I'd like to contribute with some dianostics:
Entering auth_does_password_match :: 1 :: root
t_configured_login_method=LDAP
Entering ldap_authenticate :: 1 :: root
Entering ldap_connect_bind :: ::
1: Reading bind configuration
2 Binding with cn=admin,dc=jquantlib,dc=org :: secret
4: bind succeeded
Leaving ldap_connect_bind
-------------------------------
t_ldap_root_dn=ou=People,dc=jquantlib,dc=org
t_ldap_uid_fild=uid
t_ldap_organization=(objectClass=inetOrgPerson)
t_search_filter=(&(objectClass=inetOrgPerson)(uid=administrator))
t_search_attrs=Array
t_info[1]=
-------------------------------
Leaving ldap_authenticate
What it means is:
1. ldap_connect_bind works as expected, picking userDN and userPassword from configuration file.
2. ldap_authenticate tries to authenticate to dn=uid=administrator,ou=People,dc=jquantlib,dc=org whilst it shouldnt... because I've informed test5/secret to login_page.php and this is the username I'm interested to authenticate, not the administrator.
I've seem some other posts about this behaviour: Mantis depends on internal user_ids, stored in its database in order to obtain the userDN which will be used to communicate to LDAP. This is undesirable, IMHO, because it creates an unneeded dependency between 2 distinct databases.
For the time being, I will:
a) try to reinstall Mantis and define 'mantisadmin' instead of 'administrator'. At the moment, I dont know if it can be done :/
b) make sure Mantis internal database and LDAP are synchronized.
My contribution:
My interest on Mantis is only as end-user but I could dedicate some effort for test driving Mantis with OpenLDAP.
Suggestion:
1. use usernames instead of userids in the internal Mantis database.
2. use username/password informed to login_page to authenticate, no matter which authentication database is used.
3. in the case LDAP is used, profiled information regarding the user would not be stored in Mantis internal database, but would be stored in a specific mantis.schema, in the LDAP server.
4. when a new user is created, Mantis could automagically assign inetorgperson.schema and mantis.schema to the newly created ldap entry.
Obviously it means that, on the OpenLdap side, a mantis.schema must be installed.
IMHO, this is good because a search filter (&(objectClass=mantis)(uid=test)) makes sure that a certain uid is a valid Mantis user.
A good souce of ideas is ...
http://svn.wikimedia.org/viewvc/mediawi ... ntication/
... which is a mediawiki extension able to create users in OpenLDAP and M$AD.
A side note and certainly not relevant to Mantis team... just intended to share some ideas:
SSO (single sign on) can be obtained easily by adding krb5Principal and krb5KDCEntry schemas to the newly created user (and some other details I prefer not mention here). This is certainly out of scope of Mantis new user creation because it's not Mantis responsibility to define a username/password for enterprise SSO authentication ... neither mediawiki responsibility... neither any other end-user application. A separate user administration tool and workflow is certainly needed. I've spent several days looking for something like this and I havent found anything.
In spite it's not relevant, this is something with will happen sooner or later, as applications evolve to enterprise level quality and integration.
Cheers
Richard Gomes