matomo-org / matomo-org/plugin-LoginLdap
REMOTE_USER auth prevents SuperAdmin access
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 37
- Forks
- 30
- Avg merge
- 22h 53m
- Merged PRs (30d)
- 19
Description
With REMOTE_USER/Kerberos auth enabled there's no way to log in as the SuperAdmin account. You can't assign the SuperAdmin role to LDAP authenticated users, and there's no way to log in with non-LDAP accounts when REMOTE _USER auth is enabled. Clicking the logout button has no effect, since the web auth just re-authenticates you. I suppose if you were running your own LDAP server you could create an 'admin' user, but I'm in an enterprise Active Directory environment.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the plugin's REMOTE_USER/Kerberos authentication flow and the logout handling described in the issue. Determine how LDAP-authenticated and non-LDAP accounts are selected, then define a supported path for SuperAdmin access and verify that logout does not immediately re-authenticate the same web user.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100