LDAP - Revision history

Drn@ecs.soton.ac.uk at 17:59, 22 January 2022

2022-01-22T17:59:38Z

Drn@ecs.soton.ac.uk: Added to Howto category

2022-01-21T12:25:17Z

Added to Howto category

Drn@ecs.soton.ac.uk: /* LDAP Import */

2017-06-12T13:05:01Z

‎LDAP Import

Drn@ecs.soton.ac.uk at 12:56, 12 June 2017

2017-06-12T12:56:03Z

Drn@ecs.soton.ac.uk at 16:00, 7 June 2017

2017-06-07T16:00:27Z

Drn@ecs.soton.ac.uk at 15:59, 7 June 2017

2017-06-07T15:59:44Z

Drn@ecs.soton.ac.uk at 15:54, 7 June 2017

2017-06-07T15:54:46Z

Drn@ecs.soton.ac.uk: /* LDAP Import */

2017-06-07T15:53:24Z

‎LDAP Import

Show changes

Drn@ecs.soton.ac.uk: Added more recent version of update_users script.

2017-06-07T15:49:39Z

Added more recent version of update_users script.

Show changes

Drn@ecs.soton.ac.uk: Removed separate script that can creators users to advise uncommenting section of main user_login script.

2017-06-07T14:14:17Z

Removed separate script that can creators users to advise uncommenting section of main user_login script.

← Older revision		Revision as of 17:59, 22 January 2022
Line 1:		Line 1:
−	[[Category:Authentication~~]] [[Category:Howto~~]]	+	[[Category:Authentication]]

	==LDAP Authentication==		==LDAP Authentication==

← Older revision		Revision as of 12:25, 21 January 2022
Line 1:		Line 1:
−	[[Category:Authentication]]	+	[[Category:Authentication]] [[Category:Howto]]

	==LDAP Authentication==		==LDAP Authentication==

@@ Line 391: / Line 391: @@
     return unless defined $entr and $entr->can("get_value");
-    my $username = $entr->get_value( "sAMAccountName" );
+    my $username = $entr->get_value( "sAMAccountName" ); # This may need to be changed to uid or cn rather than sAMAccountName
     my $given = $entr->get_value( "givenName" );
     my $family = $entr->get_value( "sn" );
@@ Line 430: / Line 430: @@
     $user->commit();
+  }
 ====Things to note====

@@ Line 341: / Line 341: @@
   my $updated_counter = 0;
   my $created_counter = 0;
-−
   # Create paging control
   my $page = Net::LDAP::Control::Paged->new( size => 100 );

← Older revision		Revision as of 16:00, 7 June 2017
Line 430:		Line 430:
	$user->commit();		$user->commit();
	}		}
−
−	~~====LDAP Authentication with On-Demand Creation of Users====~~
−
−	~~This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."~~

@@ Line 128: / Line 128: @@
 ====LDAP Configuration====
 All changes for LDAP authentication can be made in a single file, the file contains useful notes on configuration. Here is an example from my site, I have configured a standard Samba Domain using LDAP for authentication, if you have similar then this config may work for you :
@@ Line 256: / Line 277: @@
+  }
-user_login.pl uses several repository configuration options, they should be set by editing ldap.pl
+After editing restart Apache.

@@ Line 430: / Line 430: @@
+  }
-===LDAP Authentication with On-Demand Creation of Users===
+====LDAP Authentication with On-Demand Creation of Users====
 This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."
@@ Line 437: / Line 437: @@
 ====Things to note====
-* This script uses a dedicated proxy account which must exist in your LDAP tree and has appropriate permissions (ACL settings) to search for users and read their <tt>uid,givenname,sn,mail</tt> attributes.
+* These scripts use a dedicated proxy account which must exist in your LDAP tree and has appropriate permissions (ACL settings) to search for users and read their <tt>uid,givenname,sn,mail</tt> attributes.
 * It gets this proxy accounts' password from a file inside the repository configuration. this file needs to have read permissions for the user your webserver runs as (e.g. <tt>www-data</tt> on Debian).  Use file system permissions to protect this (e.g. <tt>chmod 400 ldap.passwd</tt>).
 * It changes the flow of <tt>user_login.pl</tt> a little to only check for local ''admin'' accounts (no users or editors; we have them all in our LDAP tree) and only when no user is found for ldap authentication. This allows you to have your admins in LDAP (if you want) but still use the local admin for "promoting" other users to admins, among other things (which could also be done with a simple SQL <code>update</code> directly in the RDBMS). If you don't need the local admin, remove those lines and just <tt>return 0</tt> since no user was found in LDAP.

@@ Line 232: / Line 232: @@
+    }
-    # Create a new user for this LDAP login.  You may wish to comment this out
+    # Uncomment to allow on-demand creation of users
-    unless( defined $user )
+    #unless( defined $user )
+    #{
-     my $data = {
+   #  my $data = {
-       username => $username,
+   #    username => $username,
-       usertype => $usertype, # This will be a standard user
+   #    usertype => $usertype, # This will be a standard user
-     };
+   #  };
-     my $name;
+   #  my $name;
-     $name->{given} = $entr->get_value( "givenName" ) if defined $entr->get_value( "givenName" );
+   #  $name->{given} = $entr->get_value( "givenName" ) if defined $entr->get_value( "givenName" );
-     $name->{family} = $entr->get_value( "sn" ) if defined $entr->get_value( "sn" );
+   #  $name->{family} = $entr->get_value( "sn" ) if defined $entr->get_value( "sn" );
-     $data->{name} = $name if defined $name;
+   #  $data->{name} = $name if defined $name;
-     $data->{email} = $entr->get_value( "mail" ) if defined $entr->get_value( "mail" );
+   #  $data->{email} = $entr->get_value( "mail" ) if defined $entr->get_value( "mail" );
-     $data->{dept} = $entr->get_value( "ou" ) if defined $entr->get_value( "ou" );
+   #  $data->{dept} = $entr->get_value( "ou" ) if defined $entr->get_value( "ou" );
-−
+   #
-     $user = EPrints::DataObj::User->create_from_data(
+   #  $user = EPrints::DataObj::User->create_from_data(
-       $session,
+   #    $session,
-       $data,
+   #    $data,
-       $session->get_repository->get_dataset( "user" ) );
+   #    $session->get_repository->get_dataset( "user" )
+   #  );
       return 1;
@@ Line 324: / Line 325: @@
 ===LDAP Authentication with On-Demand Creation of Users===
-Here's an example of a customized <tt>/opt/eprints3/archives/ARCHIVEID/cfg/cfg.d/user_login.pl</tt>
+This can be achieved by uncommenting the section in the user_login.pl script above, labelled with the comment ''Uncomment to allow on-demand creation of users."
 ====Things to note====