LDAP - Revision history

Drn@ecs.soton.ac.uk at 17:59, 22 January 2022

2022-01-22T17:59:38Z

← Older revision		Revision as of 17:59, 22 January 2022
Line 1:		Line 1:
	[[Category:Authentication~~]] [[Category:Howto~~]]		[[Category:Authentication]]

	==LDAP Authentication==		==LDAP Authentication==

Drn@ecs.soton.ac.uk: Added to Howto category

2022-01-21T12:25:17Z

Added to Howto category

← Older revision		Revision as of 12:25, 21 January 2022
Line 1:		Line 1:
	[[Category:Authentication]]		[[Category:Authentication]] [[Category:Howto]]

	==LDAP Authentication==		==LDAP Authentication==

Drn@ecs.soton.ac.uk: /* LDAP Import */

2017-06-12T13:05:01Z

LDAP Import

← Older revision		Revision as of 13:05, 12 June 2017
Line 391:		Line 391:
	return unless defined $entr and $entr->can("get_value");		return unless defined $entr and $entr->can("get_value");

	my $username = $entr->get_value( "sAMAccountName" );		my $username = $entr->get_value( "sAMAccountName" ); # This may need to be changed to uid or cn rather than sAMAccountName
	my $given = $entr->get_value( "givenName" );		my $given = $entr->get_value( "givenName" );
	my $family = $entr->get_value( "sn" );		my $family = $entr->get_value( "sn" );
Line 430:		Line 430:
	$user->commit();		$user->commit();
	}		}


	====Things to note====		====Things to note====

Drn@ecs.soton.ac.uk at 12:56, 12 June 2017

2017-06-12T12:56:03Z

← Older revision		Revision as of 12:56, 12 June 2017
Line 341:		Line 341:
	my $updated_counter = 0;		my $updated_counter = 0;
	my $created_counter = 0;		my $created_counter = 0;

	# Create paging control		# Create paging control
	my $page = Net::LDAP::Control::Paged->new( size => 100 );		my $page = Net::LDAP::Control::Paged->new( size => 100 );

Drn@ecs.soton.ac.uk at 16:00, 7 June 2017

2017-06-07T16:00:27Z

← Older revision		Revision as of 16:00, 7 June 2017
Line 430:		Line 430:
	$user->commit();		$user->commit();
	}		}

	~~====LDAP Authentication with On-Demand Creation of Users====~~

	~~This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."~~

Drn@ecs.soton.ac.uk at 15:59, 7 June 2017

2017-06-07T15:59:44Z

@@ Line 128: / Line 128: @@
 ====LDAP Configuration====
 All changes for LDAP authentication can be made in a single file, the file contains useful notes on configuration. Here is an example from my site, I have configured a standard Samba Domain using LDAP for authentication, if you have similar then this config may work for you :
@@ Line 256: / Line 277: @@
+  }
-user_login.pl uses several repository configuration options, they should be set by editing ldap.pl
+After editing restart Apache.

Drn@ecs.soton.ac.uk at 15:54, 7 June 2017

2017-06-07T15:54:46Z

← Older revision		Revision as of 15:54, 7 June 2017
Line 430:		Line 430:
	}		}

	===LDAP Authentication with On-Demand Creation of Users===		====LDAP Authentication with On-Demand Creation of Users====

	This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."		This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."
Line 437:		Line 437:
	====Things to note====		====Things to note====

	* ~~This script uses~~ a dedicated proxy account which must exist in your LDAP tree and has appropriate permissions (ACL settings) to search for users and read their <tt>uid,givenname,sn,mail</tt> attributes.		* These scripts use a dedicated proxy account which must exist in your LDAP tree and has appropriate permissions (ACL settings) to search for users and read their <tt>uid,givenname,sn,mail</tt> attributes.
	* It gets this proxy accounts' password from a file inside the repository configuration. this file needs to have read permissions for the user your webserver runs as (e.g. <tt>www-data</tt> on Debian). Use file system permissions to protect this (e.g. <tt>chmod 400 ldap.passwd</tt>).		* It gets this proxy accounts' password from a file inside the repository configuration. this file needs to have read permissions for the user your webserver runs as (e.g. <tt>www-data</tt> on Debian). Use file system permissions to protect this (e.g. <tt>chmod 400 ldap.passwd</tt>).
	* It changes the flow of <tt>user_login.pl</tt> a little to only check for local ''admin'' accounts (no users or editors; we have them all in our LDAP tree) and only when no user is found for ldap authentication. This allows you to have your admins in LDAP (if you want) but still use the local admin for "promoting" other users to admins, among other things (which could also be done with a simple SQL <code>update</code> directly in the RDBMS). If you don't need the local admin, remove those lines and just <tt>return 0</tt> since no user was found in LDAP.		* It changes the flow of <tt>user_login.pl</tt> a little to only check for local ''admin'' accounts (no users or editors; we have them all in our LDAP tree) and only when no user is found for ldap authentication. This allows you to have your admins in LDAP (if you want) but still use the local admin for "promoting" other users to admins, among other things (which could also be done with a simple SQL <code>update</code> directly in the RDBMS). If you don't need the local admin, remove those lines and just <tt>return 0</tt> since no user was found in LDAP.

Drn@ecs.soton.ac.uk: /* LDAP Import */

2017-06-07T15:53:24Z

LDAP Import

Show changes

Drn@ecs.soton.ac.uk: Added more recent version of update_users script.

2017-06-07T15:49:39Z

Added more recent version of update_users script.

Show changes

Drn@ecs.soton.ac.uk: Removed separate script that can creators users to advise uncommenting section of main user_login script.

2017-06-07T14:14:17Z

Removed separate script that can creators users to advise uncommenting section of main user_login script.

Show changes