Issue while saving contacts

vishakha 2021-06-02 17:11:56 UTC #1

I’m currently having issues with ldap while saving contacts.

$contacts = new Api\Contacts();
Basically, I’m using $contacts->save();

EGroupware\Api\Contacts\Ldap::save() 691 update of uid=test,ou=People,dc=test,dc=com failed errorcode 50 (Insufficient access)
ldapContact={“cn”:“test”,“givenname”:“test”,“sn”:“test”,“o”:“test”,“mail”:“test”,“displayname”:“test”,

EGroupware\Api\Contacts\Ldap::save() 682 ldap_rename of uid=test,ou=People,dc=test,dc=com to uid=test failed insufficient access

Egroupware version 20.1
PHp version 7.4
archive installation
maria db

RalfBecker 2021-06-02 17:59:34 UTC #2

Looks ok to me, you don’t want to rename/move the entry to that not existing dn.

Question is, did you set that changed dn, or just not passed it to save?

Ralf

vishakha 2021-06-02 18:16:21 UTC #3

I’m passing the following attributes in save

id
account_lid
account_id
owner = 0
fn
n_given
n_family
n_middle
adr_two_street
adr_two_locality
adr_two_postalcode
adr_two_region
tel_home
org_name
cat_id
access = public
email

vishakha 2021-06-03 14:17:33 UTC #4

Is it important to pass dn in save ?
Maybe that’s the reason for failed logs

RalfBecker 2021-06-03 14:59:34 UTC #5

If you want it saved and not an exception thrown

Ralf

vishakha 2021-06-03 15:31:03 UTC #7

Is there any example to illustrate best way of saving the contact by passing right parameters

RalfBecker 2021-06-04 07:20:45 UTC #8

Api\Contacts::save() expects the whole contact, like it was returned by Api\Contacts::read(), obviously with the intended modifications.

Changing the dn in LDAP is complicated:

dn is like a path and a given LDAP server has a base-dn / start-point where it can write
writing outside the base-dn is never supported
some LDAP don’t allow to change / move the dn at all (you need to delete and receate)
you need rights for the old AND new location

Your base-dn is dc=test,dc=com so the above can never work!

Ralf

vishakha 2021-06-04 17:42:41 UTC #9

okay, what do you suggest I should do to get rid of this exception since it’s not modifying the contacts

RalfBecker 2021-06-04 19:44:42 UTC #10

Hmm, not sure I understand. It does not modify the contact, even if you specify the unchanged dn?

Ralf

vishakha 2021-06-07 14:21:24 UTC #11

Can you give me an example of how to specify the the unchanged dn.
My base dn -> dc=test,dc=com

$entry[‘dn’] =

RalfBecker 2021-06-07 15:39:57 UTC #12

The dn is from the contact you read before, just don’t modify it. E.g. place it into eT2 preserv array.

Or are you trying to create new contacts?

Ralf

vishakha 2021-06-07 15:45:25 UTC #13

I’m saving a new contact and also modifying existing contacts programmatic ally.

This could probably be another thing, but I wanted to check what $contact->read() returns to know the convention of setting the dn while saving or modifying
After fetching a contact id from the addressbook table for testing, I tried using the $contact->read(), this returned me null

Even if I’m saving the new contact, the dn is still the same

RalfBecker 2021-06-07 18:24:05 UTC #14

You need to use:

$contacts = new Api\Contacts();
$contact = $contacts->read($id);

For new contacts you have to set the owner attribute, as that determines in which addressbook the new contact get stored.

Anyway I have not used contacts in LDAP other then accounts in some time, as they are very inflexible as far as ACL is concerned.

On our short-term roadmap is making the public AD addressbook available in EGroupware as an additional addressbook (no ETA yet).

Ralf

vishakha 2021-06-07 18:55:44 UTC #15

Yes I’m using

$contacts = new Api\Contacts();
$contact = $contacts->read($id);

What should be the owner value for new contacts and existing contacts ?

I maybe wrong in my understanding, request you to clarify if needed just to join the dots
The user accounts we see in admin are just LDAP accounts and not contacts from addressbook table.
That is why no information is stored in accounts table in egroupware (LDAP)
Whereas for contact, we have data in egroupware addressbook table

RalfBecker 2021-06-07 19:10:20 UTC #16

The owner is the addressbook the contact should be in:

existing contacts, you don’t want to move into an other addressbook should be store with the same/unchanged owner
for personal addressbooks the users account_id is the owner of his personal addressbook
for group addressbooks the groups (negative!) account_id is the owner of the group addressbook

Ralf