17 Aug
2005
17 Aug
'05
9:04 p.m.
Hi Shawn,
I think this is more appropriate in the developers list, even if I'm
sure admins of xwiki's are interested in LDAP features.
I'm also copying Alex who wrote the LDAP authentication plugin.
Unfortunately he is on holidays so he won't be able to answer right away.
I know he was thinking at a 'scripting' solution for groups management.
Basically the idea would have been that you could directly call a group
something like
LDAPmygroup
LDAPdept_htv
The groovy script would then automatically translate the group name to
the right query to make.. With LDAPmygroup maybe there would not even be
a script needed as it would use normal ldap group.. But for LDAPdept_htv
it would look for users having the htv property in the dept field.
The script could also decide that if there is not LDAP in the name then
it's a local xwiki group which would be allowed if a specific option is
available in the preferences..
Now it might not be necessary to have scripting but would give more
flexibility. I think Alex had some use cases where scripting would be
really usefull. But it would be great to have him answer that..
If you can help writing this part this would be really great.
Ludovic
lauzon(a)us.ibm.com wrote:
Hi all. I have a need to determine group membership
based on criteria defined outside xwiki, and wondering if anyone has done this, or can at
least suggest a direction.
We have criteria for groups defined in LDAP, such things as your department or things
like that. I would like to be able to say that for a specific space, only people in
so-and-so department are allowed in. However department should be only one criteria; in
general I want to use an LDAP search the queries on an arbitrary set of attributes. In
addition we have something called "Bluegroups", in which you can define a group
name and then specify the members through either picking members individually, or again
through an LDAP search.
To do this, my idea was that the user would manually create an XWiki group, and then as a
member give something like "ldap:(dept=HTV)", or maybe "bluegroups:Support
team". Even better would be the ability to put a value such as this in the Access
Rights, under group, but I don't think things are setup that way. Anyway, looking at
the API, it seems like I need to implement listGroupsForUser(), which is difficult because
the group members are not stored in the db. I'm left with querying all the members
which begin with "ldap:" or "bluegroups:", determing which the user is
a member of via an LDAP call, and then returning them. I could cache these, but since
I'm not going to get notifications of group membership changes, I would need to
invalidate the cache once a day or something like that.
Does this seem like the most reasonable way of doing things? Or is there something that
would make my life really easy and wonderful? Thanks in advance ...
shawn.
------------------------------------------------------------------------
--
You receive this message as a subscriber of the xwiki-users(a)objectweb.org mailing list.
To unsubscribe: mailto:xwiki-users-unsubscribe@objectweb.org
For general help: mailto:sympa@objectweb.org?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws
--
Ludovic Dubost
XPertNet: http://www.xpertnet.fr/
Blog: http://www.ludovic.org/blog/
XWiki: http://www.xwiki.com
Skype: ldubost AIM: nvludo Yahoo: ludovic