Silva users and LDAP

[Richard H.]

Having manually created a new LDAPUsersFolder (acl_users) in the test instance of Zope, we are now experiencing some odd behaviour.

I have a Silva Simple User account already in existence in 'Members' (rhewison) which was created by David Sparkes a while ago. It allows me to login to any of the Silva instances on arana (formerly on kumo). I used this account to login to Silva and get LDAP working. I then looked up David Sparkes (via LDAP) in Silva and then assigned him the Manager role.

Unfortunately, we have noticed a few things so far regarding David's Silva account. He is unable to lookup any users via LDAP in Silva (using the 'access' tab and searching for users to add to the clipboard). It always returns an empty search result. The only account he is able to lookup is his own!

If I lookup users (using my Silva Simple User account) then I am able to look up other users, assign them roles etc (as I originally did with David's account). However, we have also noticed that whenever it returns a search result, the users in that result are added to the acl_users folder in Zope even though we might not have done anything with those accounts (i.e. not assigned them any roles). Is this how it is meant to behave?

[Richard H. (richard-hewison)]

Sorry, the last paragraph should have read 'the users in that result are added to the 'members' folder in Zope' (NOT the acl_users folder)

[Richard H. (richard-hewison)]

I think this might possibly be related to incorrect credentials entered when configuring LDAP for use with Silva (via acl_users). Can someone confirm what Zope roles are expected of the credentials entered for Manager DN, or is this nothing to do with the problem? (For what it's worth, Elisabeth has exactly the same issues - she can't lookup any users in Silva even though she is a Silva manager).

[Richard H. (richard-hewison)]

For whatever reason, users added to Silva via LDAP are not allowed to search for other users (via LDAP) in the usual Silva way (via the access tab) for assigning roles, even if the user performing the search has been give the 'Manager' role. David can login to Silva via LDAP but cannot get search results. If David logs in as 'admin' then he can.

Can someone please look at this as is this another 'show stopper' for LDAP enabled Silva?

[Martijn Faassen (faassen)]

I will mail you the INSTALL.txt file of the LDAP integration.

[Richard H. (richard-hewison)]

Thanks. Is this file going to be sitting somewhere on arana already?

>>> On 21/09/2007 at 13:53, Martijn Faassen <email address hidden> wrote:
> I will mail you the INSTALL.txt file of the LDAP integration.
>
> --
> Silva users and LDAP
> https://bugs.launchpad.net/bugs/139339
> You received this bug notification because you are a direct subscriber
> of the bug.

[Martijn Faassen (faassen)]

I just did some experimenting and I think the problem is resolved. Summary, in LDAP User Folder set 'Manager DN Usage' to 'Always'.

[Martijn Faassen (faassen)]

On 9/21/07, Richard H. <email address hidden> wrote:
> Thanks. Is this file going to be sitting somewhere on arana already?

There is an INSTALL.txt in SilvaBedfordshireLDAP which is in the
products directory.
I relealized when looking at it is that it is out of date. I will update it.

[Martijn Faassen (faassen)]

That is, I will update this file in our version control system so we
can at least reference ourselves. On your server we would need to
install the new version first to update the INSTALL.txt. :)

[Kit Blake (kitblake)]

This is fixed, just setting importance.