FS#2869 Usermanager and AD-/SSO-Connection

ACL & Authentication

• 

  2013-10-23 busch

  Hello,
  
  I have a 2013-05-10a " Weatherwax " running on a Debian Squeeze with the default template " Dokuwiki ", which is connected via authad-plugin to a Windows domain. The user authentication is successfully running in AD. So far so good.
  With "pure" AD integration the usermanager on the admin page will automatically disappear. This is ok, because in this case the user management should exclusively run in the AD.
  I now activate the SingleSignOn-option (SSO). In this case the usermanager appear strangely again . If I open the usermanager, then comes the message "Authorization method does not Provide user counts" and also an admin has no ability to manage Dokuwiki users. The alternative, that in AD integration the usermanager is set completely to hidden, is more sympathetic for me.
  I can't understand why the usermanager suddenly reappears when enabling SSO.
  BTW : SSO works properly otherwise.
  
  Thank you and best regards
  busch
• 

  2013-10-28 ChrisS

  Looking through the code:
  - to appear in the admin menu, auth needs to be enabled and it must be able to list users [ canDo('getUsers') returns true].
  - in authad, canDo('getUsers') will return true if values are provided for the config options, admin_username & admin_password.  These values can be domain dependent.
  
  On the face of it, I don't see any reason why SSO would affect the presence or absence of admin_username & admin_password options.
  
  Do you have these two authad config options set?
  If you remove them, does usermanager 'go away' ?
• 

  2013-10-29 busch

  Yes, I have set these two options in my local.protected.php as 'ad_username' and 'ad_password' (see https://www.dokuwiki.org/auth:ad?s[]=single&s[]=sign#enabling_sso). And yes - if I remove them, the usermanager go away. But in this case SSO don't work anymore, because I lose my "management account".
• 

  2013-10-29 ChrisS

  Ok, that explains the conumdrum. If you want SSO, you must provide admin user/pass.  If you provide that information, auth_ad can get user information, so will include the user manager in the admin menu.
  
  You would be happy a config item to disable/hide the user manager?
  
• 

  2013-10-29 andi

  I think the real problem is that the usermanager should not be shown when user counts are not available? Though I'm not sure why that should be the case for the AD backend?
• 

  2013-10-30 busch

  Yes a config item to disable/hide the user manager would be very nice and a smart solution. In some cases it may be necessary to enable the user manager with enabled SSO, for example in mixed environments with AD-users and non AD-users.
• 

  2014-02-15 andi

  There was a bug in retrieveUsers in the ad plugin. However it's not really what this issue is about. The user manager should always be shown when a list of users can be retrieved. This is the case when an administrator account was configured. This is not related to SSO or not. That seems to work correctly so I'll close this bug.