Hi Shawn, I think this is more appropriate in the developers list, even if I'm sure admins of xwiki's are interested in LDAP features. I'm also copying Alex who wrote the LDAP authentication plugin. Unfortunately he is on holidays so he won't be able to answer right away. I know he was thinking at a 'scripting' solution for groups management. Basically the idea would have been that you could directly call a group something like LDAPmygroup LDAPdept_htv The groovy script would then automatically translate the group name to the right query to make.. With LDAPmygroup maybe there would not even be a script needed as it would use normal ldap group.. But for LDAPdept_htv it would look for users having the htv property in the dept field. The script could also decide that if there is not LDAP in the name then it's a local xwiki group which would be allowed if a specific option is available in the preferences.. Now it might not be necessary to have scripting but would give more flexibility. I think Alex had some use cases where scripting would be really usefull. But it would be great to have him answer that.. If you can help writing this part this would be really great. Ludovic [email protected] wrote:
Hi all. I have a need to determine group membership based on criteria defined outside xwiki, and wondering if anyone has done this, or can at least suggest a direction.
We have criteria for groups defined in LDAP, such things as your department or things like that. I would like to be able to say that for a specific space, only people in so-and-so department are allowed in. However department should be only one criteria; in general I want to use an LDAP search the queries on an arbitrary set of attributes. In addition we have something called "Bluegroups", in which you can define a group name and then specify the members through either picking members individually, or again through an LDAP search.
To do this, my idea was that the user would manually create an XWiki group, and then as a member give something like "ldap:(dept=HTV)", or maybe "bluegroups:Support team". Even better would be the ability to put a value such as this in the Access Rights, under group, but I don't think things are setup that way. Anyway, looking at the API, it seems like I need to implement listGroupsForUser(), which is difficult because the group members are not stored in the db. I'm left with querying all the members which begin with "ldap:" or "bluegroups:", determing which the user is a member of via an LDAP call, and then returning them. I could cache these, but since I'm not going to get notifications of group membership changes, I would need to invalidate the cache once a day or something like that.
Does this seem like the most reasonable way of doing things? Or is there something that would make my life really easy and wonderful? Thanks in advance ...
shawn.
------------------------------------------------------------------------
-- You receive this message as a subscriber of the [email protected] mailing list. To unsubscribe: mailto:[email protected] For general help: mailto:[email protected]?subject=help ObjectWeb mailing lists service home page: http://www.objectweb.org/wws
-- Ludovic Dubost XPertNet: http://www.xpertnet.fr/ Blog: http://www.ludovic.org/blog/ XWiki: http://www.xwiki.com Skype: ldubost AIM: nvludo Yahoo: ludovic