matomo-org / matomo-org/plugin-LoginLdap
User Access mapping using site names in multi-valued attribute instead of a string of site IDs
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 37
- Forks
- 30
- Avg merge
- 22h 53m
- Merged PRs (30d)
- 19
Description
The current method for user read-only/admin access mapping is very difficult to use since it involves translating a site name to a site ID and then making a string from the list of the IDs.
Why not instead: list the name of the site as multi-valued attribute, one site name per attribute instance?
So for example, if LDAP attribute "Url" is used for read-only access mapping and the user should have access to site1.com and site2.com, LDAP would look like:
Url: site1.com
Url: site2.com
With this method, giving/removing access to a user becomes a simple task of adding/removing site names in a multi-valued attribute. And it is very easy in Active Directory environment to list/add/remove site names from multi-valued attributes if choosing to use an attribute that ADUC supports.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Start by locating the existing read-only and admin access-mapping entry points, then trace how LDAP attributes are read and site access is resolved. Done means multi-valued attributes containing site names can grant and remove the corresponding access without requiring a string of site IDs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100