Mantis Bug Tracker - Forums

Hello Mantis gurus,
I successfully deployed Mantis(1.1.6) on a Windows 2003 Server of our french site using Active Directory and LDAP for Authentication.
I'd like to update my config_inc.php file settings in order to enable americans users to connect the Bug Tracking System via our Intranet...

Here are the current settings that are working fine for french users:
...
$g_ldap_root_dn = 'ou=Users,ou=France,ou=Europe,dc=MyDomain,dc=net';
$g_ldap_organization = '';
$g_ldap_uid_field = 'sAMAccountName';
...

If I change it for americans users:
$g_ldap_root_dn = 'ou=Users,ou=USA,ou=Americas,dc=MyDomain,dc=net';
French users can't connect anymore...

If I change it to the top level of the Active Directory
$g_ldap_root_dn = 'ou=Users,dc=MyDomain,dc=net';
It does not work for anyone!

Any help/suggestion is welcome

May be there is another way using Active Directory group membership... but I don't know the settings neither !

Cheers,
C.

Erratum in my previous post...

Here is the current deployed versions:
Mantis: 1.1.8
PHP: 5.2.9.9
MySQL: 5.1
Host OS: Windows 2003 Server US

Cheers,

C.

We finally found a workaround.
We slightly changed the function ldap_authenticate in core\ldap_api.php so that it now loops on severals ldap_root_dn declared in the config_inc.php

In config_inc.php
$g_ldap_root_dn1 = ...
$g_ldap_root_dn2 = ...
we also added a new variable
$g_ldap_root_dn_count = 2; # In our case.

# --------------------
# Attempt to authenticate the user against the LDAP directory
# return true on successful authentication, false otherwise
function ldap_authenticate( $p_user_id, $p_password ) {
# if password is empty and ldap allows anonymous login, then
# the user will be able to login, hence, we need to check
# for this special case.
if ( is_blank( $p_password ) ) {
return false;
}

$t_ldap_organization = config_get( 'ldap_organization' );

$t_username = user_get_field( $p_user_id, 'username' );
$t_ldap_uid_field = config_get( 'ldap_uid_field', 'uid' ) ;
$t_search_filter = "(&$t_ldap_organization($t_ldap_uid_field=$t_username))";
$t_search_attrs = array( $t_ldap_uid_field, 'dn' );
$t_ds = ldap_connect_bind();

# Search for the user id in DNs
$t_authenticated = false;
$t_ldap_root_dn_count = config_get( 'ldap_root_dn_count');
for ( $j = 1 ; $j <= $t_ldap_root_dn_count ; $j++ ) {
$t_ldap_root_dn = config_get( 'ldap_root_dn'.$j);
$t_sr = ldap_search( $t_ds, $t_ldap_root_dn, $t_search_filter, $t_search_attrs );
$t_info = ldap_get_entries( $t_ds, $t_sr );
if ( $t_info ) {
# Try to authenticate to each until we get a match
for ( $i = 0 ; $i < $t_info['count'] ; $i++ ) {
$t_dn = $t_info[$i]['dn'];

# Attempt to bind with the DN and password
if ( @ldap_bind( $t_ds, $t_dn, $p_password ) ) {
$t_authenticated = true;
break; # Don't need to go any further
}
}
}
ldap_free_result( $t_sr );
}

ldap_unbind( $t_ds );
return $t_authenticated;
}



I agree the code could be smarter ... but it works fine like this.


C.

We also have multiple OU in our AD and I was struggling until I saw this post.

Thanks it helped.

It's possible authorize only users from specified ldap group ?