I've installed the LDAP integration module and have set the system wide option for authentication mode as "Drupal's DB first, then LDAP directory". However, when searching users, it seems that nodeaccess only queries the Drupal's DB. Is this a known limitation? If so, are the changes significant to honor the system wide authentication setting?

Comments

mantyla’s picture

mantyla commented
Category: support » feature
Status: Active » Closed (fixed)

Yes, this limitation is known. And yes, the required changes to make Nodeaccess query the LDAP database for users are significant. In fact, the changes are such that implementing them is practically impossible.

The first reason why this is so is that Nodeaccess, like all node access modules, can only grant rights to users stored in the Drupal database. Even if we did search for users from the LDAP database, granting rights to them would not be possible without first creating those users. It might be possible to integrate Nodeaccess with LDAP Integration to accomplish this and honor the LDAP settings too, but it still sounds like a bad idea to try.

Why is that? There is the security aspect of it all. We'd have to implement some method to restrict users from creating new users when granting permissions, and making a mistake here would definitely be bad. We don't want users to bypass user creation restrictions like this.

Finally, there is the task of maintaining this functionality as both Nodeaccess and LDAP Integration continue to develop. Some time along the road there would certainly be a conflict of versions, and having one installed together with the other would break one or both of them.

For these reasons, this simply is not a good idea. If you want to grant rights to a user, it shouldn't be that much trouble to get them to log in once before you do it. And if they're not going to log into Drupal, what is the point of granting them rights anyway?

Anonymous’s picture

Anonymous (not verified) commented

When I originally wrote this, I did so to use it with ldap authentication. I no longer work there though and haven't used ldap since, but the way it worked when I did it was that ldap authentication actually created drupal accounts when an ldap user logged in, which meant that nodeaccess would find any user account without problems as long as they had logged in. For us this wasn't a huge deal, we just told people that if they wanted someone to access a page, they needed to tell them to log into the site first so that the site knew about them. Another option would be to just write a script that runs nightly/weekly to go ahead and create drupal accounts for all ldap accounts but that's a bit more involved.