I have a Drupal site that should only allow a rarely changed subset of LDAP users to log in. When this option is enabled, an LDAP user who successfully authenticates with the directory but does not yet exist in Drupal should be denied access. The current behavior adds the user to Drupal. This option should be disabled by default, of course.

I intend to write this pretty soon and will post a patch when it's finished.

CommentFileSizeAuthor
#10 ldapauth-256226-10.patch3.23 KBpaolomainardi
#7 ldapauth-256226.patch3.13 KBpaolomainardi

Comments

eporama@drupal.org’s picture

eporama@drupal.org commented

I just posted a Feature Request http://drupal.org/node/258974 that I wonder if it would be essentially the solution for this as well.

If the LDAPauth user creation process followed the settings in /admin/user/settings/ under "public registrations", then this could be solved by simply choosing the value 0 for user_register ("Only site administrators can create new user accounts.")

cpugeniusmv’s picture

cpugeniusmv commented

I noticed your post and was just thinking that myself.

If we were to enforce the same rules for all new LDAP accounts from the local user registration settings like you suggest, it would alter the behavior that I (and probably many others) rely on for most sites. Most of the time I disable user registration, but I allow any account to be created that can authenticate from LDAP.

I propose that instead of the option detailed in my original issue, we could have an option (disabled by default) to enforce user registration settings from the local users settings. That way the current behavior doesn't change implicitly and different sites can continue to apply the different policies if desired.

How does that sound?

gp177’s picture

gp177 commented

I too would like to see this option available.

In the meantime I've added the following code to our server configuration under PHP to transform login name.

return db_fetch_object(db_query("select name from users where name like '%s'", $name))->name;

Not ideal but it requires that the name exists in the database prior to authentication.

johnbarclay’s picture

johnbarclay commented

I add this to the ldap project d7 (http://drupal.org/project/ldap) issue queue also #968574: Option to prevent new accounts from LDAP from being added to Drupal and have admin approve them.

johnbarclay’s picture

johnbarclay commented
Version: master » 6.x-1.x-dev
shendric’s picture

shendric commented

Would it be at all possible to add that to the Drupal 6 queue? We've got some sites that can't easily be migrated as yet, and it would be helpful to have that in the Drupal 6 version.

paolomainardi’s picture

paolomainardi commented
Status: Active » Needs review
StatusFileSize
new ldapauth-256226.patch3.13 KB

I've just created a patch to avoid new users creation, please test and review it.

cgmonroe’s picture

cgmonroe commented
Status: Needs review » Needs work

Patch will not apply to head. Contains file paths from a/sites/all/modules/contrib/ and b/sitesall/modules/contrib/. Please see:

http://drupal.org/node/707484

In addition, looking thru the patch file, I'm not sure the watchdog and form errors are worded clearly.

The deny form msg should say something along the lines of a 403 Access denied message rather than this account "is not a valid system account".

Also, the watchdog message of "LDAP user with DN.. has a naming conflict with a local drupal user..." is not valid.

paolomainardi’s picture

paolomainardi commented

@cgmonroe

Thanks for your feedback, got it, i'm sending an updated patch.

paolomainardi’s picture

paolomainardi commented
Status: Needs work » Needs review
StatusFileSize
new ldapauth-256226-10.patch3.23 KB

Please find attached an updated patch.

paolomainardi’s picture

paolomainardi commented

Up

paolomainardi’s picture

paolomainardi commented

Up

cgmonroe’s picture

cgmonroe commented
Status: Needs review » Fixed

I reviewed the code and did some testing... everything looks fine.

Did make a minor wording change to the watchdog message. The message for denied user is now:

"The valid LDAP account %name was denied access because there was no matching Drupal account."

Committed to 6.x-1.x branch.

paolomainardi’s picture

paolomainardi commented

@cgmonroe Great, glad to contribute to ldap module :)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.