Sven Feyerabend	4617bf690b	replace "replaceAll" function	2021-05-17 21:21:24 +02:00
Sven Feyerabend	f25cb05c8b	Merge remote-tracking branch 'shasler/ldap-replace-uid' into fix-uid	2021-05-14 23:49:09 +02:00
Sebastian Hasler	56be9a450c	Configurable usage of UID in LDAP filters Signed-off-by: Sebastian Hasler <sebastian.hasler@sec.uni-stuttgart.de>	2021-05-14 23:42:47 +02:00
Simon M. Haller-Seeber	a66affb1e1	Merge branch 'master' of https://github.com/smhaller/ldap-overleaf-sl	2021-05-10 23:41:38 +02:00
Simon M. Haller-Seeber	57da632558	Fixed Issue #7 . Other solution for pull request #8 - it is now selectable which admin interface is used (via .env file)	2021-05-10 23:40:49 +02:00
sym	d13e6a475d	Update README.md	2021-05-10 23:01:42 +02:00
Simon M. Haller-Seeber	90e7681c35	Short test with Sharelatex 2.6.1 - seems to work. Use LDAP escape - thx to @SF2311.	2021-05-10 21:28:02 +02:00
Simon M. Haller-Seeber	831b810e81	Update to Sharelatex to version 2.6.1	2021-05-10 19:26:15 +02:00
Sven Feyerabend	34614356c9	Escape user input in ladp filters	2021-05-08 02:08:03 +02:00
Sven Feyerabend	fcebf5f33d	Change uid from const to var	2021-05-08 01:42:27 +02:00
Sven Feyerabend	eca1d9881e	Use uid instead of email for user search	2021-05-08 01:32:58 +02:00
Christian Huettig	53a4ba6b4f	Update README.md	2021-04-28 22:19:57 +02:00
Christian Huettig	fd4f45354b	Works.	2021-04-28 22:02:03 +02:00
Christian Huettig	a8d72465d9	Next phase	2021-04-28 21:33:10 +02:00
Christian Huettig	2b58ad96e3	initial changes for testing	2021-04-28 21:16:36 +02:00
Christian Huettig	c427f472db	Update README.md	2021-04-28 20:58:59 +02:00
Simon M. Haller-Seeber	0677da6a81	Merge branch 'master' of https://github.com/smhaller/ldap-overleaf-sl	2021-03-11 16:38:55 +01:00
Simon M. Haller-Seeber	204b064bb7	Actually load the ssl configuration (https://github.com/overleaf/overleaf/issues/809 )	2021-03-11 16:38:35 +01:00
sym	f97d76cca6	Update Dockerfile	2021-03-11 16:21:43 +01:00
sym	a67931a241	Update README.md fix typos; add docker create web.	2021-03-11 14:31:07 +01:00
Simon M. Haller-Seeber	8845734b91	Switch from certbot to traefik: including loadbalancing for multiple sharelatex docker instances; Fix AuthenticationManger.js for sharelatex > 2.3.1; Todo: enhancement - also use https for loadbalancing in the docker backend.	2021-03-11 09:06:23 +01:00
Simon M. Haller-Seeber	fb6f654738	Switch from certbot to traefik: including loadbalancing for multiple sharelatex docker instances; Fix AuthenticationManger.js for sharelatex > 2.3.1; Todo: enhancement - also use https for loadbalancing in the docker backend.	2021-03-11 08:58:40 +01:00
sym	4da7bac9f9	Update Dockerfile revert back to sharelatex 2.3.1. Versions greater introduce issue #5	2021-03-10 21:10:53 +01:00
sym	74426fe812	Update docker-compose.yml Add default values for access public links w/o login. (Line:46-52)	2021-03-08 13:35:14 +01:00
sym	1e60e141f3	Update AuthenticationManager.js revert Changes - the pull request was faulty. This was already the id...	2021-03-05 10:12:26 +01:00