eGW19 Retrieve user information from Active Directory when the user is automatically created or logged in

bzubi 2019-10-08 13:01:31 UTC #1

Hello,

just playing around customizing a fresh 19’er version… (need to get rid of an old 1.8)
i really appreciate the use of docker!

User authentification is against an AD, user profile is stored in SQL = working.
Any chance to retreive addidional user information (company, phone, etcetera) from the AD when the user is automatically created or logged in?

Regards, Thomas

Datenübernahme aus AD ins Adressbuch

RalfBecker 2019-10-09 08:26:40 UTC #2

Hi Thomas,

looking at the code only name, first name and email is added:

github.com

EGroupware/egroupware/blob/master/api/src/Auth/Ads.php#L108


			if (isset($allValues[0]['homedirectory']))
			{
				$GLOBALS['auto_create_acct']['homedirectory'] = $allValues[0]['homedirectory'][0];
			}
			if ($GLOBALS['egw_info']['server']['auto_create_acct'])
			{
				$GLOBALS['auto_create_acct']['account_id'] = Api\Accounts\Ads::sid2account_id($allValues[0]['objectsid'][0]);


				// create a global array with all availible info about that account
				foreach(array(
					'givenname' => 'firstname',
					'sn'        => 'lastname',
					'mail'      => 'email',
				) as $ldap_name => $acct_name)
				{
					$GLOBALS['auto_create_acct'][$acct_name] =
						Api\Translation::convert($allValues[0][$ldap_name][0],'utf-8');
				}
				//error_log(__METHOD__."() \$GLOBALS[auto_create_acct]=".array2string($GLOBALS['auto_create_acct']));
				return True;
			}

Querying more is easy, thought the account object does not store the contact information, so you would need to make more changes to store also contact information:

github.com

EGroupware/egroupware/blob/master/api/src/Accounts.php#L1138


			if($owner_column)
			{
				$owner_columns[$appname] = $owner_column;
			}
		}


		return $owner_columns;
	}


	/**
	 * Add an account for an authenticated user
	 *
	 * Expiration date and primary group are read from the system configuration.
	 *
	 * @param string $account_lid
	 * @param string $passwd
	 * @param array $GLOBALS['auto_create_acct'] values for 'firstname', 'lastname', 'email' and 'primary_group'
	 * @return int|boolean account_id or false on error
	 */
	function auto_add($account_lid, $passwd)
	{

At the end of that function you could fetch the contact data of the new user and store it in the addressbook. You could also add an own app and use the “addaccount” hook to do so without the need to modify EGroupware sources.

Ralf

bzubi 2019-10-09 12:53:47 UTC #3

Hi Ralf,
thanks a lot, now i know where to start.
Does that sound like a FeatureRequest for later versions?

Thomas

RalfBecker 2019-10-09 13:27:01 UTC #4

Wie normally use AD not just for authentication, but use the full accounts and group information from AD.

Ralf

bzubi 2020-08-11 07:40:46 UTC #5

took my time building the app

current user ID, as well as the AD server data from the GLOBALS.
Query for existing user data from the AD with PHP-LDAP queries, then prepare the data according to eGW templates.
fetched the current contact with Api\Contacts\Storage -> read(user_id)
both arrays are merged and saved again.

This should be checked every time the user logs in, which brings me to the “hooks”.
Do I see correctly that there is only one hook for the login -> ‘addaccount’?
Which existing app should I use as a guideline for the integration of hooks?

Thomas

RalfBecker 2020-08-11 08:54:39 UTC #6

If you want all data from AD for a given user, why not just read the users (and groups!) from AD.

Then you don’t need to run the merge every time, but you need to migrate EGroupware internal, nummerical account_id’s to the RID (last part of SID) of AD. That’s a standard process we did many times for customers, there is also a script for that:

github.com

EGroupware/egroupware/blob/master/doc/ad-migration.sh

#!/bin/bash
#
# Usage: ./ad-migration.sh < user.csv | bash
#
# STDIN is csv with: <account_lid>,<account_id>,<AD-user>,<SID>,<RID>
#
# <account_id> has to be negative number for groups (eg. -123 for account_id=123)!
#
# Following command should be used as startpoint for the list:
# mysql -B -e "select account_lid,CASE account_type WHEN 'u' THEN account_id ELSE -account_id END,account_lid FROM egw_accounts ORDER BY account_type!='u',account_lid" egroupware | sed 's/  /,/g'
# Change <AD-user> if not equal to <account_lid> and append ,,<RID> to each line.
#
# If migration to LDAP instead of AD use uidNumber (gidNumber for groups) as <RID>.
# <SID> is NOT used and can be empty.
#
# Change following 2 lines to an EGroupware user with admin rights and his password
#
ADMIN=sysop
PASSWD=PW

This file has been truncated. show original

If, for whatever reason, you want to sync your AD user on login with the SQL database, instead of just using AD, you app could create a session_created hook, to do so.

Ralf