15 / 15
Jun 2021

I’m currently having issues with ldap while saving contacts.

$contacts = new Api\Contacts();
Basically, I’m using $contacts->save();

EGroupware\Api\Contacts\Ldap::save() 691 update of uid=test,ou=People,dc=test,dc=com failed errorcode 50 (Insufficient access)
ldapContact={“cn”:“test”,“givenname”:“test”,“sn”:“test”,“o”:“test”,“mail”:“test”,“displayname”:“test”,

EGroupware\Api\Contacts\Ldap::save() 682 ldap_rename of uid=test,ou=People,dc=test,dc=com to uid=test failed insufficient access

Egroupware version 20.1
PHp version 7.4
archive installation
maria db

  • created

    Jun '21
  • last reply

    Jun '21
  • 14

    replies

  • 1.8k

    views

  • 2

    users

  • 1

    like

Looks ok to me, you don’t want to rename/move the entry to that not existing dn.

Question is, did you set that changed dn, or just not passed it to save?

Ralf

I’m passing the following attributes in save

id
account_lid
account_id
owner = 0
fn
n_given
n_family
n_middle
adr_two_street
adr_two_locality
adr_two_postalcode
adr_two_region
tel_home
org_name
cat_id
access = public
email

Is there any example to illustrate best way of saving the contact by passing right parameters

Api\Contacts::save() expects the whole contact, like it was returned by Api\Contacts::read(), obviously with the intended modifications.

Changing the dn in LDAP is complicated:

  • dn is like a path and a given LDAP server has a base-dn / start-point where it can write
  • writing outside the base-dn is never supported
  • some LDAP don’t allow to change / move the dn at all (you need to delete and receate)
  • you need rights for the old AND new location

Your base-dn is dc=test,dc=com so the above can never work!

Ralf

okay, what do you suggest I should do to get rid of this exception since it’s not modifying the contacts

Hmm, not sure I understand. It does not modify the contact, even if you specify the unchanged dn?

Ralf

Can you give me an example of how to specify the the unchanged dn.
My base dn -> dc=test,dc=com

$entry[‘dn’] =

The dn is from the contact you read before, just don’t modify it. E.g. place it into eT2 preserv array.

Or are you trying to create new contacts?

Ralf

I’m saving a new contact and also modifying existing contacts programmatic ally.

This could probably be another thing, but I wanted to check what $contact->read() returns to know the convention of setting the dn while saving or modifying
After fetching a contact id from the addressbook table for testing, I tried using the $contact->read(), this returned me null

Even if I’m saving the new contact, the dn is still the same

You need to use:

$contacts = new Api\Contacts();
$contact = $contacts->read($id);

For new contacts you have to set the owner attribute, as that determines in which addressbook the new contact get stored.

Anyway I have not used contacts in LDAP other then accounts in some time, as they are very inflexible as far as ACL is concerned.

On our short-term roadmap is making the public AD addressbook available in EGroupware as an additional addressbook (no ETA yet).

Ralf

Yes I’m using

$contacts = new Api\Contacts();
$contact = $contacts->read($id);

What should be the owner value for new contacts and existing contacts ?

I maybe wrong in my understanding, request you to clarify if needed just to join the dots
The user accounts we see in admin are just LDAP accounts and not contacts from addressbook table.
That is why no information is stored in accounts table in egroupware (LDAP)
Whereas for contact, we have data in egroupware addressbook table

The owner is the addressbook the contact should be in:

  • existing contacts, you don’t want to move into an other addressbook should be store with the same/unchanged owner
  • for personal addressbooks the users account_id is the owner of his personal addressbook
  • for group addressbooks the groups (negative!) account_id is the owner of the group addressbook

Ralf