login & rights > Idea

Login with LDAP / #4967

MoveBookmark

Summary

open
May 3, 2007
May 3, 2007 / burger
Jun 18, 2008 / guest
View previous 2 versions
burger
 

Attached files

No files uploaded
It would be much more comfortable if the user can login with his/her present Microsoft Windows account because in this case he/she hasn't to remember more than one username/password combination.

To realise this it has to be possible to connect to a ldap server and check if the user exists.

To make this feature flexible there also has to be:
  • a boolean db field named ldap at the streb_person table
  • configuration settings at conf.inc.php (=> customize.inc.php)
  • a drop down field at the personEdit page to select the authentication for each person (choice between streber or ldap)

7 Comments

pixtur

May 4, 2007
I am not really sure how to do this...
but since this feature was requested quiet often, I thought you could implement it. But please do not do any commits until next week, because I want to release the v0.08 without any more changes.

burger

May 4, 2007
Okay ....
I already implemented it but I will wait to commit the changes till next week. Please let me know when committing is okay again.

burger

May 4, 2007
version 2
Information
Hi Tom,

I have to tell you that next Wednesday (09.05.) is my last working day at my current company (freshframes).
That means that Wednesday is the last day I will join your streber project.
I really enjoyed working with you and to be a part of the streber project team.

Thomas (binder) will still be a member of your team and maybe there will be soon a follower on my position who will take care about the streber project.

If it's okay I will commit my last changes (ldap, time filter for efforts, extra page for effort calculation) next wednesday?!

pixtur

May 7, 2007
Antwort auf Information
Oh...

That are really sad news! I really enjoyed working with you and have to thank you very much for all the things you contributed here. Losing a good developer really hurts, but maybe changing is a part of live.

I wish you only the best for the future and much luck with your next job!

cu.
pixtur



guest

Jan 8, 2008
version 3
LDAP_USERNAME_POSTFIX necessary
ldap_bind does not work with only a username given, a complete LDAP DN is necessary. We have LDAP "usernames" in the form uid=username,ou=acounts,o=organization.

LDAP auth works with the following patches:

from conf.inc.php

diff -ru streber.orig/conf/conf.inc.php streber/conf/conf.inc.php
--- streber.orig/conf/conf.inc.php      2007-07-30 02:32:06.000000000 +0200
+++ streber/conf/conf.inc.php   2008-01-08 18:00:29.403750199 +0100
@@ -364,9 +364,10 @@
        /**
        * LDAP Settings
        */
-       'LDAP' => false,
-       'LDAP_USERNAME_PREFIX' =>'',
-       'LDAP_SERVER' => '',
+       'LDAP' => true,
+       'LDAP_USERNAME_PREFIX' => 'uid=',
+       'LDAP_USERNAME_POSTFIX' => ',ou=accounts,o=organization',
+       'LDAP_SERVER' => 'ldap-hm',

        /**
        * Reply on comment prefix

from class_auth.inc.php

diff -ru streber.orig/std/class_auth.inc.php streber/std/class_auth.inc.php
--- streber.orig/std/class_auth.inc.php 2007-07-30 00:27:16.000000000 +0200
+++ streber/std/class_auth.inc.php      2008-01-08 18:00:55.359982446 +0100
@@ -194,7 +194,7 @@
                        return false;
                }

-               if(!$ldapbind = ldap_bind($ldapconn, confGet('LDAP_USERNAME_PREFIX').$name, $password)){
+               if(!$ldapbind = ldap_bind($ldapconn, confGet('LDAP_USERNAME_PREFIX').$name.confGet('LDAP_USERNAME_POSTFIX'), $password)){
                        log_message("login failed, bind to ldap server failed.", LOG_MESSAGE_LOGIN_FAILURE);
                        return false;
                }

guest

Jan 17, 2008
LDAP instructions
Hi all,

I'd like to use the LDAP authentication too.
At the moment I am using version 0.0801.
Where can I find simple instructions to make it working?
Which files do I have to change? And so on ...
Thanks for your help.


guest

Jun 18, 2008
View comment
This wont work if the user accounts are in several different OU's though right?
 
 

Comment / Update