search

cschiewek / devise_ldap_authenticatable

Devise Module for LDAP
MIT License
594 stars 359 forks source link

Allow group check by an attribute other than 'uniqueMember' #185

Open Startouf opened 9 years ago

Startouf commented 9 years ago

My LDAP has groups of objectType posixGroup, and they don't have uniqueMember attribute but instead memberUid attribute.

Hence, LDAP::Adapter.get_groups() will fail because it had a hardcoded 'uniqueMember' filter (ldap/connection.rb line 173)

This attribute should be instead specified in the config file. Or rather, it would be great if we could check user groups with multiple attributes.

dgn commented 9 years ago

same problem here. does replacing 'uniqueMember' with 'memberUid' really solve the problem?

Startouf commented 9 years ago

I don't know. Because I could afford to change my LDAP structure, I decided to switch to objectType GroupeOfUniqueNames to have the uniqueMember attribute (I had to create the groups anyway and only a few of them were already POSIX groups).

However the solution should work. Or that's the feeling I got when I looked at the packets from Wireshark. I believe you could use whatever attribute name you want.