Kantree Help center
Try for free

Kantree extensions reference

In this article

This page lists the optional extensions and integrations of Kantree, with their options. The built-in options are in config.md.

Load an extension

Load an extension with the EXTENSIONS option, in config.yml:

extensions:
  - kantree.integrations.github
  - kantree.extensions.auth.oidc:
      only: true
      identity_providers:
        default: {...}

An extension reads its options from the configuration, with a prefix: the server option of the LDAP extension is LDAP_SERVER. Set an option at the top level of config.yml (LDAP_SERVER: ...) or inline, in the dict of the extension (server: ...). The inline options do not replace the options set at the top level.

Read the extensions

  • Module: the path to put in EXTENSIONS.
  • Former paths: aliases of the module, still accepted.
  • Prefix: the prefix of its options in the configuration.
  • Requires: other conditions (Python packages, feature flags, external setup).
  • Routes: the URLs to configure in the external service.
  • Options: its options, with the same columns as in config.md.

Extensions

Authentication

LDAP authentication

Users log in with their LDAP account. Kantree creates the account at the first login, and synchronizes the name, the avatar, the admin, observer and disabled status, and the organizations from LDAP groups.

  • Module: kantree.extensions.auth.ldap
  • Former paths: kantree.extensions.ldap
  • Prefix: LDAP_
  • Requires: The python-ldap package.

Options

Option Type Default Description
server string   Required. LDAP server URI, for example ldap://ldap.example.com.
bind_dn string null DN of the account that searches the directory. Null for an anonymous bind.
bind_password string null Password of bind_dn.
user_dn string "" Required. Base DN of the users.
user_filter string (&(objectClass=inetOrgPerson)(uid=%(user)s)) Filter that finds a user. %(user)s is the identifier typed in the login form.
username_attr string uid Attribute of the user name.
append_username_domain string null Domain added to the identifier typed in the login form when it has no “@”.
strip_username_domain boolean true Remove the “@domain” part of the user name.
email_attr string mail Attribute of the email address.
display_name_attr string displayName Attribute of the display name.
avatar_attr string jpegPhoto Attribute of the avatar image. Null to ignore avatars.
avatar_image_ext string jpg File extension of the avatar images.
avatar_image_mimetype string image/jpeg MIME type of the avatar images.
additional_attrs dict {} Other user properties to fill at account creation: {user property: LDAP attribute}.
group_dn string "" Base DN of the groups.
group_filter string (&(objectclass=groupOfNames)(cn=%(group)s)) Filter that finds a group. %(group)s is the name of the group.
group_member_attr string member Attribute of the group members.
group_member_uid_user_attr string null User property compared to the group members (for groups that list user names). Null compares the user DN.
group_flags dict {} User flags set at account creation from group membership: {flag: group DN}.
admin_group string null DN of the group of the Kantree admins. Synchronized at each login.
observer_group string null DN of the group of the observers. Synchronized at each login.
disabled_group string null DN of the group of the disabled users. Synchronized at each login.
orgs_groups_base_dn string null Base DN of the groups that are organizations. Users join the organizations of their groups; missing organizations are created.
orgs_groups_filter string (objectclass=groupOfNames) Filter of the organization groups.
orgs_groups_name_attr string cn Attribute of the organization name.
opts dict {} python-ldap options: {option name without OPT_: value}.
use_tls boolean false Use STARTTLS.
tls_demand boolean false Require TLS on the connection.
tls_require_cert boolean null True requires a valid server certificate, false never checks it. Null keeps the default of the library.
tls_cacert_dir string null Folder of the CA certificates.
tls_cacert_file string null File of the CA certificates.
tls_cert_file string null Client certificate.
tls_key_file string null Key of the client certificate.

SAML authentication

Users log in with a SAML 2.0 identity provider. Several identity providers can be configured.

  • Module: kantree.extensions.auth.saml
  • Former paths: kantree.extensions.saml
  • Prefix: SAML_
  • Requires: The python3-saml package. SERVER_SECURED must be true: SAML needs the SameSite=None session cookie. Run kantree saml-settings --idp <name> to see the generated settings.
  • Routes:
    • metadata: /saml/<idp_name>/metadata
    • assertion_consumer_service: /saml/<idp_name>/acs
    • single_logout_service: /saml/<idp_name>/slo
    • login: /saml/<idp_name>/login

Options

Option Type Default Description
identity_providers dict {default: {}} Required. Identity providers, by name. See the identity provider options below.
default_idp_name string default Identity provider of /saml/login.
common_settings dict {} Identity provider options shared by all identity providers.
only boolean true SAML is the only login. Turns off the signup form and the password login page. The former name saml_only is accepted.
show_sso_login boolean true Show a “Login with SSO” link to /saml/login.
sp_initiated_logout boolean true A logout from Kantree also logs out from the identity provider.
sync_role boolean true Synchronize the admin, observer and disabled status at each login.
sync_identifiers boolean false Update the email address and the user name of existing users at each login.
auto_join_orgs boolean true Users join the organizations listed in the orgs_attr attribute. Missing organizations are created.
saml_settings_path string saml Folder of advanced python3-saml settings files, by identity provider.

Identity provider options

Option Type Default Description
idp_metadata_url string   URL or file path of the metadata of the identity provider. Replaces the idp_* options below.
idp_metadata_url_verify_cert boolean true Check the TLS certificate of idp_metadata_url.
idp_entity_id string   Entity ID of the identity provider. Required without idp_metadata_url.
idp_sso_url string   Single sign-on URL. Required without idp_metadata_url.
idp_sso_binding string urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect  
idp_slo_url string   Single logout URL.
idp_slo_binding string urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect  
idp_cert string   Certificate of the identity provider. Required without idp_metadata_url and idp_cert_file.
idp_cert_file string   File of the certificate of the identity provider.
sp_cert string   Certificate of Kantree (service provider). Needs sp_private_key.
sp_private_key string   Private key of sp_cert.
sp_cert_file string   File of sp_cert. Needs sp_private_key_file.
sp_private_key_file string   File of sp_private_key.
name_id_format string emailAddress NameID format, short (emailAddress) or full URN.
security dict {} python3-saml security settings, for example {wantAttributeStatement: false}.
contact_person dict {} Contact persons of the service provider metadata.
preferred_url_scheme string null Scheme of the service provider URLs. Defaults to the scheme of Kantree.
request_lowercase_urlencoding boolean false Set to true with ADFS.
login_only boolean false Only existing users can log in. No account is created.
use_name_id_as_identifier boolean true Identify users by the NameID. If false, by email_attr or username_attr.
email_as_identifier boolean true The identifier is an email address. If false, it is a user name.
email_attr string email Attribute of the email address.
username_attr string null Attribute of the user name.
strip_username_domain boolean true Remove the “@domain” part of the user name.
display_name_attr string null Attribute of the display name. {Attr1} {Attr2} combines several attributes.
avatar_attr string null Attribute of the avatar.
avatar_format string url Format of avatar_attr. Values: url, binary, base64.
avatar_image_ext string jpg  
avatar_image_mimetype string image/jpeg  
orgs_attr string null Attribute with the names of the organizations of the user (see auto_join_orgs).
roles_attr string null Attribute with the roles of the user.
admin_role string null Role of roles_attr that makes a Kantree admin.
is_admin_attr string null Boolean attribute that makes a Kantree admin.
observer_role string null Role of roles_attr that makes an observer.
is_observer_attr string null Boolean attribute that makes an observer.
disabled_role string null Role of roles_attr that disables the user.
is_disabled_attr string null Boolean attribute that disables the user.

OpenID Connect authentication

Users log in with an OpenID Connect identity provider. Several identity providers can be configured.

  • Module: kantree.extensions.auth.oidc
  • Prefix: OIDC_
  • Routes:
    • redirect_uri: /oidc/<provider_name>/callback
    • login: /oidc/<provider_name>/login

Options

Option Type Default Description
identity_providers dict {default: {}} Required. Identity providers, by name. See the identity provider options below.
default_provider_name string default Identity provider of /oidc/login. Must be a key of identity_providers.
only boolean true OIDC is the only login. Turns off the password login and the signup without OIDC. The former name oidc_only is accepted.
show_sso_login boolean true Show a “Login with SSO” link to /oidc/login.

Identity provider options

Option Type Default Description
discovery_url string   Required. URL of the discovery document, for example https://idp.example.com/.well-known/openid-configuration.
client_id string   Required.
client_secret string   Required.
title string <name of the provider> Name shown to users.
scopes list [openid, email, profile]  
use_pkce boolean true  
require_email_verified boolean true Refuse the users whose email address is not verified by the identity provider.
login_only boolean false Only existing users can log in. No account is created.
claim_mapping dict {} Claim names, if they differ from the standard: keys among email, email_verified, username, display_name. iss and sub cannot be remapped.

Email

Email templates

Users write email templates in workspaces, and automations send them. Always loaded: list it in EXTENSIONS only to give options inline.

  • Module: kantree.extensions.emailing
  • Former paths: kantree.extensions.features.emailing
  • Prefix: EMAILING_
  • Requires: The emailing feature flag (in DEFAULT_FEATURE_FLAGS by default).

Options

Option Type Default Description
default_sender string null Sender of the emails. Defaults to MAIL_DEFAULT_SENDER.
mail_connection dict null Mail connection of these emails (a provider and its options, see MAIL_CONNECTIONS in config.md). Defaults to the default connection.
extend_project_roles boolean true Give the permission to manage email templates to the Admin role.
allow_localhost boolean true Allow the SMTP servers on localhost in the templates that use their own SMTP server.
show_user_generated_banner boolean false Add a banner to the emails that says a user wrote them.
user_generated_banner_message string This email was generated by a Kantree user. It is not an official Kantree email. Text of the banner.

Inbound emails (raw MIME)

Creates cards and comments from emails. Your mail server posts the raw MIME message to Kantree.

  • Module: kantree.extensions.email_inbound.mime
  • Former paths: kantree.extensions.email_inbound
  • Requires: EMAIL_INBOUND_DOMAIN.
  • Routes:
    • inbound: POST /integrations/email/inbound

No options.

Inbound emails (Mailgun)

Creates cards and comments from emails received by a Mailgun route.

  • Module: kantree.extensions.email_inbound.mailgun
  • Former paths: kantree.extensions.mailgun_inbound
  • Requires: EMAIL_INBOUND_DOMAIN.
  • Routes:
    • inbound: POST /integrations/mailgun/inbound

No options.

Inbound emails (Brevo)

Creates cards and comments from emails received by Brevo inbound parsing.

  • Module: kantree.extensions.email_inbound.brevo
  • Prefix: BREVO_INBOUND_
  • Requires: EMAIL_INBOUND_DOMAIN.
  • Routes:
    • inbound: POST /integrations/brevo/inbound

Options

Option Type Default Description
api_key string   Required. Brevo API key, to download the attachments.
webhook_token string   Required. Token that the Brevo webhook sends. Kantree refuses the requests without it.
api_url string https://api.brevo.com  

Inbound emails (Sweego)

Creates cards and comments from emails received by Sweego inbound.

  • Module: kantree.extensions.email_inbound.sweego
  • Prefix: SWEEGO_INBOUND_
  • Requires: EMAIL_INBOUND_DOMAIN.
  • Routes:
    • inbound: POST /integrations/sweego/inbound

Options

Option Type Default Description
api_key string   Required. Sweego API key, to download the attachments.
client_uuid string   Required. UUID of the Sweego client.
webhook_secret string   Required. Secret that signs the Sweego webhooks. Kantree refuses the requests with an invalid signature.
api_url string https://api.sweego.io  

Webhooks

Global webhooks

Sends the events of all the workspaces of the instance to webhook URLs.

  • Module: kantree.extensions.global_webhooks
  • Former paths: kantree.extensions.enterprise.global_webhooks
  • Prefix: GLOBAL_WEBHOOKS_

Options

Option Type Default Description
<event> list   URLs that receive an event, for example GLOBAL_WEBHOOKS_CARD_CREATED: [https://example.com/hook]. One option for each event.

Integrations

GitHub

Login with GitHub, import of the issues of a repository as a workspace, and two-way synchronization of cards with issues.

  • Module: kantree.integrations.github
  • Former paths: kantree.extensions.github_integration
  • Prefix: GITHUB_
  • Requires: A GitHub OAuth app.
  • Routes:
    • oauth_callback: /login/github/callback
    • webhook: POST /integrations/github/webhook/<token>

Options

Option Type Default Description
client_id string   Required. Client ID of the GitHub OAuth app.
client_secret string   Required. Client secret of the GitHub OAuth app.
api_base_url string https://api.github.com/ GitHub API URL. Change it for GitHub Enterprise Server.
access_token_url string https://github.com/login/oauth/access_token  
authorize_url string https://github.com/login/oauth/authorize  

GitLab

Shows the GitLab commits that mention a card (#ref) in its activity, with a GitLab webhook for each workspace.

  • Module: kantree.integrations.gitlab
  • Routes:
    • webhook: POST /integrations/gitlab/webhook/<project_id>

No options.

Google Workspace

Login with Google, and files from Google Drive in cards.

  • Module: kantree.integrations.google
  • Former paths: kantree.extensions.google_integration
  • Prefix: GOOGLE_
  • Requires: A Google Cloud OAuth client and an API key with the Google Picker API.
  • Routes:
    • oauth_callback: /login/google/callback

Options

Option Type Default Description
client_id string   Required. Client ID of the Google OAuth client.
client_secret string   Required. Client secret of the Google OAuth client.
api_key string   Required. Google API key of the file picker.
scopes list ['https://www.googleapis.com/auth/userinfo.email', 'https://www.googleapis.com/auth/userinfo.profile', 'https://www.googleapis.com/auth/drive.file'] OAuth scopes requested from Google.

Microsoft 365

Login with Microsoft, files from OneDrive in cards, and Kantree as a Microsoft Teams tab.

  • Module: kantree.integrations.microsoft365
  • Former paths: kantree.integrations.office365, kantree.extensions.office365_integration
  • Requires: A Microsoft Entra app registration. Create the Teams app package with kantree msteams (see kantree msteams --help).
  • Routes:
    • oauth_callback: /login/ms365/callback
    • teams_tab: /integrations/msteams/tab/auth

Options

Option Type Default Description
MS365_CLIENT_ID string   Required. Application (client) ID, for the login with Microsoft. Set it at the top level of the configuration.
MS365_CLIENT_SECRET string   Required. Client secret, for the login with Microsoft. Set it at the top level of the configuration.
MICROSOFT365_CLIENT_ID string   Required. Application (client) ID, for the OneDrive file picker. Set it at the top level of the configuration.

Slack

Sends the activity of a workspace to a Slack channel, and adds a /kantree command to Slack.

  • Module: kantree.integrations.slack
  • Former paths: kantree.extensions.slack_integration
  • Prefix: SLACK_
  • Requires: A Slack app.
  • Routes:
    • command: POST /slack/command

Options

Option Type Default Description
client_id string   Required. Client ID of the Slack app.
client_secret string   Required. Client secret of the Slack app.
scope string incoming-webhook,commands OAuth scopes requested from Slack.

Dropbox

Files from Dropbox in cards, with the Dropbox file chooser.

  • Module: kantree.integrations.dropbox
  • Former paths: kantree.extensions.dropbox_integration
  • Prefix: DROPBOX_
  • Requires: A Dropbox app with the Chooser.

Options

Option Type Default Description
app_key string   Required. App key of the Dropbox app.

Zapier

Shows the Zapier integration in the list of integrations.

  • Module: kantree.integrations.zapier

No options.

Trello importer

Imports Trello boards as workspaces.

  • Module: kantree.integrations.trello
  • Former paths: kantree.extensions.trello_importer
  • Prefix: TRELLO_
  • Requires: A Trello Power-Up API key and secret (OAuth 1).
  • Routes:
    • oauth_callback: /login/trello/callback

Options

Option Type Default Description
client_id string   Required. Trello API key.
client_secret string   Required. Trello API secret.

Asana importer

Imports Asana projects as workspaces.

  • Module: kantree.integrations.asana
  • Former paths: kantree.extensions.asana_importer
  • Prefix: ASANA_
  • Requires: An Asana OAuth app.
  • Routes:
    • oauth_callback: /login/asana/callback

Options

Option Type Default Description
client_id string   Required.
client_secret string   Required.

Jira importer

Imports Jira Cloud projects as workspaces.

  • Module: kantree.integrations.jira
  • Former paths: kantree.extensions.jira_importer
  • Prefix: JIRA_
  • Requires: An Atlassian OAuth 2.0 (3LO) app with the read:jira-work and read:jira-user scopes.
  • Routes:
    • oauth_callback: /login/jira/callback

Options

Option Type Default Description
client_id string   Required.
client_secret string   Required.

Hosted service (kantree.io)

These extensions are made for the kantree.io service. They work on other instances.

SSO by organization

Organization owners configure their own SAML or OIDC identity provider in the organization settings. Users whose email domain matches are sent to it. Loads the SAML extension with settings for this use.

  • Module: kantree.extensions.saas.sso
  • Requires: The python3-saml package, and the sso feature flag for the organization.
  • Routes:
    • login: /sso

No options.

Spam protection

Locks the new organizations without an active subscription that send too many invitations.

  • Module: kantree.extensions.saas.spam_protection
  • Prefix: SPAM_PROTECTION_

Options

Option Type Default Description
auto_lock_org boolean true Lock the organizations detected as spam.
detection_period_days integer 4 Only organizations and workspaces created in the last days are checked.
max_invites integer 100 Number of invitations of an organization or a workspace above which it is spam.

PostHog analytics

Sends the product analytics events to PostHog.

  • Module: kantree.extensions.saas.posthog
  • Prefix: POSTHOG_
  • Requires: The posthog package.

Options

Option Type Default Description
api_key string   Required. Project API key.
personal_api_key string null Personal API key.
host string   Required. PostHog URL, for example https://eu.posthog.com.

OpenPanel analytics

Sends the product analytics events to OpenPanel.

  • Module: kantree.extensions.saas.openpanel
  • Prefix: OPENPANEL_

Options

Option Type Default Description
client_id string   Required.
client_secret string   Required.
api_url string https://api.openpanel.dev  
timeout integer 5 Timeout of the requests, in seconds.

Brevo (Sendinblue) contacts sync

Synchronizes the users with Brevo contact lists, for the newsletter and the onboarding emails.

  • Module: kantree.extensions.saas.sendinblue_sync
  • Prefix: SENDINBLUE_
  • Requires: The sib-api-v3-sdk package.

Options

Option Type Default Description
api_key string   Required. Brevo API key.
default_list_id integer   Required. List of all the users.
onboarding_list_id integer   Required. List of the new users.
newsletter_list_id integer   Required. List of the users who subscribed to the newsletter.
debug_prevent_call boolean true Only log the calls to Brevo. Set it to false to synchronize the contacts.