For security and privacy reasons, I want to setup my own server for syncing bookmarks and history in Firefox browser. We have Sync 1.1 which supports MySQL or LDAP backend for user authentication - at least according to the Mozilla docs. Altough the linked engine doc from SQLAlchemy doesn't contain any information how to use LDAP. Only relational databases like MySQL or Postgres are listed, also on other dialects. The entire docs doesn't even contain the term LDAP.

In Sync 1.5 which is the current supported release (1.1 is deprecated since Firefox 29), I couldn't find any information about LDAP. Also not on the related account-server for Firefox. Using LDAP as account-backend would be very handy, since all my self hosted applications like Nextcloud for example are compatible. This avoids messing up with many accounts on e.g. password-changes.

How can I use LDAP as user-store for Firefox sync?

  • It seems Mozilla doesn't offer a LDAP backend for FXA. However, there is documented API which allows to write own backend. – Michał F Apr 6 '18 at 20:00

The user-store for FireFox sync is a proprietary, certificate-based, system that requires the "Firefox Accounts Server".

See here: https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html#howto-run-fxa

The protocol is incompatible with LDAP. The only way to use LDAP authentication would be to significantly change the code for the Firefox Account Server to have an option to pass the user\pass combo to the LDAP server in some secure fashion and use the result to issue the token, instead of checking against it's own internal database.

Another option would be to populate the Firefox Account Server with entries from LDAP but then the passwords would not be in sync.


Things that still need to be Documented

how to interoperate with a self-hosted accounts server

| improve this answer | |

Actually there seems to be a way to do this and it is documented: http://moz-services-docs.readthedocs.io/en/latest/server-devguide/configuration.html#authentication

I didn't try it for myself, but as far as I understand you have to use the LDAP authentication backend like this:

backend = ldap
ldapuri = ldap://localhost:390

ldap_timeout =  -1
ldap_use_pool = true
ldap_pool_size = 100

use_tls = false

bind_user = "cn=admin,dc=mozilla"
bind_password = admin

admin_user = "cn=admin,dc=mozilla"
admin_password = admin

users_root = "ou=users,dc=mozilla"

sqluri = mysql://sync:sync@localhost/sync
pool_size = 100
pool_recycle = 3600

cache_servers =

You will need to run a mysql server in parallel though

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.