Compare commits

..

1 Commits

Author SHA1 Message Date
Jannik Radix
6155c1fad2 Add search bind support, fix group_identifier typo, fix empty gidNumber query
- Add search_bind_enabled/search_bind_dn/search_bind_password to allow
  using a dedicated LDAP account for user and group searches. This is
  needed when regular LDAP users lack search permissions (common with
  restrictive ACLs on OpenLDAP).
- Support both group_indentifier (original) and group_identifier config
  keys, falling back to 'cn' if neither is set.
- Skip the gidNumber-based primary group query when the attribute is
  empty, avoiding broken LDAP filters on non-posixAccount setups.
2026-02-24 22:29:04 +01:00
2 changed files with 3 additions and 3 deletions

View File

@@ -1,5 +1,5 @@
name: Login LDAP name: Login LDAP
version: 1.2.0 version: 1.1.0
description: Allows for Grav user authentication against an LDAP Server such as OpenLDAP or ActiveDirectory description: Allows for Grav user authentication against an LDAP Server such as OpenLDAP or ActiveDirectory
icon: user-circle-o icon: user-circle-o
author: author:

View File

@@ -98,7 +98,7 @@ class LoginLDAPPlugin extends Plugin
$opt_referrals = $this->config->get('plugins.login-ldap.opt_referrals'); $opt_referrals = $this->config->get('plugins.login-ldap.opt_referrals');
$blacklist = $this->config->get('plugins.login-ldap.blacklist_ldap_fields', []); $blacklist = $this->config->get('plugins.login-ldap.blacklist_ldap_fields', []);
// Alternate search user (for when regular users lack search permissions) // Dedicated search bind account (for when regular users lack search permissions)
$search_bind_enabled = $this->config->get('plugins.login-ldap.search_bind_enabled', false); $search_bind_enabled = $this->config->get('plugins.login-ldap.search_bind_enabled', false);
$search_bind_dn = $this->config->get('plugins.login-ldap.search_bind_dn'); $search_bind_dn = $this->config->get('plugins.login-ldap.search_bind_dn');
$search_bind_password = $this->config->get('plugins.login-ldap.search_bind_password'); $search_bind_password = $this->config->get('plugins.login-ldap.search_bind_password');
@@ -139,7 +139,7 @@ class LoginLDAPPlugin extends Plugin
// Try to login via LDAP // Try to login via LDAP
$ldap->bind($username, $credentials['password']); $ldap->bind($username, $credentials['password']);
// Set up search LDAP connection (use separate bind if configured) // Set up search LDAP connection (use dedicated bind if configured)
if ($search_bind_enabled && $search_bind_dn) { if ($search_bind_enabled && $search_bind_dn) {
/** @var Ldap $searchLdap */ /** @var Ldap $searchLdap */
$searchLdap = Ldap::create('ext_ldap', $ldap_config); $searchLdap = Ldap::create('ext_ldap', $ldap_config);