Comments on: Group Support Planning

By: Roberta

Roberta — Wed, 02 Jun 2010 13:47:21 +0000

We absolutely need this. Drupal has it, by the way, in the “LDAP Integration module” http://drupal.org/project/ldap_integration which is in PHP and is open source, if you wanted to investigate the code.

By: Damien Tougas

Damien Tougas — Tue, 09 Feb 2010 18:51:50 +0000

One reason to hook roles to LDAP attributes is that one might want to be able to control access based on something like a department name. In our LDAP directory things like departments and user types (i.e. faculty/staff/student) are stored as attributes, not groups.

By: Nasir

Nasir — Mon, 28 Sep 2009 18:52:04 +0000

any progress on this yet ?

By: Aaron Axelsen

Aaron Axelsen — Fri, 31 Jul 2009 13:39:26 +0000

No – these are not working yet

By: danielle

danielle — Fri, 31 Jul 2009 10:38:18 +0000

hello,
these features are already working?

By: Aaron Axelsen

Aaron Axelsen — Thu, 09 Jul 2009 12:05:23 +0000

@Ben Forchhammer

My goal is to have any updating happen on user login – i’ll probably stay away from wp_cron for this.

By: Aaron Axelsen

Aaron Axelsen — Thu, 09 Jul 2009 12:04:28 +0000

@Jim Willeke For alot of people (myself included) it's not going to be practical to add attributes to the ldap server for such things. Are you interested in this functionality?

By: Ben Forchhammer

Ben Forchhammer — Thu, 09 Jul 2009 09:52:53 +0000

This sounds good.

I don’t know much about LDAP Groups but what I think might be really useful for us is to be able to automatically add new users to certain blogs (and maybe even BuddyPress groups) depending on their LDAP Group.

I understand the “Automatic Updating” as a kind of synchronisation feature (is that what you mean?); it would be really cool if WordPress could automatically synchronise itself with the LDAP user groups (and automatically add new users to groups and also remove old users).

Technically the WordPress Cron might be a good place to put the automatic synchronisation bit (see function wp_schedule_event()), and of course the state for a user would also have to be “checked” whenever a user logs in. WP_Cron is build so it does not affect frontend performance directly (as long as the server can cope) and is e.g. used for the twice-daily update checks at the moment.

By: Jim Willeke

Jim Willeke — Thu, 09 Jul 2009 09:03:19 +0000

Why not an attribute on the user entry in LDAP rather than a group?
Although I do not know anything about your architecture, Perhaps something on the user like:

Attribute Name: Attribute Value
blogLoginDN: cn=blog1

blogCreate cn=blog2

For denied, why not attributes on the blog entry:

Attribute Name: Attribute Value:
deny uid=jwilleke,ou=users,dc=somewhere,dc=com

Generally, Groups are bad from a performance standpoint.

Just my two cents.
-jim