matomo-org / matomo-org/plugin-LoginLdap
Group membership control with IBM Security Directory Server.
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 37
- Forks
- 30
- Avg merge
- 22h 53m
- Merged PRs (30d)
- 19
Description
Definition of a specific LDAP group for authenticating on Piwik using the LDAP plugin does not seem to work with IBM Security Directory Server (formerly known as IBM Tivoli Directory Server).
Indeed, as far as I know, in this LDAP server there is:
- no native "memberOf" attribute defined at the user level (on contrary to what exists in MS Active Directory, for instance)
- no overlay mechanism allowing to automatically provision such an attribute each time a user is added/removed to/from a group (on contrary to what is possible with OpenLDAP, for instance)
- a special "ibm-allGroups" user attribute which is computed dynamically (considering static, dynamic and nested groups) but this attribute CANNOT be used in an LDAP search filter
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are identified in the issue. First inspect the LDAP plugin's existing group-authentication handling and clarify the intended IBM Security Directory Server behavior and acceptance criteria; done means group-based authentication works with that server without relying on unsupported attributes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100