LDAP Authenticator custom uid field

lublak · July 10, 2024, 6:46am

I’m currently quite new here, so I’d like to say hello to everyone!

The LDAP Authenticator works perfectly: https://extensions.xwiki.org/xwiki/bin/view/Extension/LDAP/Authenticator/
According to the documentation, you can currently only set the UID attribute here: xwiki.authentication.ldap.UID_attr=cn.

In general, I would like to adjust this value in my setup.
Only the profile page is currently customisable here: xwiki.authentication.ldap.userPageName=${uid._lowerCase}.

I would like to be able to set the internal uid myself here too:
xwiki.authentication.ldap.UID_attr=${cn._lowerCase}
or
xwiki.authentication.ldap.uid=${uid._lowerCase}.

Is there a solution in this direction or do I have to use the old project https://extensions.xwiki.org/xwiki/bin/view/Extension/LDAP%20Authenticator%20Lowercase%20UID/?

The following is also noted here on the page:

LDAP Application implements a solution for this need, the current extension becoming obsolete.

but I have not found a solution in this regard in the LDAP Application.

lublak · July 10, 2024, 9:57am

Some information: After looking into the source code of ldap auth. It looks like the “uid” is hard coded and can’t change. But I don’t yet know where I have to touch the code here. This is the base function: ldap/ldap-authenticator/src/main/java/org/xwiki/contrib/ldap/XWikiLDAPAuthServiceImpl.java at master · xwiki-contrib/ldap · GitHub (it should be work if i just change the “auth” to lower case)
A list of relevant code lines:
ldap/ldap-authenticator/src/main/java/org/xwiki/contrib/ldap/LDAPProfileXClass.java at master · xwiki-contrib/ldap · GitHub (it saves the ldap user as a xwiki document)
It creates the user? user != document? (i think so!) ldap/ldap-authenticator/src/main/java/org/xwiki/contrib/ldap/XWikiLDAPUtils.java at master · xwiki-contrib/ldap · GitHub (but it looks like the “user” is not based on the uid, only the document (userProfile)

After a lot of searching i think this is the line of code:

github.com

xwiki-contrib/ldap/blob/master/ldap-authenticator/src/main/java/org/xwiki/contrib/ldap/LDAPProfileXClass.java#L228


      
              boolean needsUpdate = false;
          
              String objDn = getDn(ldapObject);
              if (!dn.equalsIgnoreCase(objDn)) {
                  map.put(LDAP_XFIELD_DN, dn);
                  needsUpdate = true;
              }
          
              String objUid = getUid(ldapObject);
              if (!uid.equalsIgnoreCase(objUid)) {
                  map.put(LDAP_XFIELD_UID, uid);
                  needsUpdate = true;
              }
          
              if (needsUpdate) {
                  this.ldapClass.fromMap(map, ldapObject);
              }
          
              return needsUpdate;
          }

lublak · July 10, 2024, 10:06am

I think the uid is generell not used publicly in the wiki. It is always the userPageName?

I’m correct?
No im not correct, the id is used in the url. So lowercase id is important to me. (or doesn’t update the active directoy changes the user profile name?)

Another thing I noticed is that userPageName cannot be configured with https://extensions.xwiki.org/xwiki/bin/view/Extension/LDAP/Application/.

TomTheWise · July 11, 2024, 5:13am

In general I think it would would be even much more beneficial if the uid could be changed / mapped to the LDAP objectGUID. While this way links of usernames would probably look bad but that doesn‘t matter in my opinion. With the objectGUID users would still work flawlessly if their names change (getting married for example). Currently that would mean that a new user is created.