I have a use case where I don't need any sort of granular authorization based on ldap roles/memberships/etc, but I do need to be able to distinguish LDAP users vs Drupal users when assigning drupal permissions. I added a simple setting to the authentication module to allow users to select a Drupal role to apply to any LDAP user that's created.
| Comment | File | Size | Author |
|---|---|---|---|
| #12 | ldap_authorization_add-1416692-12.patch | 5.7 KB | rafuel92 |
| #10 | ldap_authorization_add-1416692-10.patch | 5.73 KB | rafuel92 |
| #4 | ldap_authorization_add_drupal_role.patch | 5.2 KB | altcom_alan |
| ldap-auth-add-drupal-role.patch | 6.32 KB | fearlsgroove |
Comments
Comment #1
johnbarclay commentedThanks. Seems like a handy use case.
This should go in LDAP Authorization and allow for working with all types of authorization plugins (drupal role, og, etc.). Without this approach, sites using shib, sso, cas etc won't be able to leverage this functionality. Most larger organizations aren't likely to use ldap authentication module for security reasons, but will use ldap authorization.
The coupling of authorization and authentication created a great deal of implementation issues in the drupal 6 version of ldap_integration.
Comment #2
fearlsgroove commentedOK that makes sense, although in my case I'm going with the opposite -- using authorization for shared logins but not authorization since they don't want to manage permissions directly via AD. Would you add this setting to the drupal roles plugin or a standalone plugin?
Comment #3
johnbarclay commentedIt should be in the parent class/module ldap_authorization so roles, og, etc can all leverage it.
Comment #4
altcom_alan commentedHi,
I needed exactly the same functionality so I've had a stab at patching ldap_authorization, it works fine for me in testing.
Comment #5
grahlComment #10
rafuel92 commentedHello @Grahl, i've rerolled the patch again, i think that now it should be ok.
Comment #11
rafuel92 commentedi've also queued auomated testing again.
Comment #12
rafuel92 commentedi've also identified an error on the update function (the function that adds the field 'add_drupal_role') to ldap_authorization, that's another patch that fixes also this problem.
Comment #13
grahlNeeds to go in 8 first.
Comment #14
grahlWith wildcards (e.g.: /.*/) in ldap_authorization in 8.x it's possible to assign a group to all users.
Therefore I'm moving the issue back to 7 and marking it as postponed, because I don't plan on committing to this different approach.
Comment #15
grahlComment #16
grahlClosing issue as outdated due to no further development on 7.x, if you feel this issue is still relevant and you are willing to work on a patch and/or debug the problem, please reopen.