By geste on

I started this "feature" thread under LDAP Integration issues, but realized I might get more input if I posted something in a Forum topic. My quest is to see whether other folks have combined the use of both WebServer Auth and LDAP Integration modules in such a way that they get authenticated by HTTPD REMOTE_USER (using Webserver Auth) but then get authorized by Drupal user/role with roles derived from LDAP groups (via LDAP Integration).

My situation is that our university has university-wide Pubcookie system in place that is very pervasive and popular. It allows folks to authenticate once at start of day and then visit a variety of Pubcookie-protected sites including our Drupal intranet without need for additional sign-on. Once an hour, we generate a new Apache authgroupfile from our departmental LDAP server to provide basic authorization. When a new department member connects to our Drupal for the first time, their account is automatically created. Great.

However, when I looked at implementing the mapping of LDAP groups to Drupal roles, it started to become clear that the LDAP Integration module expects, probably requires, that users be authenticated to LDAP in order for group/role membership information to be populated. It *looks* like user's LDAP password is cached and used for subsequent LDAP queries (group membership). The LDAP integration module allows the definition of a dedicated account/DN to perform LDAP lookups. I created such a dedicated service account, but that is not working yet; perhaps I need to improve the LDAP ACLs for that account.

One other issue is that users automatically created via Webserver Auth are not necessarily LDAP users that will work with aspects of LDAP Integration module. I am trying to tease out what I will need to change in my 300+ user records to make them LDAP users.

In any event, I am posting this question under "Post Installation" to see if by chance any of you have already managed to achieve what I hope to -- to authenticate via Webserver Auth but then have fairly complete LDAP functionality with respect to authorization and group/role membership.

Jim

⋅ Categories: Drupal 5.x

Comments

dinis’s picture

dinis commented

I believe I am trying to exactly the same thing as you, have you had any success in getting this to work as required?

Kind regards,
Danielle

cybertron1’s picture

cybertron1 commented

i too search this . Have been trying to implement / continueing the work of others to reach my goal, but with no real luck.

kswan’s picture

kswan commented

I wrote a module that might be a good starting point. I am just applying ldap data to the profile fields, but it should be possible to apply it to roles as well. Take a look at http://groups.drupal.org/node/14614 and http://drupal.org/node/292423#comment-1025792.

It is Drupal 6 only.