How to import LDAP group memberships?

Paul_Coray 2006-08-28 16:55:30 UTC #1

Hi all

I have to deploy an Egroupware server for our ~200 users. They are
stored in an OpenLDAP database and organized into groups (of course).

During my tests I realize that EGW does not reflect group memberships of
my LDAP groups, neither if I import the groups in the
LDAP-useradministration, logged in as setup-admin, nor adding

objectClass: phpgwAccount
phpgwAccountType: g
phpgwAccountExpires: -1

into the LDAP-group entry.

As far as I can see, EGW stores group membership in MySQL, in the table
’egw_acl’:

acl_appname = ‘phpgw_group’, acl_location = ‘-[GID]’, acl_account
= [UID], acl_rights = 1

Now, how could I batch import all existing group memberships from LDAP?
I really need to avoid having to assign manually group memberships to
each one of my 200 users…
The only way I see is to write a script, extracting group memberships
from LDAP and inserting the right entries to ‘egw_acl’ in MySQL.
Somebody did this before and could share? But still all changes in LDAP
would have to be amended in manually the MySQL EGW-database…

Somebody please shed some light.

Thanks + regards
Paul

–
Paul Coray
Administrator Server und Netzwerk

Oeffentliche Bibliothek der Universitaet Basel
EDV-Abteilung
Schoenbeinstrasse 18-20
CH-4056 Basel

Tel: +41 61 267 05 13
Fax: +41 61 267 31 03

mailto:paul.coray@unibas.ch
http://www.ub.unibas.ch

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

ralfbecker_dr 2006-08-28 19:23:08 UTC #2

Hi Paul,

I suggest to use the development version, which stores group-memberships
direct in LDAP as posixGroup (and groupOfNames for ACL purpose).

Ralf

Paul Coray schrieb:

Hi all

I have to deploy an Egroupware server for our ~200 users. They are
stored in an OpenLDAP database and organized into groups (of course).

During my tests I realize that EGW does not reflect group memberships of
my LDAP groups, neither if I import the groups in the
LDAP-useradministration, logged in as setup-admin, nor adding

objectClass: phpgwAccount
phpgwAccountType: g
phpgwAccountExpires: -1

into the LDAP-group entry.

As far as I can see, EGW stores group membership in MySQL, in the table
’egw_acl’:

acl_appname = ‘phpgw_group’, acl_location = ‘-[GID]’, acl_account
= [UID], acl_rights = 1

Now, how could I batch import all existing group memberships from LDAP?
I really need to avoid having to assign manually group memberships to
each one of my 200 users…
The only way I see is to write a script, extracting group memberships
from LDAP and inserting the right entries to ‘egw_acl’ in MySQL.
Somebody did this before and could share? But still all changes in LDAP
would have to be amended in manually the MySQL EGW-database…

Somebody please shed some light.

Thanks + regards
Paul

–
eGroupWare Training & Support ==> http://www.egroupware-support.de
1.2 Release Offer: 250Euro for a Standard Update or Installation
including 1h Telefonsupport und ein gedrucktes deutsches Handbuch

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Paul_Coray 2006-08-29 09:10:19 UTC #3

Hi Ralf,

Do you mean, the development version would dynamically reflect all
existing memberships as well as changes in the LDAP groups? I know that
even the stable 1.2 version EGW indeed does update group memberships by
adding the corresponding memberUid to the LDAP group, when a user is
assigned to a group within EGW.

Paul

Ralf wrote:

Hi Paul

I suggest to use the development version, which stores group-memberships
direct in LDAP as posixGroup (and groupOfNames for ACL purpose).

Ralf

Paul Coray schrieb:

Hi all

I have to deploy an Egroupware server for our ~200 users. They are
stored in an OpenLDAP database and organized into groups (of course).

During my tests I realize that EGW does not reflect group
memberships of

my LDAP groups, neither if I import the groups in the
LDAP-useradministration, logged in as setup-admin, nor adding

objectClass: phpgwAccount
phpgwAccountType: g
phpgwAccountExpires: -1

into the LDAP-group entry.

As far as I can see, EGW stores group membership in MySQL, in the table
’egw_acl’:

acl_appname = ‘phpgw_group’, acl_location = ‘-[GID]’, acl_account
= [UID], acl_rights = 1

Now, how could I batch import all existing group memberships from LDAP?
I really need to avoid having to assign manually group memberships to
each one of my 200 users…
The only way I see is to write a script, extracting group memberships
from LDAP and inserting the right entries to ‘egw_acl’ in MySQL.
Somebody did this before and could share? But still all changes in LDAP
would have to be amended in manually the MySQL EGW-database…

Somebody please shed some light.

Thanks + regards
Paul

–
Paul Coray
Administrator Server und Netzwerk

Oeffentliche Bibliothek der Universitaet Basel
EDV-Abteilung
Schoenbeinstrasse 18-20
CH-4056 Basel

Tel: +41 61 267 05 13
Fax: +41 61 267 31 03

mailto:paul.coray@unibas.ch
http://www.ub.unibas.ch

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

ralfbecker_dr 2006-08-29 09:47:47 UTC #4

Hi Paul,

as I said, the development version stores the group membership in LDAP,
NOT longer in the acl-table in SQL. There for you can assign group
memberships outside of eGW - thought the user needs to newly log in to
see it, as that stuff cat’s cached in the session.

Ralf

Paul Coray schrieb:

Hi Ralf,

Do you mean, the development version would dynamically reflect all
existing memberships as well as changes in the LDAP groups? I know that
even the stable 1.2 version EGW indeed does update group memberships by
adding the corresponding memberUid to the LDAP group, when a user is
assigned to a group within EGW.

Paul

Ralf wrote:

Hi Paul

I suggest to use the development version, which stores group-memberships
direct in LDAP as posixGroup (and groupOfNames for ACL purpose).

Ralf

Paul Coray schrieb:

Hi all

I have to deploy an Egroupware server for our ~200 users. They are
stored in an OpenLDAP database and organized into groups (of course).

During my tests I realize that EGW does not reflect group
memberships of

my LDAP groups, neither if I import the groups in the
LDAP-useradministration, logged in as setup-admin, nor adding

objectClass: phpgwAccount
phpgwAccountType: g
phpgwAccountExpires: -1

into the LDAP-group entry.

As far as I can see, EGW stores group membership in MySQL, in the table
’egw_acl’:

acl_appname = ‘phpgw_group’, acl_location = ‘-[GID]’, acl_account
= [UID], acl_rights = 1

Now, how could I batch import all existing group memberships from LDAP?
I really need to avoid having to assign manually group memberships to
each one of my 200 users…
The only way I see is to write a script, extracting group memberships
from LDAP and inserting the right entries to ‘egw_acl’ in MySQL.
Somebody did this before and could share? But still all changes in LDAP
would have to be amended in manually the MySQL EGW-database…

Somebody please shed some light.

Thanks + regards
Paul

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users