LDAP Authentication extension

Guest · Posted: Wed Sep 17, 2003 4:39 pm Post subject: LDAP Authentication extension

I would like to have an LDAP user search account which finds the authenticating user's dn.
This is needed because users are not allways under the same branch (see below) in the directory so the dn is not fixed.
If this option is implemented then it will also require the ability to run an external script to add new users to LDAP.

Tree Eg.

ablyler · Joined: 19 Mar 2002 Posts: 40 Location: Marysville, PA

This is a great idea, I too have given this a great deal of thought.

I initially created the LDAP code for my company's Windows 2000 Active Directory. I knew that eventually I would need to scale to code to allow for users to restrict access on a LDAP container based level.

Maybe it would be beneficial to have authentication groups, where you can define what rights the group has and then you can link the group to a LDAP object and/or just add standard cacti user accounts.

I do realize that the current LDAP support is limited and will not work for everyone.

In any case this will take a lot more brain storming.

TheWitness · Posted: Sun Oct 05, 2003 6:31 am Post subject: >> LDAP Authentication <<

I suggest that you maintain lists of users locally and then associate each users with their respective directory or simply as a local user as you do now. Each user would be associated with pre-defined access levels.

As eluded to, user types would be local, active directory, or LDAP. Then each user type would would be authenticated using the appropriate method or api. Some consideration should be given to the potential that each user could be associated with different LDAP or AD directories. Therefore, there will have to be some association of ID's to their respective directory. For example, in my company our IT is performed by one supplier who have their own AD, while the customer maintains another AD. Both groups of users are likely required to access the system.

Keep in mind that it is more difficult in some corporate worlds to make changes in LDAP than it is to simply query one.

It's been a long time since I posted. It looks like the product is comming along well! I will be providing additional commentary in the near future. Peace!

Larry Adams