this is a continuation of #1317704: same uid on two different ldap servers able to log into drupal and claim same drupal user. and related to #986806: LDAP User: Use Case: ldap attribute for deriving email or username is not unique, unalterable user attribute

With multiple ldap servers or ldaps, one of the following needs to be possible:

- allow the user to specify which ldap they want to authenticate against. This would be a pulldown list of enabled ldap "friendly" names. It would not accomodate the case where redundant ldap servers server the same ldap. This is rare and built into modern ldap failovers where forwarding is done.

- round robin authentication. where on authentication each server is hit until successful authentication. this is the way the ldap module has always done it and has a number of drawbacks. One is a user that has the same "username" and password in 2 sister ldaps. They lose the ability to control which ldap their account is associated with.

In both cases another issue is mapping ldap accounts to drupal usernames without 2 users having the same usernames. We likely need to prefix drupal account names when more than one ldap server is used.

Comments

johnbarclay’s picture

Version: 7.x-1.x-dev » 7.x-2.x-dev
johnbarclay’s picture

Status: Active » Closed (duplicate)