nicolas escribió:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
nicolas escribió:
Hello !
I’m working for a french university which is interested about using
egroupware. I want to add more options like CAS authentication, or
using LDAP in read-only mode (no LDAP modification is allowed).
I’m trying to add this options, and I want to ask if someone will
be
interested about that.
If I understand correctly, that is implemented since long ago in egw.
The difference is to use SQL as storage method instead of LDAP in
/setup, and LDAP as auth method.
Regards.
[/quote]
Sorry if i didn’'t explain very well.
In fact, I use CAS (SSO) as auth method. The goal of this is to
integrate egroupware with others applications using the same
authentication.
About the storage, egw looks at LDAP to get information about
accounts, but store them into SQL. There are a lot of applications
which use the same LDAP, so we don’t want to change entries. And we
don’t need necessary the LDAP password if we only read LDAP entries
(for security, I think it’s better to not store this password,
encrypted or not).
Where are the passwords then stored? If they’re in LDAP, then what you
need is to use LDAP as storage instead of SQL. In my experience, if you
want to see the user data correctly, apart from making sure you have the
phpgwAccount objectclass for every user, define the givenName and
displayName attributes. Of course, you say you don’t have write access,
but I don’t find any security risk in having self enabled for changes,
what means that every user, if authenticated, can change update data.
Anyway, there should be no problem in storing passwords in SQL, since
they’re encrypted, and the admin (I guess you are the admin), if is
worried for that, can restrict the db (even the egw_accounts table) to
be readable only by the db user specified in egw setup.
Regards.
----------------------------------------------------------------------|
http://counter.li.org info: Linux user: 92390 - Linux machine: 39301 |
Oscar Manuel Gómez Senovilla - omgsATescomposlinux.org |
GPG Key at http://pgp.escomposlinux.org |
----------------------------------------------------------------------|
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers
