LDAP: Progress Updates

I roughed out the user interface for ldap authorization. Attached is a pdf. Looking it over will give a sense of the functionality I'm looking for. If I'm missing anything, please add it as a feature request with the subject LDAP Authorization: ....

Remaining tasks to LDAP Authorization:
- connect admin form to database
- connect module to configuration data
- establish default values for configuration
- connect to LDAP Api functions
- clean up the form instructions with advanced help and more examples

I'm using this thread for general progress updates.

Had a good Saturday on this on the ldap authorization component.

Here's the approach I'm thinking for wrapping LDAP up: http://www.gliffy.com/publish/2315088

Though its pretty flexible.

Here's a sequence diagram for ldap authorization, though its up for debate still.
http://www.gliffy.com/publish/2318063/

I have some placeholder code in place for the api part and am hoping to get an alpha of ldap authorization (no authentcation + placeholder api code) early next week.

At that point, we could use some other coders for ldap authorization for:
- code review
- UI review
- Implement exportables for it
- Accessibility review
- unit tests

Attached is:

• ldap_api_temp. temporary functionality to allow work on ldap_authorization
• ldap_servers. temporary functionality to allow work on ldap_authorization

Most of the functionality of these two will be in the ldap_api part of the package which retsamedoc is working on.

• ldap_authentication. a rough placeholder for authentication
• ldap_authorization, ldap_authz_roles, ldap_authz_og which are non functional but give a sense of where ldap_authorization is headed. ldap_authz_og was just to see if the hooks would work in another auth module. ldap_authz_og will not exist. Its functionality will be in og_ldap or entitlements or wherever. ldap_authz_roles will be in the ldap package, but may be within the ldap_authorization module.

Oh. and I think ldap_authentication is up for grabs as far as development currently. I will get back to it after ldap_authorization, but ideally someone else would jump in and move it forward. retsamedoc is working on the ldap api part.

Attached is the pre alpha of ldap_authorization and a temporary ldap_servers and ldap_api_temp (these last 2 may be in the api part of the module in the end).

Since there is no ldap_authentication yet, its only good for the use case where authentication is not ldap, but authorization is.

I need to flush out the configuration a bit to clarify what should be done when ldap_authorization gives a user a role, but the role is removed manually.

I'm going to check in with others and see how this can fit into cvs.

retsamedoc, netw3rker and I had a short Skype last night. I'm following up on the ldap authentication part of the module and retsamedoc is plugging away at the API. netw3rker took on the tricky use case where a user needs to merge multiple accounts generated by different authentication modules.

Attached is a pdf of my first shot at the admin interface for ldap authentication. Looking for feedback on the functionality the form implies as well as wording. Comments on the pdf refer to drupal issues.

The classes behind the ldap authentication configuration are attached also if anyone is interested. After I get this functional, I'll get check it in.

Getting close on ldap_authentication. The new d7 user.module has simplified some things. I made a sequence diagram of sorts at http://www.gliffy.com/publish/2362004/ to get my head around the code. I just need to test and debug then I will check in ldap_authentication and ldap_authorization and the temporary api files I'm using. I've already checked the ldap_authorization in.

I'm working against D7 RC1.

Here's the way I see the overall project workflow:
http://www.gliffy.com/publish/2315088/

I checked into head, d7 rc2 code for ldap_authentication and ldap_authorization. The api and servers part is still temporary code until the api is done. I also threw in an ldap_developer module that I use for breaking down and rebuilding ldap configurations. It may be handy for testers.

I would definately call this alpha code and I've done very little testing. Its far enough along that:
1) patches within the ldap_authorization and ldap_authentication will be helpful.
2) I'm going to start moving more of my @todos into the issue queue
3) anyone interested in working on exportables, unit tests, drush, accessibility, usability, etc can jump right in on ldap_authentication and ldap_authorization.

Here's the flow for ldap_authentication:
http://www.gliffy.com/publish/2362004/

Yes. Progress is being made. The bugs and unfinished features in unstable 4 are mostly resolved. There were enough of them that it makes no sense to test until I get unstable 5 out.

Released 7.x-1.0-unstable5.

Main focus was on ldap_authentication. Next will be ldap_authorization. I can really use some help with articulating test for ldap_authorization and cleaning up the UI and creating documentation.

Here's the unstable 5 changes:

- install instructions: disable and uninstall previous ldap modules. make sure tables are removed.
------------------
- main focus of unstable 5 is ldap_authentication including finishing out features, improving usability,
fixing bugs, documentation and setting up tests. ldap_authorization still needs features to be
finished out, documentation and usability improvements, and a set of tests.
- ldap_authentication: reordered authentication validation related to issue #1022362
- ldap_authentication: added test grid for ldap_authentication testing: http://drupal.org/node/1053818
- ldap_authentication: added typical authentication configurations: http://drupal.org/node/1053748
- ldap_help: added "status" and "issue reporting" tabs to improve testing and bug reporting
- ldap_authentication: removed option to allow ldap users to change, have separate drupal email. this feature needs more work if desired at all.
- ldap_authentication: added configurable help link for ldap password resetting.
- ldap_authentication: made more content themeable, especially where localized ldap user help may be a factor
- ldap_authentication: #807416 finished and tested white lists
- ldap_authentication: clarified and tested rules for existing drupal account conflicts. Desired behavior is in
tests (ldap_authentication.tests.txt).
- ldap_authentication: #968574, #256226, #258974 added "Account Creation for LDAP Authenticated Users" section for account creation. Desired behavior is in
tests (ldap_authentication.tests.txt). Pushed some configuration over to user settings page.
- ldap_servers: #1050590 added check for existance of https in $_SERVER array per
- ldap_authorization: #1050944 fixed array work ldap to role mapping.
- ldap_servers: improved wording on required https message and made themeable
- ldap_authentication: #1023510 several tweaks for ldap authentication settings related to location and visibility of password,
password reset links, account creation links, etc. Many of the combinations made no sense and the form was overly complex. The logic is
articulated in the ldap authentication settings form and ldap_authentication.tests.txt
- ldap_authentication: moved request account and password reset link hide/show logic from theming layer to menu/permission layer.
makes more sense and reduced code alot.
- another trip through drupal code module\
- ldap_authorization: #1026138 bug that didn't remove past ldap applied roles #1026138
- ldap_authorization: fixed 1 case insensitivity issue; may be more. target role mappings are case sensitive in php, but not in mysql.

Funding would help to get some outside eyes on the module or perhaps set up test scripts. I would likely use it to hire someone to give the module a once over. I don't have any extra purchaseable time as I'm quite busy so it would not help out with the ldap_authorization part I'm working on. It may be useful in the long run or for some of the other developers, but I don't think they have time for this project at the moment.

What the project really needs is more hands on at this point. Its not a viable project without more active participants. We are particulaly weak in issue queue support, testing, and documentation. There is also much coding to do. Maybe you can get a time commitment from your boss to work on some tasks; you seem to have a good deal of drupal contrib coding experience.

Here is the path I would recommend:

- read up a little on the project in the issue queue
- take a read through the documentation pages and make any obvious improvements
- pick a clear initial role for yourself.
-- If you really need a backport of this to d6, that might be your role. My guess is that if there is an insurmountable problem with ldap_integration for d6, that a patch/fork may be a better solution for you.
-- this task would be of the most use: #1062994: Automated Testing for Developers but its a big one. If you are familiar with this sort of testing, it might be a good task. We aren't looking for a crazy amount of functionality in the modules, besides the existing feature set, our highest priorities are test coverage, good documentation, support for exportables, and other goodies that create a stable and secure authn/authz module.
-- some other issues http://drupal.org/node/806068#comment-4097492