LDAP group mapping using SimpleMapping

Monday 17 January 2011 2:49:10 am

Hi,
I would like to map LDAP to eZ groups with SimpleMapping. I cannot make it work without the following modification in ./kernel/classes/datatypes/ezuser/ezldapuser.php. Is this a bug or a configuration issue (maybe related to the LDAP server I am trying to use)? I am using Exponential 4.4.0.
Thanks
Mathieu

--- ./kernel/classes/datatypes/ezuser/ezldapuser.php.orig 2011-01-14 13:59:10.000000000 +0100
+++ ./kernel/classes/datatypes/ezuser/ezldapuser.php 2011-01-17 10:38:56.000000000 +0100
@@ -488,15 +488,29 @@

$groupsTree = array();
$stack = array();
- $newfilter = '(&(objectClass=' . $LDAPGroupClass . ')(' . $LDAPGroupMemberAttribute . '=' . $userData['dn'] . '))';
+ // $userData['uid'][0]=<login> -> OK
+ // $userData['dn']=uid=<login>,ou=users,dc=domain.org,dc=local -> KO
+ $newfilter = '(&(objectClass=' . $LDAPGroupClass . ')(' . $LDAPGroupMemberAttribute . '=' . $userData['uid'][0] . '))';

$groupsTree[ $userData['dn'] ] = array( 'data' => & $userData,
'parents' => array(),
'children' => array() );

settings/override/ldap.ini.append.php file:

[LDAPSettings]
LDAPDebugTrace=enabled

# LDAP Server
LDAPServer=ldap.domain.org

# Where to find users
LDAPBaseDn=dc--domain.org,dc--local

# Group mapping
LDAPGroupMappingType=SimpleMapping
LDAPCreateMissingGroups=disabled
LDAPGroupBaseDN=dc--domain.org,dc--local
LDAPGroupClass=<name of my group object in LDAP>
LDAPGroupNameAttribute=cn
LDAPGroupMemberAttribute=<name of the attribute of my group object in LDAP specifying the members of the groups>
LDAPUserGroupMap[]
LDAPUserGroupMap[group1]=ezgroup1
LDAPUserGroupMap[group2]=ezgroup2
LDAPUserGroupMap[group3]=ezgroup3

# Default group (if group mapping fails)
LDAPUserGroupType=name
LDAPUserGroup[]=Members

# if 'enabled' you can move LDAP users to a different group and they will not
# be automatically moved back (to the group they are configured to be placed in)
# when the user logs in again.
KeepGroupAssignment=disabled