Include support for LDAP authentication to web interface - #14
twinfield (tylerwinfield) wants to merge 8 commits into
Conversation
add login support for LDAP credentials. stores logged on username in session for correct display in web interface.
return the username value from the session data for the current web user if has been set
included lookup functions for administrators from an LDAP directory using the sAMAccountName and UserPrincipalName directory attributes.
included settings page to configure LDAP connectivity
Included support for LDAP connectivity settings and administrative users/groups
Included link and image for LDAP settings
Included link image for LDAP settings
There was a problem hiding this comment.
not necessary, since ldap_unbind equals ldap_connect and just gives warnings :)
There was a problem hiding this comment.
you are correct, ldap_close is an alias of ldap_unbind; the call is redundant the line for ldap_close($conn) can be removed
|
I believe there is a way we could accomplish the same thing using the username and password of the user logging in to attempt the bind. If we were able to go this route there would not be a need for storing the credentials in clear text to initiate the bind. Have you tried that work flow? |
|
I have not tried that, but you are correct; that workflow should work. I'll give that a try. |
|
If you can make that work please resubmit the pull request. I will close this out for now. Thanks. |
Thanks to Tylor Winfield! I adopted the configure section layout and some some other little things from jamf#14 This implementation doesn't need an proxy user for authentication. Things you have to setup are stated in LDAP settings - searchdn - domainname - admin groups. yes. only groups. (but nested is allowed ofc) added files: images/settings/ldap.png: as provided by Tylor Winfield - came with jss some versions ago I guess inc/auth.activedirectory.php: an authentication class for activedirectory. may works with other ldap's too. ldap.php: settings page, slightly changed but mainly from Tylor Winfield accounts.php: ldap users don't have to enter "webadmins" password to change it. (they even can't enter it anyway now). webadmin itself still has to enter the current password to change it. inc/config.php: adding ldap functions for storing and retrieving out of the config. get and set filter for their configureable variables inc/functions.php: we return the correct user now. since it alway return the webadmin's name for active directory this wouldn't have been correct. The current name is stored inside it's session index.php: store the username which authenticates within the session. add active directory as "fallback" authentication. settings.php: see Tyler Winfields commit - add LDAP settings. If you find any bug, please report it or pull request :)
|
All commits I made to my master include those things you required - you're free to merge it (or not). Maybe some more will come too, depending on my workload ;) |
3 participants
Adds LDAP authentication support to the NetSUS web appliance. A section to configure the LDAP connectivity has been added to the Settings screen of the appliance. All data required for LDAP authentication are stored in the WebadminConfig object.