LDAP adjustments for AD support and group membership discovery.

That "garbage" in the logs is pretty useful. It tells me that the code is not finding the correct config file. Can you verify that it's located at modules/ldap/config/identity.php ?

I wrote the LDAP module but I'm far from an LDAP expert so any guidance here is appreciated. If you can point me at the right PHP code to bind to your ldap, I can work that into the G3 module.
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

Ah, I bet I know what happened. We failed to properly do the LDAP install leaving your site in a weird state where the module isn't fully installed, but we've specified that it's active. So it's not looking in modules/ldap/config, but it's expecting there to be a $config["ldap"] in an identity.php file somewhere in the active module path. Let's see if we can verify that. Can you run this SQL statement? My sample output is included below

edit: I had a typo in the sql!

mysql> select * from modules where name = "ldap"; 
+----+--------+------+---------+
| id | active | name | version |
+----+--------+------+---------+
| 22 |      1 | ldap |       1 | 
+----+--------+------+---------+
1 row in set (0.00 sec)

If the active column is set to 0, try setting it to 1.

I just updated the LDAP module to allow you to specify a u/p to ldap_bind in http://github.com/gallery/gallery3-contrib/commit/9f7907f9cbc42cd457e9ccd196b200319dc70a55 -- see if that works for you.
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

I don't even see the LDAP module. I checked the box in the admin page and it went straight to the "Dang" error.

mysql> select * from modules;
+----+--------+-----------+---------+
| id | active | name | version |
+----+--------+-----------+---------+
| 1 | 1 | gallery | 30 |
| 3 | 1 | comment | 3 |
| 4 | 1 | organize | 1 |
| 5 | 1 | info | 1 |
| 6 | 1 | rest | 3 |
| 7 | 1 | rss | 1 |
| 8 | 1 | search | 1 |
| 9 | 1 | slideshow | 2 |
| 10 | 1 | tag | 2 |
+----+--------+-----------+---------+
9 rows in set (0.00 sec)

mysql>

I've made quite a bit of progress. I can confirm the bind user and password is functioning correctly. I've also made the required attribute changes to authenticate against Microsoft Active Directory. And can confirm successful authentication against AD.

I have a question about groups. In this function:

   190    static function groups_for($user) {                                                                                  
   191      if ($user->guest) {                                                                                                
   192        return $user->groups;                                                                                            
   193      }                                                                                                                  
   194                                                                                                                         
   195      $result = ldap_search(self::$_connection, self::$_params["group_domain"],                                          
   196                            "(memberUid=$user->name)");                                                                  
   197                                                                                                                         
   198      $associated_groups = self::$_params["groups"];                                                                     
   199      $groups = array();                                                                                                 
   200      for ($entry_id = ldap_first_entry(self::$_connection, $result);                                                    
   201           $entry_id != false;                                                                                           
   202           $entry_id = ldap_next_entry(self::$_connection, $entry_id)) {                                                 
   203        $group_id = ldap_get_values(self::$_connection, $entry_id, "gidNumber");                                         
   204        $group_name = ldap_get_values(self::$_connection, $entry_id, "cn");                                              
   205        if (in_array($group_name[0], $associated_groups)) {                                                              
   206          $groups[] = new Ldap_Group($group_id[0], $group_name[0]);                                                      
   207        }                                                                                                                
   208      }                                                                                                                  
   209      return $groups;                                                                                                    
   210    }                                                                                                                    

It appears you're only respecting the primary GID associated with the user object. I am able to provide this information in my AD environment via the RFC2307 POSIX attributes. However, the above function does not look at the actual group membership "memberof" attribute. Therefore, the only groups looked at are the ones in the "groups" array that match the user's primary GID. This means a user cannot be in the "registered users" group and another group at the same time.

Can you confirm, or clarify for me? I've been staring at Ldap.php for hours now I will post the changes I made to support AD as well if you would like. A simple flag can be set in identity.conf to enable AD support.

Thanks for any help you can provide.

-Brian

Here is what I've come up with. It seems to work well.

I've changed the way it handles group discovery as well.

Original code:

$result = ldap_search(self::$_connection, self::$_params["group_domain"],
                          "(memberUid=$user->name)");

For what I can tell, the above code grabs all groups in the baseDN and searchs for memberships. This doesn't scale when hundreds of thousands of groups exist at the DN. The query can take minutes.

Instead, I find the membership of the user by looking at the user object itself rather than dump all of the groups. The "memberOf" attribute tells us this. This all holds true for OpenLDAP as well. Each user object has attributes in which provides group membership information.

This is my major change. I've made other changes as well so you'll probably want to do a diff (on my attachments) to see what I've done. The below code snippet looks at the user object for its group membership, we stick the values into the "$group_membership_DNs" array just like you did, however, the memberOf value is a DN--it must be converted to a CN for Gallery3. The AD specific attribute is "samaccountname" rather than "uid". I can confirm the attribute differences between AD and OpenLDAP to clean up the code a bit. I'm going to move the attributes out of Ldap.php and into identity.php. I'd like to have parameters that can easily be set in identity.conf for all required attributes. This will be LDAP server agnostic and won't take much work at all (I'm sure you know that).

    $result = ldap_search(self::$_connection, self::$_params["group_basedn"],"(samaccountname=$user->name)");
    $associated_groups = self::$_params["groups"];
    $groups = array();
    for ($entry_id = ldap_first_entry(self::$_connection, $result);
         $entry_id != false;
         $entry_id = ldap_next_entry(self::$_connection, $entry_id)) {
         $group_membership_DNs = ldap_get_values(self::$_connection, $entry_id, "memberof");
      foreach ($group_membership_DNs as $group_to_convert) {
       $result = ldap_search(self::$_connection, self::$_params["group_basedn"],"(distinguishedname=$group_to_convert)");
         $entry_id = ldap_first_entry(self::$_connection, $result);
         $group_id = ldap_get_values(self::$_connection, $entry_id, "gidnumber");
         $group_name = ldap_get_values(self::$_connection, $entry_id, "samaccountname");
          if (in_array($group_name[0], $associated_groups)) {
           $groups[] = new Ldap_Group($group_id[0], $group_name[0]);
          }
       }
      return $groups;
    }

Here is my identity.conf:

$config["ldap"] = array(
  "driver"        => "ldap",
  "allow_updates" => false,
  "params"        => array(
    "groups" => array("4324_Gallery_Admins", "4234_Gallery_Everyone", "4234_Gallery_Registered_Users"),
    "everybody_group" => "4234_Gallery_Everyone",
    "registered_users_group" => "4234_Gallery_Registered_Users",
    "admins" => array("brianmiller"),
    "ldap_server" => "ldap://4234-addc1.phospher.com:3268",
    "group_basedn" => "dc=phospher,dc=com",
    "user_basedn" => "dc=phospher,dc=com",
    "bind_rdn" => "cn=ldapbind,ou=Service Accounts,ou=NWK,ou=US,ou=Americas,dc=phospher,dc=com",
    "bind_password" => "<sanitized password>"
  )
);

My Gallery3 site is on its way up! yay!

Let me know what you think.
.

-Brian

Ok, this looks awesome. The best way to proceed here would be if you could fork our contrib repo on Github and start editing your code such that we can just merge it back into the LDAP module. This would basically make you a developer on the LDAP module (which is warranted since you seem to know a whole lot more about it than I do!).

Basically, go to:
http://github.com/gallery/gallery3-contrib

Create an account on Github and make your own fork of gallery3-contrib, then commit your code changes back. I'll
Follow the instructions to get your own git clone. Then hack up the code as you see fit and commit your changes to your fork, and we'll merge them into the contrib repo. Then get a beer, and give yourself a pat on the back cause you'll be a Gallery developer!

As for a task to do the cleanup, I think that would be pretty easy. Take a look at modules/search/helpers/search_task.php for an example of how to write a simple maintenance task. We could have a task that just resyncs the groups -- I think all you have to do is look at the current groups and the ones in identity.php and generate "group_created" and "group_deleted" events as appropriate.

Let me know how it goes!
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

The bash code looks roughly right. Looking forward to seeing it in PHP!
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

@brianmiller: any progress?

@wadewell: You're following the right process, but it's hard to say what's going wrong. Can you let us know what's in your gallery3/var/logs logfiles?
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

@lkraav: unofficial modules are dangerous and your mileage will vary. Furthermore, when you switched to it there was a big warning message (http://gallery.menalto.com/node/97018#comment-349769) that should make you think twice. If you're unhappy with our design choices, propose some new ones and help us improve the product. Else, you get what you pay for.

In the meantime, I just pushed a fix to the contrib ldap module to get rid of the PHP Exception you're seeing.
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

Awesome, thanks lkraav!
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git