[Serusers] SER and LDAP

[Jan Janak]

I am no LDAP expert, but I would like to propose that we do group
membership checking in SER instead (in the configuration file).

other authentication modules (radius and database) make it possible to
load a set of name-value pairs during authentication. Those pairs will
be stored in AVPs (Attribute-Value pairs) in SER and SER has a variety
of functions to process them.

Thus we could have an attribute named "Group" which will contain all
groups the user belongs to. So, in my opinion, all that the LDAP
authentication module has to do is to verify the authenticity of the
user and return a set of attributes associated with the authententicated
user.

What do you think ? This way we can have group checking independent of
the authentication method. You could also store additional data
atttributes in LDAP that can be later used by SER, such as call forwarding
rules (call forward on busy, call forward on no answer, and so on).

  Jan.

On 10-11-2005 16:47, Arek Bekiersz wrote:
> Jan,
> 
> 
> As I said to Greger, there are many many changes that will have to be 
> made to the module. But as they will be going on parallel to my current 
> work, I hope I can correct them quickly. If I find time to actually DO 
> my current work.
> 
> Imagine group handling - I made a wrong design requirement, I've put 
> group membership inside every Ldap object. That is: if somebody is 
> member of some group, he has special attribute (let's say 'memberOf') 
> set to name of this group.
> 
> This is wrong, as proper approach is to have groupOfNames (or 
> groupOfUniqueNames) object and just put DN's of members into this. That 
> is for example how LDAP groups are used in Radius, when working with 
> LDAP backend...
> 
> 
> ... but according to Greger V.Teigre there is an issue with groupOfNames 
> (thanks Greger). Some LDAP servers do not have built-in functions for 
> efficiently checking group membership (i.e. OpenLDAP). We will have to 
> make sure that the future implementation of group check algorithm will 
> works across LDAP servers.
> 
> What is more, from my experience I know we could have schema violations 
> in some users when using empty 'groupOfNames' (without any 'member' 
> attribute value - like if group has no members :-) ). This attribute is
> mandatory according to various schemas. However it is perfectly possible 
> to enter empty value inside 'member' attribute'.
> 
> 
> So as you see plenty of work is to be done.
> 
> 
> --
> Arek
> 
> 
> Jan Janak wrote:
> >Great, I am looking forward to it and hopefuly we can get it to the main
> >tree soon.
> >
> >  Jan.