I noticed the mapping is to the label or name for the organic group. So if the name of the group is altered, users will have to logon again to join and the mapping will need to be changed in admin/config/people/ldap/authorization/add/og_group or admin/config/people/ldap/authorization/edit/og_group ?

I think a more usable approach would be:
- requiring the "Mapping of LDAP to OG group" field and filtering enabled
- make the mapping to og node id. (og's don't have machine names). In the administrative interface, list all the ogs and their nids.
- eliminate the admin/config/people/ldap_authorization_og interface, by having the role type entered directly in the mapping?
- not allowing automatic creation of og groups that didn't exist.

So the user interface would look like this:

blah blah blah...here are existing group memberships available:
Knitters (member): 7-member
Knitters (administrator): 7-administrator member
Bakers (member): 9-member
Bakers (admininstrator): 9-administator member

For example to map "Underlings,dc=myorg,dc=mytld" to Bakers (member), use "ou=Underlings,dc=myorg,dc=mytld|9-member" in the text box below. If this approach makes sense, pull downs could be used also.

------------------------------
ou=Underlings,dc=myorg,dc=mytld|knitters|member
ou=IT,dc=myorg,dc=mytld,dc=edu|knitters|administrator member
-----------------------------

What do you think?
Does anyone use automated generation of Organic Groups?
Does anyone use the OG authorization without mapping and filtering in the authorization interface?

Comments

johnbarclay’s picture

johnbarclay commented

Since the names or groups and roles can change, this storage method won't work:

ou=Underlings,dc=myorg,dc=mytld|knitters|member
ou=IT,dc=myorg,dc=mytld,dc=edu|bakers|administrator member

The actual stored authorizations would have to be:
gid-rid such as:
1-1
2-3

The user interface could be more flexible using a form of:
[ldap match]|[group match field]=>[group match value]|[role match field]=>[role match value]

such as:
ou=Underlings,dc=myorg,dc=mytld|title=>knitters|role_name=>member
ou=IT,dc=myorg,dc=mytld,dc=edu||title=>bakers|role_name=>administrator member
ou=Underlings,dc=myorg,dc=mytld|gid=>1|rid=>1
ou=IT,dc=myorg,dc=mytld,dc=edu||title=>bakers|rid=>3

This would meet the common use cases in #1358568: Need to change the groups label. As long as the UI is complex, might as well make it flexible. In the long run, a wizard could be developed but use case documentation may be better spent usability efforts.

johnbarclay’s picture

johnbarclay commented
Assigned: Unassigned » johnbarclay
Status: Active » Needs work

I've done this and added documentation. The code is in head. Most of the documentation is in the configuration user interface, but I've added some here: #1443428: LDAP Authorization Organic Groups. If there is anyone interested in testing this, I would gladly help them through the configuration.

johnbarclay’s picture

johnbarclay commented
Status: Needs work » Closed (fixed)