FS#447 no groups with ldap auth backend

ACL & Authentication

• 

  2005-07-07 mainframe

  ldap authentication is working without errors but assigning permissions to ldap groups have no effect in dokuwiki.
  My example:
  
  I'm having wikieditor group in ldap tree with several users as members:
  
  version: 1
  
  # LDIF Export for: cn=wikieditor,ou=Groups,dc=active,dc=ee
  # Generated by phpLDAPadmin ( http://phpldapadmin.sourceforge.net/ ) on July 7, 2005 4:10 pm
  # Server: ActiveTux (127.0.0.1)
  # Search Scope: base
  # Search Filter: (objectClass=*)
  # Total Entries: 1
  
  # Entry 1: cn=wikieditor,ou=Groups,dc=active,dc=ee
  dn: cn=wikieditor,ou=Groups,dc=active,dc=ee
  objectClass: posixGroup
  objectClass: sambaGroupMapping
  cn: wikieditor
  gidNumber: 1001
  sambaSID: S-1-5-21-530076877-4031960640-1585896771-3003
  sambaGroupType: 2
  displayName: wikieditor
  memberUid: toomas
  memberUid: tiina
  memberUid: mart
  
  
  In local.php config file I have:
  
  $conf['useacl']       = 1;                //Use Access Control Lists to restrict access?
  $conf['openregister'] = 0;        // users are allowed to register themselves (default)
  $conf['superuser']    = 'admin'; // admin is superuser
  $conf['authtype']     = 'ldap';
  
  $conf['auth']['ldap']['server']      = '127.0.0.1';
  $conf['auth']['ldap']['usertree']    = 'ou=Users, dc=active, dc=ee';
  $conf['auth']['ldap']['grouptree']   = 'ou=Groups, dc=active, dc=ee';
  $conf['auth']['ldap']['userfilter']  = '(&(uid=%{user})(objectClass=posixAccount))';
  $conf['auth']['ldap']['groupfilter'] = '(&(objectClass=posixGroup)(memberUid=%{user}))';
  
  $conf['auth']['ldap']['version']    = 3;
  $conf['auth']['ldap']['debug']      = true;
  
  In acl.auth.php I have:
  
  start   @ALL    1
  *       @wikieditor     16
  stuff_pages     @wikieditor     2
  
  But members of wikieditor groups are treated like @ALL - having read only right
• 

  2005-07-07 mainframe

  The slapd query is certainly wrong:
  
  activetux slapd[18482]: conn=2747 op=5 SRCH base="ou=Groups,dc=active,dc=ee" scope=2 filter="(&(objectClass=posixGroup)(?=undefined))"
  
• 

  2005-07-07 mainframe

  Ok - found a fix:
  
  $conf['auth']['ldap']['groupfilter'] = '(&(objectClass=posixGroup)(memberUid=%{uid}))';
• 

  2005-07-07 mainframe

  First code example in auth_ldap documentation page shows %{user} in groupfilter - shouldn't it be %{uid} as in following examples?
• 

  2005-08-24 doychi

  I had a similar problem.  It appears that auth_getUserData() is called twice.  The first time by auth_checkPass and the second by auth_logon (auth_login?).  All the groups are returned correctly on the first call, but on the second no groups are retuned.  This means that the user only has the default group assigned to them.
  
  My simple solution was to store the $info variable in a global variable and then test if this variable has already been set.  I don't believe this is the best solution, but I do know that it works for me (for now).
• 

  2006-03-02 andi

  should be fixed in devel