Closed (fixed)
Project:
LDAP integration
Version:
6.x-1.x-dev
Component:
Code
Priority:
Critical
Category:
Bug report
Assigned:
Issue tags:
Reporter:
Created:
30 Mar 2009 at 04:39 UTC
Updated:
3 Jan 2014 at 00:07 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
miglius commentedStrange, the roles name should not be a full DN unless the mapping for that DN is explicitly configured under the "Mapping of LDAP groups to Drupal roles:" If this field is left empty, or the corresponding DN is not defined, then the regexp
is performed to extract the group's name.
Comment #2
aren cambre commentedI think you should be using the group's CN. That would eliminate possibility of improper matching.
I have never had anything in the "Mapping of LDAP groups to Drupal roles" field.
Comment #3
miglius commentedA group might be defined not only by CN but also as a OU=group,... The regex would match all those possibilities.
Comment #4
aren cambre commentedWhat information may I provide to help this module boil down the DN to a user friendly group name?
Comment #5
miglius commentedWhat is your full group DN?
Comment #6
aren cambre commentedI'd rather not post here, so I'll send you one privately through your contact form.
Comment #7
aren cambre commentedI cleared out my DB and reinstalled Drupal. I kept the files, which are the latest version of Drupal and the Mar. 30 dev version of this module.
I still get the same problem. These two errors show up in the logs:
I emailed you the memberOf attributes of the account I am signing in with. Only the first group makes it into a Drupal role. Also, that Drupal role's name is the first 64 characters of the group's DN. (I.e., CN=groupname,OU=division,.... up to 64 characters)
In case it matters, I am using Active Directory.
Comment #8
aren cambre commentedMore precise issue title.
Comment #9
aren cambre commentedInstead of using that regexp, why not just use the CN attribute of the group?
Comment #10
miglius commentedAs I mentioned in #3 reply, for a group entry CN should not necessary be in a DN. Regex is dealing with the broader case. The problem here is that an array is used where a function expects a string. This is a AD related issue as I cannot replicate it using OpenLDAP and I don't have AD in my possession.
I think this issue is related to a #417896: "Group by attribute" causes error and probably with a #417892: ldapgroups "Group by entry" breaks when CN has commas. In all those issues AD is used ant it's query result is kind of different I'm getting from the OpenLDAP.
Comment #11
aren cambre commentedSearching through Google, I found other examples of attributes with multiple values, so it looks like this is not just an Active Directory peculiarity.
I wonder whether the regexp in #3 is "overengineered"? Regardless of how you locate the group, be it through the DN, a user attribute, or an OU containing groups, I think you should still pull the group's directory entry and use that entry's CN attribute for the Drupal role name. Otherwise you are risking inconsistencies.
Comment #12
miglius commentedWhat is your ldapgroups configuration? Are you using "Groups are specified by LDAP attributes"?
Comment #13
aren cambre commentedUnder admin/settings/ldap/ldapgroups/edit/1, only Groups are specified by LDAP attributes is checked (under Group by attribute). In the Attribute names (one per line) field is memberOf.
I have nothing else selected.
Comment #14
chinko commentedI got the same problem with roles being created with truncated DN of LDAP group names.
I also got the same PHP syntax error messages as in comment #7.
Looking into ldapgroups.module, there is a trivial 'typo' in the function _ldapgroups_detect_groups():
178 $attrib_groups[] = array_merge($attrib_groups, $_ldapgroups_ldap->retrieveMultiAttribute($user->ldap_dn, $attribute));The code merges all the LDAP group names gathered using the 3 strategies into a single array. The code re-assigns the merged array back to the original variable $attrib_groups but it included '[]' and therefore causing $attrib_groups variable to become a two-dimensional array. This caused the syntax error messages and hence the group-to-name mapping did not work.
The line should have been:
178 $attrib_groups = array_merge($attrib_groups, $_ldapgroups_ldap->retrieveMultiAttribute($user->ldap_dn, $attribute));I removed the '[]' and the group-to-role mapping works perfectly.
Comment #15
Andrew Kaufmann commentedI applied that change and group-to-role is working for us, too.
Thanks!
Comment #16
chinko commentedHere is patch of the change I described in comment #14 on ldapgroups.module
Comment #17
miglius commentedThis code changed was already committed to cvs when fixing the #429186: unable to map AD Group to Role with Filtering, looking for support help. issue.