| Subject: | Catalyst::Authentication::Store::LDAP - statically configure roles |
| Date: | Tue, 4 May 2010 21:12:32 +0200 |
| To: | Peter Karman <karman [...] cpan.org> |
| From: | Jochen Lutz <jlu [...] akk.org> |
Hello.
For a Catalyst project which authenticates against an LDAP server whose
groups I can't influence (and admin won't adjust), I implemented stati-
cally configurable roles.
I would be happy if you would include my patch in the upstream source.
The patch is version 1.008.
Sincerely
Jochen
--- LDAP.pm.orig 2010-05-04 20:05:32.000000000 +0200
+++ LDAP.pm 2010-05-04 21:10:35.000000000 +0200
@@ -41,28 +41,33 @@
password_type => "self_check",
},
store => {
- binddn => "anonymous",
- bindpw => "dontcarehow",
- class => "LDAP",
- ldap_server => "ldap.yourcompany.com",
- ldap_server_options => { timeout => 30 },
- role_basedn =>
"ou=groups,ou=OxObjects,dc=yourcompany,dc=com",
- role_field => "uid",
- role_filter => "(&(objectClass=posixGroup)
(memberUid=%s))",
- role_scope => "one",
- role_search_options => { deref => "always" },
- role_value => "dn",
- role_search_as_user => 0,
- start_tls => 1,
- start_tls_options => { verify => "none" },
- entry_class => "MyApp::LDAP::Entry",
- use_roles => 1,
- user_basedn =>
"ou=people,dc=yourcompany,dc=com",
- user_field => "uid",
- user_filter => "(&(objectClass=posixAccount)
(uid=%s))",
- user_scope => "one",
- user_search_options => { deref => "always" },
- user_results_filter => sub { return shift->pop_entry },
+ binddn => "anonymous",
+ bindpw => "dontcarehow",
+ class => "LDAP",
+ ldap_server => "ldap.yourcompany.com",
+ ldap_server_options => { timeout => 30 },
+ role_basedn =>
"ou=groups,ou=OxObjects,dc=yourcompany,dc=com",
+ role_field => "uid",
+ role_filter => "(&(objectClass=posixGroup)
(memberUid=%s))",
+ role_scope => "one",
+ role_search_options => { deref => "always" },
+ role_value => "dn",
+ role_search_as_user => 0,
+ start_tls => 1,
+ start_tls_options => { verify => "none" },
+ entry_class => "MyApp::LDAP::Entry",
+ use_roles => 1,
+ user_basedn =>
"ou=people,dc=yourcompany,dc=com",
+ user_field => "uid",
+ user_filter => "(&(objectClass=posixAccount)
(uid=%s))",
+ user_scope => "one",
+ user_search_options => { deref => "always" },
+ user_results_filter => sub { return shift->pop_entry },
+ static_roles_map => {
+ 'dn1' => [ 'role1', 'role3', 'role4' ],
+ 'dn2' => [ 'role2', 'role3' ],
+ },
+ static_roles_default => [ 'role1', 'role2' ],
},
},
},
@@ -147,6 +152,10 @@
role_value: dn
role_search_options:
deref: always
+ static_roles_default: [ 'role1', 'role2' ],
+ static_roles_map: {
+ 'dn1' => [ 'role1', 'role3', 'role4' ],
+ 'dn2' => [ 'role2', 'role3' ],
B<NOTE:> The settings above reflect the default values for
OpenLDAP. If you
@@ -258,7 +267,8 @@
=head2 use_roles
Whether or not to enable role lookups. It defaults to true; set it
to 0 if
-you want to always avoid role lookups.
+you want to always avoid role lookups. Set it to 'static' if you
want to enable
+static role configuration
=head2 role_basedn
@@ -319,6 +329,16 @@
The name of the class of user object returned. By default, this is
L<Catalyst::Authentication::Store::LDAP::User>.
+=head2 static_roles_map
+
+A hashref containing the roles for LDAP users. Use the dn
(distinguished name)
+as key.
+
+=head2 static_roles_default
+
+When static roles is enabled this specifies the list of groups a
user gets if
+no configuration for him is set.
+
=head1 METHODS
=head2 new
--- LDAP/Backend.pm.orig 2010-04-03 04:56:34.000000000 +0200
+++ LDAP/Backend.pm 2010-05-04 21:10:43.000000000 +0200
@@ -49,6 +49,11 @@
'deref' => 'always',
},
'role_search_as_user' => 0,
+ 'static_roles_map' => {
+ 'dn1' => [ 'role1', 'role3', 'role4' ],
+ 'dn2' => [ 'role2', 'role3' ],
+ },
+ 'static_roles_default' => [ 'role1', 'role2' ],
);
our $users = Catalyst::Authentication::Store::LDAP::Backend->new
(\%config);
@@ -87,6 +92,7 @@
role_filter role_scope role_field role_value
role_search_options start_tls start_tls_options
user_results_filter user_class role_search_as_user
+ static_roles_default static_roles_map
)
);
}
@@ -372,6 +378,16 @@
sub lookup_roles {
my ( $self, $userobj, $ldap ) = @_;
+ if ( $self->use_roles =~ /^static$/i ) {
+ my $user = $userobj->ldap_entry->dn;
+
+ if ( exists $self->static_roles_map->{$user} ) {
+ return $self->static_roles_map->{$user};
+ }
+ else {
+ return $self->static_roles_default;
+ }
+ }
if ( $self->use_roles == 0 || $self->use_roles =~ /^false$/i ) {
return undef;
}