Download & Extend

LDAP Server: Need to be able to differentiate ldap servers on logon and 2 users with same username but different ldap

Project:Lightweight Directory Access Protocol
Version:7.x-2.x-dev
Component:Code
Category:feature request
Priority:normal
Assigned:johnbarclay
Status:active
Issue tags:D7 stable release blocker

Issue Summary

this is a continuation of #1317704: same uid on two different ldap servers able to log into drupal and claim same drupal user. and related to #986806: Use Case: ldap attribute for deriving email or username is not unique, unalterable user attribute

With multiple ldap servers or ldaps, one of the following needs to be possible:

- allow the user to specify which ldap they want to authenticate against. This would be a pulldown list of enabled ldap "friendly" names. It would not accomodate the case where redundant ldap servers server the same ldap. This is rare and built into modern ldap failovers where forwarding is done.

- round robin authentication. where on authentication each server is hit until successful authentication. this is the way the ldap module has always done it and has a number of drawbacks. One is a user that has the same "username" and password in 2 sister ldaps. They lose the ability to control which ldap their account is associated with.

In both cases another issue is mapping ldap accounts to drupal usernames without 2 users having the same usernames. We likely need to prefix drupal account names when more than one ldap server is used.

Comments

#1

Version:7.x-1.x-dev» 7.x-2.x-dev