[jifty-devel] proposal for Jifty::Plugin::Authentication::Ldap modifications

[Stanislav Sinyagin]

hi,

I need to authenticate users against the corporate MS Active Directory, and also

authorize them based on group membership.

A static account for binding and searching is not available, therefore AuthzLDAP
is

difficult to use.

Here's a proposal, please let me know if it fits your philosophy, and then I'll
make

a fork at Github:


1. Allow MS style binding: DN=***@domain.com
This simplifies the thing, as we don't need to know the whole AD hierarchy
structure.
Works with most activedirectory servers.

2. Allow hooks in Action::LDAPLogin.
I want to look up the user's group membership right at the spot when the LDAP
session is created and authenticated.
Based on that lookup, I would update the user's fields, like "is_administrator".
Such things are much site-specific, so it doesn't make much sense to put them
into the

public plugin. Of course, I would give an example in the documentation.



cheers,
stan

[Jesse Vincent]

That sounds great to me.

Post by Stanislav Sinyagin
hi,
I need to authenticate users against the corporate MS Active Directory, and also
authorize them based on group membership.
A static account for binding and searching is not available, therefore AuthzLDAP
is
difficult to use.
Here's a proposal, please let me know if it fits your philosophy, and then I'll
make
This simplifies the thing, as we don't need to know the whole AD hierarchy
structure.
Works with most activedirectory servers.
2. Allow hooks in Action::LDAPLogin.
I want to look up the user's group membership right at the spot when the LDAP
session is created and authenticated.
Based on that lookup, I would update the user's fields, like "is_administrator".
Such things are much site-specific, so it doesn't make much sense to put them
into the
public plugin. Of course, I would give an example in the documentation.
cheers,
stan
_______________________________________________
jifty-devel mailing list
http://lists.jifty.org/cgi-bin/mailman/listinfo/jifty-devel

[Stanislav Sinyagin]

ok, here we go:

http://github.com/ssinyagin/jifty-plugin-authentication-ldap/commits/master





----- Original Message ----

Post by Jesse Vincent
That sounds great to me.

This simplifies the thing, as we don't need to know the whole AD hierarchy
structure.
Works with most activedirectory servers.
2. Allow hooks in Action::LDAPLogin.
I want to look up the user's group membership right at the spot when the LDAP
session is created and authenticated.
Based on that lookup, I would update the user's fields, like

"is_administrator".

Such things are much site-specific, so it doesn't make much sense to put them
into the
public plugin. Of course, I would give an example in the documentation.

[Yves Agostini]

Post by Stanislav Sinyagin
http://github.com/ssinyagin/jifty-plugin-authentication-ldap/commits/master

login hooks is a great idea !

I made some manual tests and it works fine :-)

I will try to find the best way to merge ... I'm not really comfortable
with github :-/

Thanks

Post by Stanislav Sinyagin
----- Original Message ----

Post by Jesse Vincent
That sounds great to me.

This simplifies the thing, as we don't need to know the whole AD hierarchy
structure.
Works with most activedirectory servers.
2. Allow hooks in Action::LDAPLogin.
I want to look up the user's group membership right at the spot when the LDAP
session is created and authenticated.
Based on that lookup, I would update the user's fields, like

"is_administrator".

Such things are much site-specific, so it doesn't make much sense to put them
into the
public plugin. Of course, I would give an example in the documentation.

[Stanislav Sinyagin]

haha, me too. I ordered a Git book from amazon :)



----- Original Message ----

Post by Yves Agostini
login hooks is a great idea !
I made some manual tests and it works fine :-)
I will try to find the best way to merge ... I'm not really comfortable
with github :-/