situation:
drupal 5.1, Debian, ldap authentication at eDirectory.
ldap groups are defined in the userobject using "groupMembership" (2nd authentication method in drupal ldap group configuration)

Problem;
ldap authentication works, however all group memberships of the eDirectory user are imported as roles in Drupal.... we have a lot of groups in edirectory


<?php
// $Id: ldapgroups.conf.php,v 1.7 2007/03/03 03:23:56 scafmac Exp $

// Interesting constants that admins would want to mess with

//   The module automatically decides names for the Drupal roles
// based in the names of the LDAP groups. For example:
//   - LDAP group: Admins => Drupal role: Admins
//   - LDAP group: ou=Underlings,dc=myorg,dc=mytld => Drupal role: Underlings
//   However, if this is not enough, this name mapping can be refined
// by altering this array. Some examples are given.


$GLOBALS['ldap_group_role_mappings'] = array(
  // LDAP group => Drupal role

  // make sure the last group->role mapping does NOT have a trailing comma (,)
  'cn=hoofdbeheerder,ou=drupal,ou=usergroups,o=ourplace' => 'hoofdbeheerder',
  'cn=contentbeheerder,ou=drupal,ou=usergroups,o=ourplace' => 'contentbeheerder'

);

// Note: Uncommenting this function will limit the groups -> roles conversion t$
// specified in the function.

/*
function ldapgroups_roles_filter($groups) {
  global $ldap_group_role_mappings;
  $roles = array();
  // this should take the roles array, pass it thru the filters and send a NEW $
  foreach ( $groups as $group ) {
    foreach ($ldap_group_role_mappings as $approved_group => $approved_role) {
       // must strip spaces ?
       $group_stripped = preg_replace('/\s+/', '', $group);
       $approved_group_stripped = preg_replace('/\s+/', '', $approved_group);  $
      if (strcasecmp($approved_group_stripped, $group_stripped) == 0) {
        // this role is specified -- grant
           $roles[] = $approved_role;
      }
    }
  }
  return $roles;
}
*/

?>

please advise

Comments

kreaper’s picture

Assigned: Unassigned » kreaper
Status: Active » Closed (works as designed)

To limit the groups that are being pulled from AD, you can uncomment the function function ldapgroups_roles_filter($groups) and define the groups that you want to pull.

kreaper

avpaderno’s picture