LDAP Authorization: CAS integration testing

Thanks. This is a bug. I understand the issue and code and will commit this before beta3. This issue will affect anyone doing ldap authorization without ldap authentication.

Actually this doesn't make sense. It should be the user object, not the array. Can you copy and cast it with (object)$user before passing it in.

I'm not clear about the use case, but shouldn't CAS and ldap_authorization work together out of the box.

LDAP Authorization should grant the user's roles and save the user object, regardless of what CAS does. Does CAS need the drupal roles assigned before it finishes authentication for some reason.

It sounds like a bug in ldap authorization if its not granting the roles. There should be no need for the code you have. Perhaps its a bug in the CAS module. If code is needed for every permutation of authentication and authorization module we have a problem.

When you test authorization, does it work:
admin/config/people/ldap/authorization/test/drupal_role

When you try ldap authentication and authorization, does it work?

Yes, when you use the Drupal login system with ldap authentication and authorization configured correctly, the users groups/roles get synchronized perfectly. However, if you use the CAS login system then the groups/roles do not get synchronized. I contacted the developers of CAS and they confirmed this is the case, but they did say at one point in time (about a year or so ago) that the CAS module did trigger the group/role synchronization but there were incompatibilities with it it so they removed that functionality. This is why we are developing a module to invoke the group/role synchronization on CAS login.

LDAP Authorization does group/role synchronization on CAS login. That is all I'm trying to say. I'm just arguing that you don't need such a module.

As far as the patch, its not going to fly. The user object is the way to go, not the array. You should do the object - array conversion before you call the function.

Hi, one of the CAS developers here. The errors are getting triggered because the module being developed is passing an $edit-type array object instead of an $account-type user object (like in user_save().

At first glance, I don't think there is an error in the LDAP code, but I haven't examined this thoroughly.

We need someone to test ldap authorization with cas authentication. Ideally including a simpletest. I can write the ldap authorization part of the simpletest, but am not familiar with the CAS module.

This integration will likely inform ldap authorization working with other external authentication modules.

We ended up fixing this in our code.

Reopening since johnbarclay asked in #8 for CAS testing. I've opened #2047731 since group syncing does not work with CAS currently.

I have group sync partially working with the help of bobthebuilder and this snippet of code in a custom module. I have LDAP Authorization configured to re-grant roles each time a user logs in, but that doesn't seem to be happening. The first time a user logs in, they get a role of student, staff, or faculty. If I remove the role from that user and have them log in again, they are not re-assigned that role. Any help would be greatly appreciated!

/**
 * A CAS user has authenticated and the login is about to be finalized.
 *
 * This allows modules to react to a CAS user logging in and alter their
 * account properties. For example, modules may want to synchronize Drupal
 * user roles or profile information with LDAP properties.
 *
 * If you would like to synchronize information only for new accounts, you may
 * examine the value of $account->login which will be 0 if the user has never
 * logged in before.
 *
 * The 'cas_user' key in $edit contains all information returned from
 * hook_cas_user_alter().
 *
 * The CAS module promises to call user_save() and user_login_finalize() with
 * this $edit data.
 *
 * @param $edit
 *   An array of values corresponding to the Drupal user to be created.
 * @param $account
 *   A Drupal user object.
 */
function mymodule_cas_user_presave(&$edit, $account) {
  // Load the user object.
  $user = user_load($account->uid);

  // Get the roles from LDAP Authorization.
  ldap_authorizations_user_authorizations($user, 'set', 'drupal_role', 'logon');

  // Per @param $edit, set roles that have been assigned in the $user object.
  // CAS calls user_save() with the $edit data.
  $edit['roles'] = $user->roles;
}

@johnbarclay: Would love to get your thoughts on this. We have implemented the code in #11 in the hopes of a fix in LDAP for this eventually. This also seems to strip the CAS module's default to assign the 'authenticated user' role when a new user logs in.

Some related issues have been fixed in 7.x-2.0-dev and I'm not working on 7.x-1.0 at all anymore unless patches are submitted and tested. Can you check this against 7.x-2.0-dev?

I've been testing with 7.x-2.x-dev, so I'm changing the version of this issue. I disabled the custom module I mentioned in #11, updated to the latest 7.x-2.x-dev, and logged into CAS with a new user. The user was not assigned a role as configured with LDAP Authorization. If I create a Drupal core account with the same username, I am correctly assigned the 'staff' role as defined by LDAP Authorization. Thanks.