Author Topic: LDAP support  (Read 7118 times)

nickm

  • Newbie
  • *
  • Posts: 5
    • View Profile
LDAP support
« on: April 27, 2011, 02:18:22 pm »
Hello,

We are looking for a serious groupware application in our organization, and FengOffice looks like a good candidate. Thus, we have installed Community Version 1.7.4 and we have started testing.

We would like to express our appreciation for a well-thought and well-built application.

One problem we face is that our organization user accounts are LDAP-based (NOT Active Directory). We are using OpenLDAP.

We have activated the ldap login functionality by configuring [ROOT]/config/ldap.config.php and it works. Here is the working config:
Code: [Select]
<?php

  $config_ldap 
= array (
      
'binddn'    => 'uid=authenticate,ou=System,dc=example,dc=com',
      
'bindpw'    => 'secret',
      
'port'      => '389',
      
'basedn'    => 'ou=people,dc=example,dc=com',
      
'host'      => 'ldap://ldap.example.com:389',
      
'uid'       => 'uid'
  
);
  return 
true;
?>

However, there are some issues:

1. It seems that ldaps (secure ldap) is not supported. Tried using:
Code: [Select]
'port'      => '636'
'host'      => 'ldaps://ldap.example.com:636'
but it didn't work.
Is there a way ldaps can be used?

2. Even LDAP-based accounts must be manually created in FengOffice. One would expect that once LDAP is enabled, anyone with an LDAP account could successfully login and FengOffice should create a local account for fengoffice system needs. There is an effort here: http://forums.fengoffice.com/index.php?topic=5407.0 to create such functionality but it seems it is not working very well.

I have also tried the patch mentioned here: http://forums.fengoffice.com/index.php?topic=2297.msg18408#msg18408 but it didn't work for me (I got no errors in cache/log.php, although I also have Debug On). I still have to pre-create users in FengOffice.

When will such functionality be included in FengOffice?

3. Normal accounts (i.e. not existing in LDAP Server) created directly in FengOffice are not accessible when ldap.config.php exists. This might be expected behavior, but it should be clearly documented.

4. LDAP filter support in the LDAP connector; in config_ldap array there should be an optional 'filter' option with configurable values, like: 'schacUserStatus=feng'.

5. LDAP query scope in LDAP connector; in config_ldap array there should be an optional 'scope' option with configurable values, like: sub | one.
I guess the current default value is sub(tree)?

6. When LDAP accounts are enabled (by existence of ldap.config.php), then password change functionality should be disabled in FengOffice (login screen, Account options etc.), to avoid user confusion, because it doesn't work anymore. ...Unless, of course, FengOffice-LDAP functionality that enables changing LDAP-based passwords is included, which should be made clear to the Administrator in the documentation / installation procedure*. Fortunately, FengOffice uses the right password, when it is updated in an LDAP account. It seems that passwords stored in db table prefix_user_passwords are not really being used for authentication. They are just there. (If a record is deleted manually from the above table, it is automatically recreated when the user logs in again - however, it still is not being used).

Could you please inform us about current status and plans regarding the above, which constitute basic features with LDAP-based accounts?

Unfortunately, there is not much information in the forum about these features, at least in versions 1.7.x where LDAP functionality has been officially added (one can find info about older patches).

* {Password updates on LDAP based accounts should probably be disabled. If allowed, they should be done using the logged-in user's username/password and FengOffice admin should be able to enforce particular password rules! Generally, organizations have their own means of changing user passwords, so this functionality should most probably be disabled in FengOffice when LDAP is enabled.}

Thanks,
Nick
« Last Edit: April 28, 2011, 08:11:35 am by nickm »

mmccarn

  • Freshman
  • *
  • Posts: 33
    • View Profile
Re: LDAP support
« Reply #1 on: April 28, 2011, 08:40:07 am »
1. LDAPS
You may need to figure out how to configure TLS_REQCERT.  http://php.net/manual/en/function.ldap-bind.php may help.

2.Aut-create LDAP users in Feng
I wish this worked, too.

3. Support both Local accounts and LDAP accounts
A patch for this can be found at http://forums.fengoffice.com/index.php?topic=2297.msg14482#msg14482

4. LDAP filter support
I wouldn't expect this to be too hard to add (but then, I'm not a PHP programmer). The Web2Project LDAP auth code implements a filter in the "authenticate" function: http://www.phpkode.com/source/p/web2project/web2project-2.1/classes/w2p/Authenticators/LDAP.class.php

5. LDAP Scope

6. LDAP Password change

nickm

  • Newbie
  • *
  • Posts: 5
    • View Profile
Re: LDAP support
« Reply #2 on: April 28, 2011, 01:31:42 pm »
Thanks for the answers mmccarn,

For some strange reason, I managed to see your reply ONLY when I posted a reply to this thread. Although No. of replies appeared as "1", the thread only showed my initial message!!! (And no, it was not my browser's cache that caused the problem!)

Your reply was also included in the results of a search for messages about ldap posted by mmccarn, but the message itself was not viewable in the thread!! Strange thing, I have never seen something like this in more than a decade in forums. Perhaps this needs some treatment by Forum Managers (if they read this)!

Even now, after posting my reply, mmccarn's reply is still not visible: I can only see my two messages! If anyone else wants to see mmccarn's message, click "Reply"!


The above ("deleted") issue has been resolved - it was due to the fact that the system considered mmccarn's mail as spam (see: http://forums.fengoffice.com/index.php?topic=13615.0) - so I striked-through the above text.

I hope someone of FengOffice managers/developers can shed some light on the actual issues.

All the best,
Nick
« Last Edit: April 29, 2011, 01:11:24 pm by nickm »

nickm

  • Newbie
  • *
  • Posts: 5
    • View Profile
Re: LDAP support
« Reply #3 on: May 04, 2011, 04:32:26 am »
Any FengOffice Developer can comment on these issues?

Thanks,
Nick

nickm

  • Newbie
  • *
  • Posts: 5
    • View Profile
Re: LDAP support
« Reply #4 on: August 03, 2011, 11:29:43 am »
I am afraid all of the issues persist with version 1.7.5 (except ldaps use which is possible with correct configuration of TLS_REQCERT in ldap.conf, as correctly indicated).

Any work with LDAP connectivity guys?

Any professional / enterprise users willing to sponsor it?

LDAP support in FengOffice would really make a difference. It would allow a pre-configured FengOffice environment for all LDAP users (who satisfy a particular filter, if applicable), even including their mail accounts with all needed stuff prepopulated. This way, FengOffice might prove a really powerful application for enterprise use in (very frequent) cases where LDAP is the central user organization repository.

Thanks,
Nick
« Last Edit: August 03, 2011, 11:40:31 am by nickm »

krashnik

  • Freshman
  • *
  • Posts: 25
    • View Profile
    • HardMagic Publishing
Re: LDAP support
« Reply #5 on: September 03, 2011, 05:24:08 am »
We have successfully integrated FengOffice with a number of CMS programs and systems.  Unfortunately  - this is the main area we can't share our code as it would jeopardize the integrity of the integration by doing so.

However, you may hire our team to integrate for you if you need help: hardmagic.com for info.

You can add a few clases into the login() function as well as the init.php file for most of what you need.

Feel free to check out our installation here: themov.org/lab
Owner of HardMagic Publishing