search

haiwen / seafile

High performance file syncing and sharing, with also Markdown WYSIWYG editing, Wiki, file label and other knowledge management features.
http://seafile.com/
Other
12.25k stars 1.54k forks source link

LDAP users identified by "uid" can't share with others #1548

Closed yanncam closed 8 years ago

yanncam commented 8 years ago

Hello,

I use Seafile with delegated authentication to an OpenLDAP server. My ccnet.conf file configuration looks like :

[...]

[LDAP]
HOST = ldap://localhost
BASE = ou=internal,dc=example,dc=com
USER_DN = uid=SVC_SEAFILE,ou=services,dc=example,dc=com
PASSWORD = SuPeRsTrOnGpAsSwOrD
LOGIN_ATTR = uid

My "uid" attribute in OpenLDAP are in this format : "Firstname-Lastname", example : "John-Doe".

With this configuration I can connect to Seafile (through agent on Windows or through Seahub in my browser). Login : John-Doe Password : *****

In the administration panel I can see in "Users" / "LDAP imported" all my user from LDAP that was log by the past.

When I try to share a folder or library with an LDAP account authenticated, autocompletion form list my targeted LDAP user, but I've the error "Share failed" (in french : "Échec du partage avec John-Doe".

I tried to activate the DEBUG mode (log level verbose) of Seafile but no additionnal information...

I reconfigure my ccnet.conf with the "mail" as "LOGIN_ATTR" :

[...]

[LDAP]
HOST = ldap://localhost
BASE = ou=internal,dc=example,dc=com
USER_DN = uid=SVC_SEAFILE,ou=services,dc=example,dc=com
PASSWORD = SuPeRsTrOnGpAsSwOrD
LOGIN_ATTR = mail

All work fine with the email as LOGIN_ATTR, I can share folder from one LDAP email-user to another.

**Why Seafile doesn't permit sharing folder when the LDAP LOGIN_ATTR isn't an email address ?

Other observation : Why a user can't add an LDAP (Firstname-Lastname) user into a group despite the message "Account successfully added" is displayed ? (admin panel doesn't display the added member too...).**

killing commented 8 years ago

If you read the manual carefully, you should see only email or UserPrincipalName are supported for the "LOGIN_ATTR" option. All other attributes cannot be used. Many web front end logic in Seafile depends on the users id to be in email address format. So we don't support other form of user id. It's quite normal that software has some requirements on configuration.