HOWTO integrate ldapuserfolder and ldapgroupuserfolder

From Chaos

This article is part of the HOWTO series.

Contents 1 Summary 2 Installation Procedure 2.1 Server Setup 3 Administration Procedure 3.1 Delete a user 3.2 Add a user 3.3 Change a users role (group)

Summary

This how-to implies that you already have an LDAP server setup, with the appropriate schema and any other external information you m ay need (Manager DN, etc). This is by no means a 'difinitive guide' on how to setup Plone / Zope LDAP Authentication. I wrote most o f this down from memory. If something you do breaks your site because this how-to said to do it, it is not Kyle Mott's, or Gadoz Inc orporated's fault; you take full responsibility for your own actions.

Installation Procedure

1. Download the current versions of python-ldap, LDAPUserFolder, and GroupUserFolder.
2. Unpack python-ldap somewhere on the system.
3. Unpack LDAPUserFolder and GroupUserFolder to the desired instances' Products folder.
4. Change into the directory of python-ldap.
5. Run the following: /Applications/Plone2/Tools/pysetup <instancename> (Where <instancename> is the instance you have previously installed LDAPUserFolder and GroupUserFolder to).
6. Re-start your plone instance.
7. Login to your ZMI as admin.
8. Browse to your Plone Instance.
9. Click on 'acl_users'.
10. Click on the 'Sources' tab.
11. Add a new source, selecting 'LDAPUserFolder' from the drop-down box.
12. Input the various information for your specific server setup. Our settings are below.
13. Click 'Add'.
14. Click on 'LDAPUserFolder', and double check your settings.
15. Click on the 'LDAP Schema' tab.
16. Select 'sn' and click 'Delete'.
17. Go back to /<instancename>/acl_users/.
18. Click on Sources.
19. Next to Groups source, select from the drop-down box 'LDAPGroupFolder'. Select 'Im sure'.
20. Click 'Ok'.
21. It should ask you where the default LDAPUserFolder is. It should be correct, so just click 'Ok'.
22. Go back to /<instancename>/acl_users/.
23. Click on the 'Sources' tab.
24. Click on 'LDAPUserFolder'.
25. Click on the 'Groups' tab.
26. Add Groups based on the standard plone roles (Manager, Member, Reviewer) with Object class of 'groupOfNames'.
27. Add a Group mapping for each one, e.g., Map LDAP Group Manager => to Zope Role Manager.
28. Go back to /<instancehome>/acl_users/.
29. Click on the 'Sources' tab.
30. Select the old 'User Folder' and Delete it. WARNING: THIS WILL DELETE ALL CURRENTLY REGISTERED USERS!!!!!!!!!!!!
31. You should be done!

To verify, go to the main portal's site, and try to register a new user. It should insert a new record into the LDAP database with t he appropriate information. I have also put below some simple steps to follow to manage your LDAP users through the ZMI.

Server Setup

LDAP Server is 'localhost'.
Login Name Attribute, User ID Attribute, and RDN Attribute are all 'uid'.
Users Base DN is 'cn=cerium-users, dc=gadoz, dc=com'.
Group storage is set to 'Groups stored on LDAP server'.
Groups Base DN is 'cn=cerium-groups, dc=gadoz, dc=com'.
Manager DN is 'uid=somelogin, cn=users, dc=domain, dc=tld'.
User object classes is 'top,person,inetOrgPerson'.
User password encryption is 'SHA'.
Default User Roles is 'Member'.

Administration Procedure

Delete a user

1. Login to the ZMI.
2. Browse to <instancehome>.
3. Click on 'acl_users' folder.
4. Click on 'Users' tab.
5. If the name(s) do not show up, force an update by clicking on 'Clicking here'.
6. Select the user, and press Delete.

Add a user

1. Login to the ZMI.
2. Browse to <instancehome>.
3. Click on 'acl_users' folder.
4. Click on 'Users' tab.
5. If the name(s) do not show up, force an update by clicking on 'Clicking here'.
6. Fill out 'Create users:' as the login you want the person to have.
7. Fill out 'Default password:' as the password you want the person to have.
8. Select their 'Affect roles' for the role(s) you want them to have.
9. Click 'Create'.

Change a users role (group)

1. Login to the ZMI.
2. Browse to <instancehome>.
3. Click on 'acl_users' folder.
4. Click on 'Users' tab.
5. If the name(s) do not show up, force an update by clicking on 'Clicking here'.
6. Select the user(s) role you wish to change.
7. Select or Deselect their 'Affect roles'.
8. Click 'Change'.