mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-06 09:09:38 +03:00
[PR #2288] [CLOSED] Added console command to sync with ldap server #5975
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📋 Pull Request Information
Original PR: https://github.com/BookStackApp/BookStack/pull/2288
Author: @injektion
Created: 9/29/2020
Status: ❌ Closed
Base:
master← Head:syncldap-command📝 Commits (6)
1a2a217Added bookstack:syncldap console command so can pre-populate users and groups from LDAP serverc67f7effixed the LdapSessionGuard exception and cleaned up SyncLdap command to make phpunit and codeclimate happierdfff8fefixed recursion bug when recursing nested groupsa99df98added informational log messages for syncsf20c861added command line argument to override filter variable for custom imports and scripting the commanda159de5added ability to exclude emails from import using comma seperated string list config variable env.LDAP_SYNC_EXCLUDE_EMAIL📊 Changes
5 files changed (+238 additions, -1 deletions)
View changed files
📝
app/Auth/Access/Guards/LdapSessionGuard.php(+5 -1)📝
app/Auth/Access/LdapService.php(+25 -0)📝
app/Config/auth.php(+5 -0)📝
app/Config/services.php(+3 -0)➕
app/Console/Commands/SyncLdap.php(+200 -0)📄 Description
Current behaviour:
When LDAP enabled, if a user tries to log in and isn't found, credentials are checked and user is imported.
Issue:
We require users to be populated from the LDAP server before they visit the site the first time. Also want option to prevent users from being auto registered if we'd prefer to use the LdapSync.
As example, if you're using any sort of SSO or Server/Header authentication, the user won't exist for an auto login check, and will have to click Login before being logged into their account. Very confusing for users who expect to just be auto logged into their own account.
Fix:
Use this console command to trigger a sync with an LDAP filter (LDAP_SYNC_USER_FILTER) that will pull in users and sync groups prior to the login request.
Changes:
Added and stuck most of the logic in /app/Console/Commands/SyncLdap.php command
Added two config variables in config/services.php -> LDAP which default to current behaviours of the app
'sync_user_filter' => env('LDAP_SYNC_USER_FILTER', false),
'sync_user_recursive_groups' => env('LDAP_SYNC_USER_RECURSIVE_GROUPS', true),
Added public function to app/Auth/Access/LdapService.php to getAllUsers() by filter [defaults to sync_user_filter]
Added an option to disable auto registering members when using LDAP (config/auth/auto-register = TRUE) which stops the createNewFromLdapAndCreds call in /app/Auth/Access/Guards/LdapSessionGuard.php
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.