I think that I have talked about this before here, but I am needing to figure it out again.
I have a few LDAP Bridge assets with LDAP users underneath. I need to give read access to all the LDAP users under those bridges, so I linked all the bridges under a normal User Group, then gave that group the read permissions. Well, this didn't seem to work when trying to view that page as an LDAP user.
Any ideas for how to make this work?
The LDAP Bridge asset is not a user group and so permissions ignore it. So you can't do what you are after. You need those LDAP users to be directly inside an LDAP Group or a User Group asset.
[quote]
The LDAP Bridge asset is not a user group and so permissions ignore it. So you can't do what you are after. You need those LDAP users to be directly inside an LDAP Group or a User Group asset.
[/quote]
Ok, that is fine. I do have LDAP groups that I just added permissions for, but I seem to remember that those need to be set up in a certain way as well (currently the groups are under a LDAP Bridge). Currently it seems like I am still not getting permissions to the page even when using LDAP groups.
If you've assigned permissions to an LDAP group and the users in it are not getting permissions, then it might be an LDAP Bridge configuration problem. Possibly something to do with the Group Membership attribute not containing the full DN of the groups a user is in.
[quote]
If you've assigned permissions to an LDAP group and the users in it are not getting permissions, then it might be an LDAP Bridge configuration problem. Possibly something to do with the Group Membership attribute not containing the full DN of the groups a user is in.
[/quote]
Do you mean on the Attribute Setup screen? I just have the group membership attribute set as "ou", but it used to be set as "memberof", but neither seem to work.
Any other ideas?
[quote]
Any other ideas?
[/quote]
Not from me, sorry. Would need to debug and find out what groups the user thinks they are in.
[quote]
Would need to debug and find out what groups the user thinks they are in.
[/quote]
I am fine debugging it, but where would I start?
Thanks Greg.
This is what happens:
- Matrix checks permission on the user asset
- User asset will grab its parents(user groups) to be checked too. (core/assets/users/user/user.inc getGroups())
- Shadow asset like ldap user will forward the getParent() call to bridge asset. ( asset_manager.inc getParents() line 3895)
- Ldap bridge getParents() is called to return the parents of the ldap user.
So the ldap bridge asset getParents() is where you should start your debugging.
packages/ldap/ldap_bridge/ldap_bridge.inc line 640
It is supposed to search ldap entry and return you the correct ldap group id.
note that, user.inc getGroups() will only get the group once, and then it caches the parents info to the SESSION, so probably you need to comment out some code to make sure it grabs parents every time when checking permission.
p.s
a backtrace for calling ldap bridge getParents()
0 => "function getParents(line=3895 class=asset_manager object=LDAP_Bridge)",
1 => "function getParents(line=797 class=user object=Asset_Manager)",
2 => "function getGroups(line=2539 class=mysource object=User)",
3 => "function getUserPrefs(line=1243 class=mysource object=MySource)",
4 => "function setupUser(line=402 class=mysource object=MySource)",
5 => "function init(line=263 class=init object=MySource)",
6 => "function require_once(line=28 file=index.php)"
[quote]
This is what happens:
- Matrix checks permission on the user asset
- User asset will grab its parents(user groups) to be checked too. (core/assets/users/user/user.inc getGroups())
- Shadow asset like ldap user will forward the getParent() call to bridge asset. ( asset_manager.inc getParents() line 3895)
- Ldap bridge getParents() is called to return the parents of the ldap user.
So the ldap bridge asset getParents() is where you should start your debugging.
packages/ldap/ldap_bridge/ldap_bridge.inc line 640
It is supposed to search ldap entry and return you the correct ldap group id.
note that, user.inc getGroups() will only get the group once, and then it caches the parents info to the SESSION, so probably you need to comment out some code to make sure it grabs parents every time when checking permission.
p.s
a backtrace for calling ldap bridge getParents()
0 => "function getParents(line=3895 class=asset_manager object=LDAP_Bridge)",
1 => "function getParents(line=797 class=user object=Asset_Manager)",
2 => "function getGroups(line=2539 class=mysource object=User)",
3 => "function getUserPrefs(line=1243 class=mysource object=MySource)",
4 => "function setupUser(line=402 class=mysource object=MySource)",
5 => "function init(line=263 class=init object=MySource)",
6 => "function require_once(line=28 file=index.php)"
[/quote]
Ok, so I am looking through the code. What kind of information am I needing to get from my debugging? If it has a parent?
Does someone have an example of their LDAP Bridge configuration which is working with LDAP groups and giving them permissions? I really need to figure this out.
[quote]
Ok, so I am looking through the code. What kind of information am I needing to get from my debugging? If it has a parent?
[/quote]
Yes, you should be able to log dump all the groups returned from getGroups() (which should return all) or the getParents() under LDAP bridge (for the parents the bridge should return) and the group that has permission should be in those results.
[quote]
Yes, you should be able to log dump all the groups returned from getGroups() (which should return all) or the getParents() under LDAP bridge (for the parents the bridge should return) and the group that has permission should be in those results.
[/quote]
Ok, so I logged the getParents() groups as I tried to login with my LDAP user, from which the LDAP user group has been given permissions to the page I am trying to login to see. Here is the log:
(
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:09] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:09] Array
Raw Entry: (
Raw Entry: [19909:CN=Staff,OU=Groups,DC=puc,DC=edu] => ldap_user_group
Raw Entry: [19909:OU=Staff,DC=puc,DC=edu] => ldap_user_group
Raw Entry: [214] => user_group
Raw Entry: [27404] => user_group
Raw Entry: [33460] => user_group
Raw Entry: [53308] => user_group
Raw Entry: [59301] => user_group
Raw Entry: [75118] => user_group
Raw Entry: [75586] => user_group
Raw Entry: [75933] => user_group
Raw Entry: [76953] => user_group
Raw Entry: [80703] => user_group
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:10] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:11] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:12] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:14] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:15] Array
Raw Entry: (
Raw Entry: [72070] => user_group
Raw Entry: [11] => system_user_group
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:15] Array
Raw Entry: (
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:17] Array
Raw Entry: (
Raw Entry: [72070] => user_group
Raw Entry: [11] => system_user_group
Raw Entry: )
Raw Entry: [06-Apr-2011 16:42:19] Array
Raw Entry: (
Raw Entry: [72070] => user_group
Raw Entry: [11] => system_user_group
Raw Entry: )Any idea what this is telling me?
I don't see my LDAP Usergroup ID in this list.
Raw Entry: [06-Apr-2011 16:42:09] Array
Raw Entry: (
Raw Entry: )
No groups found
Raw Entry: [06-Apr-2011 16:42:09] Array
Raw Entry: (
Raw Entry: [19909:CN=Staff,OU=Groups,DC=puc,DC=edu] => ldap_user_group
Raw Entry: [19909:OU=Staff,DC=puc,DC=edu] => ldap_user_group
Raw Entry: [214] => user_group
Raw Entry: [27404] => user_group
Raw Entry: [33460] => user_group
Raw Entry: [53308] => user_group
Raw Entry: [59301] => user_group
Raw Entry: [75118] => user_group
Raw Entry: [75586] => user_group
Raw Entry: [75933] => user_group
Raw Entry: [76953] => user_group
Raw Entry: [80703] => user_group
Raw Entry: )
The user here belongs to: 2 ldap groups (from the same bridge #19909) and the normal user groups: 214,27404, 33460, 53308, 59301 etc.
Raw Entry: [06-Apr-2011 16:42:15] Array
Raw Entry: (
Raw Entry: [72070] => user_group
Raw Entry: [11] => system_user_group
Raw Entry: )
This user is a System Administrator or Root user.
From the snippet, I cannot tell which LDAP bridge is returning what.
From the code, it looks like it can return empty arrays when it cannot make a connection to the ldap bridge or it finds no matches. You could possibly try, in the LDAP bridge, to log dump the results of:
- $result = $ldap->search($assetid,'(objectClass=*)', NULL, TRUE, TRUE, array_merge(array_values($attrs), Array('objectclass')));[*]$data = $ldap->getEntries($result);
Hope that helps!
Ok, here is what I got from running those:
[quote]
$result = $ldap->search($assetid,'(objectClass=*)', NULL, TRUE, TRUE, array_merge(array_values($attrs), Array('objectclass')));
[/quote]
[07-Apr-2011 12:02:52] Resource id #80
[quote]
$ldap->getEntries($result);
[/quote]
Raw Entry: [07-Apr-2011 12:05:30] Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Array
Raw Entry: (
Raw Entry: [objectclass] => Array
Raw Entry: (
Raw Entry: [count] => 4
Raw Entry: [0] => top
Raw Entry: [1] => person
Raw Entry: [2] => organizationalPerson
Raw Entry: [3] => user
Raw Entry: )
Raw Entry: [0] => objectclass
Raw Entry: [cn] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Nic Hubbard [nnhubbard]
Raw Entry: )
Raw Entry: [1] => cn
Raw Entry: [sn] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Hubbard
Raw Entry: )
Raw Entry: [2] => sn
Raw Entry: [description] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Public Relations
Raw Entry: )
Raw Entry: [3] => description
Raw Entry: [givenname] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Nicholas
Raw Entry: )
Raw Entry: [4] => givenname
Raw Entry: [distinguishedname] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => CN=Nic Hubbard [nnhubbard],OU=Staff,DC=puc,DC=edu
Raw Entry: )
Raw Entry: [5] => distinguishedname
Raw Entry: [instancetype] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 4
Raw Entry: )
Raw Entry: [6] => instancetype
Raw Entry: [whencreated] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 20031105235749.0Z
Raw Entry: )
Raw Entry: [7] => whencreated
Raw Entry: [whenchanged] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 20110407190251.0Z
Raw Entry: )
Raw Entry: [8] => whenchanged
Raw Entry: [displayname] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Nic Hubbard
Raw Entry: )
Raw Entry: [9] => displayname
Raw Entry: [usncreated] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 38208
Raw Entry: )
Raw Entry: [10] => usncreated
Raw Entry: [memberof] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => CN=Staff,OU=Groups,DC=puc,DC=edu
Raw Entry: )
Raw Entry: [11] => memberof
Raw Entry: [usnchanged] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 37077314
Raw Entry: )
Raw Entry: [12] => usnchanged
Raw Entry: [extensionattribute1] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 19800725
Raw Entry: )
Raw Entry: [13] => extensionattribute1
Raw Entry: [extensionattribute4] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => SH
Raw Entry: )
Raw Entry: [14] => extensionattribute4
Raw Entry: [employeenumber] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => my-number
Raw Entry: )
Raw Entry: [15] => employeenumber
Raw Entry: [name] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => Nic Hubbard [nnhubbard]
Raw Entry: )
Raw Entry: [16] => name
Raw Entry: [objectguid] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => ����6N���fk�+
Raw Entry: )
Raw Entry: [17] => objectguid
Raw Entry: [useraccountcontrol] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 66048
Raw Entry: )
Raw Entry: [18] => useraccountcontrol
Raw Entry: [badpwdcount] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 0
Raw Entry: )
Raw Entry: [19] => badpwdcount
Raw Entry: [codepage] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 0
Raw Entry: )
Raw Entry: [20] => codepage
Raw Entry: [countrycode] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 0
Raw Entry: )
Raw Entry: [21] => countrycode
Raw Entry: [employeeid] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 01555555
Raw Entry: )
Raw Entry: [22] => employeeid
Raw Entry: [badpasswordtime] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 129388928066060467
Raw Entry: )
Raw Entry: [23] => badpasswordtime
Raw Entry: [lastlogon] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 129388928093398967
Raw Entry: )
Raw Entry: [24] => lastlogon
Raw Entry: [pwdlastset] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 128031530793747544
Raw Entry: )
Raw Entry: [25] => pwdlastset
Raw Entry: [primarygroupid] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] => 513
Raw Entry: )
Raw Entry: [26] => primarygroupid
Raw Entry: [objectsid] => Array
Raw Entry: (
Raw Entry: [count] => 1
Raw Entry: [0] =>
Hi Nic,
Is it anything like whats is described on bug #5050 LDAP users not getting correct permissions if the user is under sub group ?
Ash
[quote]
Hi Nic,
Is it anything like whats is described on bug #5050 LDAP users not getting correct permissions if the user is under sub group ?
Ash
[/quote]
Well, similar I think. My setup is like:
LDAP Bridge
|-- LDAP User Group #1
|-- LDAP User Group #2
|-- LDAP User Group #3
|----LDAP User <— This is the user that I need to get permissions to.
So, I have given LDAP User Group #3 read permissions to a page, and I still am not able to view that page after trying to login, it says I don’t have permissions. Do you think this is the same bug?
[quote]
Well, similar I think. My setup is like:
LDAP Bridge
|-- LDAP User Group #1
|-- LDAP User Group #2
|-- LDAP User Group #3
|----LDAP User <— This is the user that I need to get permissions to.
So, I have given LDAP User Group #3 read permissions to a page, and I still am not able to view that page after trying to login, it says I don't have permissions. Do you think this is the same bug?
[/quote]
Yes this is something i have come across too. Not too sure if it is the same piece of code that is affecting it but will be looking into too…
Will keep this Post updated. Thanks for all your input.
Regards,
Ash
[quote]
Well, similar I think. My setup is like:
LDAP Bridge
|-- LDAP User Group #1
|-- LDAP User Group #2
|-- LDAP User Group #3
|----LDAP User <— This is the user that I need to get permissions to.
So, I have given LDAP User Group #3 read permissions to a page, and I still am not able to view that page after trying to login, it says I don't have permissions. Do you think this is the same bug?
[/quote]
Testing on Matrix version 4.0.5 and greater, the above scenario works correctly.
My attribute setup is:
Group Membership ou
Group Members o
Group Name ou
In fact I fixed bug 5050 where the LDAP User under a sub LDAP group can get access when giving read access to the top level LDAP group!!
[quote]
Testing on Matrix version 4.0.5 and greater, the above scenario works correctly.
My attribute setup is:
Group Membership ou
Group Members o
Group Name ou
In fact I fixed bug 5050 where the LDAP User under a sub LDAP group can get access when giving read access to the top level LDAP group!!
[/quote]
Here is my attribute setup, is it wrong?
User Attributes
User Id samaccountname
Common Name cn
First Name givenname
Last Name sn
Email Address mail
Group Attributes
Group Membership memberof
Group Members member
Group Name ou
[quote]
Here is my attribute setup, is it wrong?
User Attributes
User Id samaccountname
Common Name cn
First Name givenname
Last Name sn
Email Address mail
Group Attributes
Group Membership memberof
Group Members member
Group Name ou[/quote]
Looks like you are using Active Directory. Currently Labs have been testing and debugging on an Open LDAP. Hang in there while we get access and debug a system using Active Directory.
Thanks