Re: [phpldapadmin] Fwd: [ phpldapadmin-Feature Requests-2073323 ] Using Single Sign On authentication

OK, i've been playing with this this weekend, and it seems a little
easier than first thought.

Basically after logging into the ldap server (after ldap_bind), we call:

In the simplest case:
$ctrl = array("oid" => "2.16.840.1.113730.3.4.18", "value" => "dn:
cn=Lisa Simpson,ou=People,o=Simpsons", "iscritical" => true);
ldap_set_option($resource, LDAP_OPT_SERVER_CONTROLS, array($ctrl));

And then the connection assumes the role of the dn in the value field...

A more complicated option would use "u: uid" as the value, but that
would then rely on the ldap server config to transpose it into a valid DN.

So, that leaves it upto the tool to pass the 3 attributes to PLA:
uid, uid's password, su uid.

Then:
* PLA should transpose uid and su uid into a DN, if they are not already,
* connect and bind with uid's DN and uid's password
* su to su's DN

In the simplest way, this could probably be passed to PLA as PHP server
variables, or in as POST variables in a form.

For the next release of PLA, I want to re-work the login/authentication
- its very complicated and messy at the moment, so once I've worked
through that, it should be very easy to enable a proxied authentication
access method as well...

...deon

Clément OUDOT wrote:
> We have to try to set controls like that :
>
> And to study how use the specific Authorization Proxy Control. It is
> cleary more difficult thant the first case :)
>   

------------------------------------------------------------------------------
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/