LDAP with MS Entra (formely Azure) AD DS as auth backend + docker

[var-log-skynet]

We've been looking for a pw management software for weeks and ended up using sysPass, as it is the most mature/documented we've found. I would like to share my install experience according to the title:

• if you plan to use sysPass behind a reverse proxy, first complete the installataion steps (admin- and master, db connection etc) accessing the service directly on the host, as at this point the base url is not set to use https:// and due to mixed content error in the browser the installation would not complete. The base url can be set after sucessfull installation in the General settings. After that sysPass works behind an SSL terminating proxy.
• we use LDAPs, with a self signed certificate, so the first step was to add the CA certificate (that issued the cert) to the image (avoiding the use of a mount for just a single file).

#Dockerfile:
FROM syspass/syspass
ADD ./certs/myCAcert.crt /usr/local/share/ca-certificates/myCAcert.crt
RUN update-ca-certificates

Then in the compose.yml just use the line build: . instead of the image: syspass/syspass

• configuring LDAP was a bit tricky as one would guess that adding ldaps:// automatically sets the port to the standard 636, but that's not the case; the correct form in our case was: ldaps://our.ldaps_server.tld:636 (no TLS!)
• first we did import groups from AD, but it turns out, that membership is not being imported alongside the groups