Re: [phpldapadmin] Fwd: [ phpldapadmin-Feature Requests-2073323 ] Using Single Sign On authentication

Hi,

I send a mail here because comments are closed on feature #2073323.

I get the latest source code (git clone) and tried to use the proxy
authentication mode.

Here is my config:

$servers->setValue('login','auth_type','proxy');
$servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');
$servers->setValue('login','bind_pass','secret');

I push the user DN in the "Auth-User" HTTP header. I don't know how to
tell PLA to get this value in this header. Need som doc ;)

Thanks,

Clément.

Le 21 décembre 2008 00:07, Clément OUDOT<[email protected]> a écrit :
> Thanks for the job. We will wait for the new authentication code!
>
> Clément.
>
> 2008/12/20 Deon George <[email protected]>:
>> OK, i've been playing with this this weekend, and it seems a little
>> easier than first thought.
>>
>> Basically after logging into the ldap server (after ldap_bind), we call:
>>
>> In the simplest case:
>> $ctrl = array("oid" => "2.16.840.1.113730.3.4.18", "value" => "dn:
>> cn=Lisa Simpson,ou=People,o=Simpsons", "iscritical" => true);
>> ldap_set_option($resource, LDAP_OPT_SERVER_CONTROLS, array($ctrl));
>>
>> And then the connection assumes the role of the dn in the value field...
>>
>> A more complicated option would use "u: uid" as the value, but that
>> would then rely on the ldap server config to transpose it into a valid DN.
>>
>> So, that leaves it upto the tool to pass the 3 attributes to PLA:
>> uid, uid's password, su uid.
>>
>> Then:
>> * PLA should transpose uid and su uid into a DN, if they are not already,
>> * connect and bind with uid's DN and uid's password
>> * su to su's DN
>>
>> In the simplest way, this could probably be passed to PLA as PHP server
>> variables, or in as POST variables in a form.
>>
>> For the next release of PLA, I want to re-work the login/authentication
>> - its very complicated and messy at the moment, so once I've worked
>> through that, it should be very easy to enable a proxied authentication
>> access method as well...
>>
>> ...deon
>>
>> Clément OUDOT wrote:
>>> We have to try to set controls like that :
>>>
>>> And to study how use the specific Authorization Proxy Control. It is
>>> cleary more difficult thant the first case :)
>>>
>>
>> ------------------------------------------------------------------------------
>> ______________________________________
>> phpLDAPadmin development mailing list.
>> To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
>> http://phpldapadmin.sourceforge.net/
>>
>

------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge  
This is your chance to win up to $100,000 in prizes! For a limited time, 
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize  
details at: http://p.sf.net/sfu/Challenge
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/