Hey there --

This feature would be very helpful to our organization -- perhaps others would find it so as well? Here's our situation:

Our Active Directory has several user attributes that we would like to be able to assign specific permissions to. We're a university, so, for example: we have an AD attribute "Classifcation." It can have the values "Undergraduate", "Graduate", "Faculty", "Staff". We would like users with the attribute "Undergraduate" to be assigned to one security role, "Graduate" to a separate security role, etc.

Is this possible? If there is maintainer/user interest in making such a feature, if it's not already easily done , we would be open to discussing sponsoring such a feature.

Thanks!

Comments

miglius’s picture

miglius commented

Current implementation does not support drupal roles mapping to the ldap attributes.

Andrew Kaufmann’s picture

Andrew Kaufmann commented

We'd be interested in sponsoring such a feature... is there interest in that?

aren cambre’s picture

aren cambre commented

subscribe

miglius’s picture

miglius commented
Issue tags: +ldapgroups

Reading again the issue, you might try configuring the "Group by attribute" setting, maybe it will fit your needs?

aren cambre’s picture

aren cambre commented

Look at section 2 of http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduper.... That is what we are probably going after. There would be multiple attributes from which we would like to create roles, and some of the attributes will be multivalued.

markDrupal’s picture

markDrupal commented
Status: Active » Fixed

@Andrew
You can do this currently using the LDAP group module and setting the 'Group by attribute' checkbox on the page 'admin/settings/ldapgroups/edit/1' (You may need to change '1')
set 'Attribute names (one per line): ' to the attribute you want to use to assign roles. I'm using "memberOf". You'd want to use 'Classifcation'

@Aren
The same should apply for you as well put 'eduPersonPrimaryAffiliation' (or whatever attribute you want to use) into the box after 'Attribute names (one per line):'

aren cambre’s picture

aren cambre commented
Status: Fixed » Active

The current implementation is limited to one attribute.

markDrupal’s picture

markDrupal commented

So is the label text incorrect?
'Attribute names (one per line):'

Should it be changed to
'Attribute name (at most one):'

ccw’s picture

ccw commented

I don't know how much 6.x differs from 5.x, but I have submitted a patch to 5.x-1.5, that introduces a hook, so anyone can easily write their own weird group detection scheme in their own module without bloating the ldap_integration code.

I wrote it because we had to get groups from users with the same cn but a different dn. Useful for us but not something everybody is waiting for. Hence the hook_detect_ldapgroups.

Perhaps someone can port it upstream.

cgmonroe’s picture

cgmonroe commented
Status: Active » Fixed

Not sure when this was put in but the latest -dev version supports multiple attributes (and has for a while). It this can't do what you want, there are a bunch of new hooks that allow groups and roles to be changed via site specific modules.

For recent change details see: #1475272: 6.x-1.0 Release Candidate 1 Status

Status: Fixed » Closed (fixed)
Issue tags: -ldapgroups

Automatically closed -- issue fixed for 2 weeks with no activity.

Issue tags: +ldapgroups

Restoring issue tags, see #2125755: System messages removed all issue tags during D7 upgrade.