Allow authentication and not only authorize

[ceso]

Hi, first of all, sorry is something is strange, english is a foreign language for me.

I open this, because I'd like to request an update for this module, the thing that will be good, is that this module allow authenticate and not only authorize, I say this because, if the user isn't defined under contacts in a .cfg file, login fails against ldap, so I need define the user in two places, so define two times the same contact, in this way the benefits for using ldap is loss.

Thanks a lot!

Regards!

[jplorier]

Hi,

Let me rephrase what my college said. We are planning to use IPA server for both authentication and authorization, but this LDAP plugin is only doing the authorization. The user must be created in shinken and LDAP is used only to authorize that user. We'd like to avoid defining the user in shinken because this is a duplicate effort.
Maybe this can be accomplished via sssd so it also can use both cache and high availability (for ldap servers).
Maybe we are missing something, in that case, please let us know where to look.
Regards

[thifranc]

I just stumbled upon the same pb you had to fix in shinken-monitoring/mod-webui#539
and indeed, it's rather unusual and counter-intuitive to duplicate LDAP-contacts when you set up an LDAP-authentification.
While waiting for a new implementation or a refactor of this auth, it'd be good to update doc regarding to that maybe, then I'd be glad to do either :

1. updating the docs
2. helping refactoring the LDAP-auth module

[maethor]

@thifranc this is not a mod-auth-active-directory problem, nor a mod-webui problem. This is due to the architecture of Shinken, and how the WebUI gets objects (hosts, services, contacts, etc.) from the Shinken core. So no fix seems possible to me.

So updating the docs seems fine to me. I'll be happy to integrate any pull request.

Thanks.