Unable to create LDAP user (empty LDAPProfileClass object)

Help / Discuss
1

When creating users with values from our LDAP server with the following groovy script, the object “XWiki.LDAPProfileClass” is empty, regardless if we use “getObject” or “newObject”:

def create_ldap_user(user) {
    udoc = xwiki.getDocument("XWiki."+user)
    uobj = udoc.getObject("XWiki.XWikiUsers", true)
    uobj.set("active", 1)
    lobj = udoc.getObject("XWiki.LDAPProfileClass", true)
    //lobj = udoc.newObject("XWiki.LDAPProfileClass")
    lobj.set("dn" , "uid=" + user + ",ou=Users,dc=example,dc=com")
    lobj.set("uid" , user)
    udoc.save()
}

Newly created user profile in object inspector

After creation the object inspector shows a class of type “XWiki.LDAPProfileClass” attached to the user, but it does not contain any attributes. When clicking on “New LDAPProfileClass object”, we only get the error “Failed:Not Found”.
error message

This only happens on a newly installed instance, that is configured for LDAP login, as long as no LDAP user ever logged in.

Why does this happen and how can we avoid it? Thanks in advance!

2

The XWiki.LDAPProfileClass class is automatically generated by the LDAP authenticator the first time it creates a user, so that’s probably your problem.

3

Thanks, we suspected as much… is there any possibility of manually triggering the class creation via a groovy script?

4

It’s initialized in the constructor of the class org.xwiki.contrib.ldap.LDAPProfileXClass so something like the following Groovy script should do it:

new org.xwiki.contrib.ldap.LDAPProfileXClass(context.context)
5

Thank you for the pointer! After some trial and error, we could get it to work with this groovy script:

def create_ldap_user(user) {
    udoc = xwiki.getDocument("XWiki."+user)
    uobj = udoc.getObject("XWiki.XWikiUsers", true)
    uobj.set("active", 1)
    lobj = udoc.getObject("XWiki.LDAPProfileClass", false)
    if (!lobj) {
        new org.xwiki.contrib.ldap.LDAPProfileXClass(xcontext.context)
        lobj = udoc.getObject("XWiki.LDAPProfileClass", true)
        print("created XWiki.LDAPProfileClass\n")
    }
    lobj.set("dn" , "uid=" + user + ",ou=Users,dc=example,dc=com")
    lobj.set("uid" , user)
    udoc.save()
}
create_ldap_user("hmuster")
6

Glad you found a working solution !

7

I think it would be meaningful to add “XWikiRights”, so that the user is able to edit its own profile page…

{{groovy}}
def create_ldap_user(user) {
    udoc = xwiki.getDocument("XWiki." + user)
    uobj = udoc.getObject("XWiki.XWikiUsers", true)
    uobj.set("active", 1)
    lobj = udoc.getObject("XWiki.LDAPProfileClass", false)
    if (!lobj) {
        new org.xwiki.contrib.ldap.LDAPProfileXClass(xcontext.context)
        lobj = udoc.getObject("XWiki.LDAPProfileClass", true)
        print("created XWiki.LDAPProfileClass\n")
    }
    lobj.set("dn", "uid=" + user + ",ou=Users,dc=example,dc=com")
    lobj.set("uid", user)

    robj = udoc.getObject("XWiki.XWikiRights", false)
    if (!robj) {
        robj = udoc.getObject("XWiki.XWikiRights", true)
        robj.set("users", "XWiki." + user)
        robj.set("levels", "edit")
    }
    udoc.save()
}

create_ldap_user("hmuster")
{{/groovy}}
8

An alternative would be to use the standard XWiki#createUser API which is taking care of this (and also to add the user to configured default groups), before adding the LDAPProfileClass. This is what the LDAP authenticator is doing.

9

Ok, thank.
Maybe you can give me a hint concerning one issue I’m currently testing.
We plan to migrate from Confluence to XWiki (without any payed services). We are a software developer company, so technical issues my not be the problem, if we understand the relationships :slight_smile:

Current Question:

We plan to use the “Filter streams Converter” to import Confluence Spaces one by one.
We plan to use the “LDAP Authenticator” in XWiki, which is already configured in our testenvironment.

Our aim: Users/authors of our Confluence content imported into XWiki should successfully mapped to the users handled/created/… by the “LDAP Authenticator” (the users with the mapping info attached).

e.g. there is a Confluence page imported with the user “dibr”, how can I accomplish that this page author is correctly mapped to the “LDAP Authenticator” user? Have I to hold a special setting/import order or something like this?

In a first test a user “dibr_1” was created, when logging in with the LDAP account and the mapping was not working.

10

You need to make sure this user is an LDAP user with the right uid. In practice, that means adding the right LDAPProfileClass object (which is what is in charge of maintaining the mapping).

When a user already exist at the location, but is not the right user from LDAP point a view, a new one is created to avoid causing problems.

11

Ok thanks,
sounds like writing a small script, iterating over the users, adding the LDAP Class and thats it? (no “automated”/default way)

12

Yes, the tricky part is usually more knowing which uid to put exactly in the object (when it’s not identical to the page name).