wekan / ldap

LDAP support for Wekan code has been moved to https://github.com/wekan/wekan/tree/master/packages/wekan-ldap , issues to https://github.com/wekan/wekan/issues , and if PRs are needed please add them instead to https://github.com/wekan/wekan/pulls
https://github.com/wekan/wekan/tree/master/packages/wekan-ldap
MIT License
12 stars 10 forks source link

Add LDAP email matching support #39

Closed stevenpwaters closed 5 years ago

stevenpwaters commented 5 years ago

Problem

Currently, there's no way to match LDAP accounts and Wekan accounts with anything but an exact username match. In our case, users have already created accounts with usernames that don't match their LDAP username. Therefore, no existing user account is detected for merging and the task of changing each user's Wekan username to match their LDAP username will be arduous. However, in most cases the e-mail address of the Wekan user matches their LDAP e-mail address.

Solution

This introduces four new environment variables to allow LDAP accounts to be matched with existing Wekan accounts using e-mail addresses as well as usernames when LDAP_Email_Match_Enable is true.

When a regular username match is detected, the merge can be additionally verified using the e-mail address if LDAP_Email_Match_Require is true. This stops erroneous matching (as in our case, where some users have set usernames that match another users' LDAP username). This is a reliable solution to issue #36

You must specify an LDAP email address field with LDAP_Email_Field. You can also limit email matching to just verified email addresses in Wekan if LDAP_Email_Match_Verified is true.

Supported with wekan/wekan#2198