Changes between Version 4 and Version 5 of LdapSupport

Timestamp:

Oct 18, 2014, 1:52:27 PM (10 years ago)

Author:

davea

Comment:

--

LdapSupport

@@ -1 +1 @@
 = LDAP support =
 
-Goal: a BOINC project (e.g. nanoHUB) can let users authenticate
-(in both Web and Manager) using an LDAP server,
-using their LDAP UID and password.
+A BOINC project can let users authenticate (in both Web and Manager) using LDAP.
 Specifically:
 
- * The web create-account form has an "authenticate with LDAP" link,
-   which goes to an LDAP-specific form that asks for uid and passwd.
- * Similar for login form.
- * In BOINC Manager Attach Project wizard, if
+ * The web login form lets users enter an LDAP ID instead of an email address.
+ * Similarly in the Manager Attach Project wizard (works only with 7.4.5+ clients).
 
-== Model ==
-An account on a BOINC project can optionally have an "external authorizer" (EA), described by
- * authorizer type: e.g. LDAP, !OpenAuth
- * authorizer URL
- * authorizer account ID
+To enable this, add the following to your '''html/project/project.inc''':
+{{{
+define("LDAP_HOST", "ldap1.ssl.berkeley.edu");
+define("LDAP_BASE_DN", "dc=ssl,dc=berkeley,dc=edu");
+}}}
+(with values reflecting your LDAP server).
 
-Projects can support one or more EAs; this is exported in get_project_config.php.
+== Implementation ==
 
-If a user creates an EA account, they shouldn't be aware of a separate BOINC account.
+For accounts authenticated with LDAP,
+the '''user.email_addr''' database field has a string of the form
+'''LDAP:uid''' where uid is the LDAP user ID.
 
-if an account has an EA, user can remove it, after which they have to login with password.
 
-if an account doesn't have an EA, user can add it.
-
-== Web login ==
-{{{
-    login form has "log in with LDAP" link
-    handler:
-        authorize account w/ LDAP server
-        get back email, ID
-        if acct w/ that email exists
-            if authorizer info matches, OK
-            else show error
-                "a PROJECT account with that email address exists,
-                but isn't configured to log in with LDAP.
-                Please log in using email and PROJECT password."
-        else
-            create account
-        if
-}}}
-
-== Client attach ==
-{{{
-   current:
-      do either lookup_account or create_account w/ email, passwd
-      create account as needed
-   new:
-      GUI, attach form:
-         "login with LDAP" checkbox
-         LDAP name, password fields
-}}}
-