Cerb4 & LDAP

[djoos]

I saw there's some code in comment for LDAP authentication in the login.classes.php - does anyone know whether I'd be able to use it?

I've added my own implementation of an LDAP-login (with testing on the value of the password) - but: apparently DevblocksSession is not a know class (yet?)...

[CERBERUS CODE]
$session = DevblocksPlatform::getSessionService();
$visit = new DevblocksSession();
// [TODO]: Need to set real properties here
$visit->id = 1;
$visit->login = 'ldap_user';
$visit->admin = 1;
$session->visit = $visit;
$_SESSION['um_visit'] = $visit;
[/CERBERUS CODE]

Is there anyone who has got some more information about this issue? Thanks in advance!

[jstanden]

Hey there,

Dan had a working LDAP authentication plug-in going early in 4.0 development, but due to the constant evolution of the codebase (which kept breaking it) we just commented it out.

It's pretty trivial for us to get this going again now that things in 4.0 are pretty conceptually stable.

I've added a task on the project roadmap for this:
http://www.wgmdev.com/jira/browse/CHD-183

We can get this going for both helpdesk logins and customer authentication through the new ("soon-to-be-re-released") Support Center.

Thanks!

[djoos]

Originally Posted by jstanden

We can get this going for both helpdesk logins and customer authentication through the new ("soon-to-be-re-released") Support Center.

Is there any information available about the "soon-to-be-released"-time scale? Eg. within a month or within a couple of months?

Thanks in advance for the information!

[jstanden]

Hey there!

Regarding the core Support Center, I'm working to get it in Subversion and announced on the forums this afternoon (Pacific time).

As for "soon" and LDAP, I highly doubt it will take months for us to get to it. I posted our roadmap as a sticky topic on the "Concepts" forum. LDAP has a lower priority than a lot of those things, but it's also much quicker to develop (and something any developer here can do in tandem with the main development effort).

I've made it really easy to use alternate authenticators with the new Support Center.

Re-implementing LDAP should be an afternoon project, so when I get a few spare moments I'll do the groundwork for external authenticator plug-ins (e.g., LDAP, vBulletin) in the helpdesk and Support Center. From there it's pretty easy to hand off to anybody else over here.

Thanks!

[dptekco]

Can Cerberus staff please update us regarding the status of LDAP or any mechanism to do authentication with an external store?

ETA and details are appreciated.

Thanks!

[jstanden]

Hey there!

Dan@WGM wrote the code for LDAP already (for workers + Support Center).

I just need to use his LDAP server over here and do some simple refactoring so the Support Center can have pluggable authentication.

Cerb4 itself already can support pluggable authentication, we just need to hook it into the UI. We also need to decide what to do about the 'chicken and egg' of having no fixed 'superuser' account, but needing a way to allow you guys to still log in without LDAP.

The hard work is already done, we just need to find the time to wrap it up.

(The community hasn't been banging on the dev castle gates about it! )

[dptekco]

A little off topic but what the hell,

We have never implemented LDAP before. Can anyone point us a little blurp of how the LDAP back interface is implemented?

Is LDAP essentially Active Directory?

For external authentication, have you ever considered Cerberus simply calling an external script via https, passing the user input for username / password, where the called script simply return true/false? This seems lightweight and to the point!

[jstanden]

Originally Posted by dptekco

A little off topic but what the hell,
We have never implemented LDAP before. Can anyone point us a little blurp of how the LDAP back interface is implemented?

OpenLDAP is a popular opensource LDAP daemon:
http://www.openldap.org/
http://www.howtoforge.net/linux_ldap_authentication

Dan recommends this LDAP viewer:
http://www.jxplorer.org/

Is LDAP essentially Active Directory?

Yeah!

http://en.wikipedia.org/wiki/Ldap
http://en.wikipedia.org/wiki/Active_Directory

Active Directory (AD) is the Microsoft attempt at LDAP (insert various groaning noises here).

For external authentication, have you ever considered Cerberus simply calling an external script via https, passing the user input for username / password, where the called script simply return true/false? This seems lightweight and to the point!

We use plugins for authentication, but the general idea is the same. The plugins can do anything they want to authenticate, provided they link the current session to a worker. They either report they succeeded (true) or not (false).

They can check an external DB, LDAP, file, horoscope, whatever.

[nmorse]

Hey Jeff et al,

What's the possibility of an AD plugin/tie-in to pull info directly from Active Directory so individuals don't have to login/etc.?

-n

[Hildy]

With the final push for 4.0 underway, this has been bumped to 4.1, but you can still follow it at the JIRA link above.