Uploaded image for project: 'Observium'
  1. Observium
  2. OBS-3240

Fix for LDAP Web INterface auth

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Fixed
    • Minor
    • None
    • Professional Edition
    • Authentication
    • None

    Description

      Problem description

      When integrating Observium with LDAP that has strong requirement of group nesting and usage of "groupOfNames", ran into following issues:

      • When groups are recursively fetched from LDAP (i.e. uid=admin is member of cn=system_admins, and cn=system_admins is member of cn=observium_admins which is used to get privileges in Observium interface), upon 2nd iteration I received not "cn=system_admins", but just "c" this is due to a fact that ldap_search_user function referenced "$element[$config['auth_ldap_attr']['dn']][0]" instead of just "$element[$config['auth_ldap_attr']['dn']]";
      • When group search is performed ldap_filter_create function uses fixed value of "group" for objectClass, but the LDAP I integrated with uses "groupOfNames".

      Proposed solution

      Use not "$element[$config['auth_ldap_attr']['dn']]" and not "$element[$config['auth_ldap_attr']['dn']][0]" to fix recursive group search.
      Introduce "$config['auth_ldap_attr']['group']" variable in config to fix different names of group attribute in LDAP. Use default value of "group" for this variable to avoid breaking existing installations.

      Attached patch fixes both of them.

      Attachments

        Issue Links

          Activity

            People

              landy Mike Stupalov
              j-v-c Sergei Fomin
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: