mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feature: Add an option for ad authentication to have a default level (#4801)

Browse Source 
* Add an option for ad authentication to have a default level

* rework as a flag indicating unspecified access is global read

* Fix indentation
This commit is contained in:
jonathon-k
2016-10-21 10:22:13 -06:00
committed by Tony Murray
parent 61b461503c
commit 65f74215d3
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/Extensions/Authentication.md
View File

@@ -140,7 +140,7 @@ If you have issues with secure LDAP try setting `$config['auth_ad_check_certific
##### Require actual membership of the configured groups
If you set ```$config['auth_ad_require_groupmembership']``` to 1, the authenticated user has to be a member of the specific group. Otherwise all users can authenticate, but are limited to user level 0 and only have access to shared dashboards.
If you set ```$config['auth_ad_require_groupmembership']``` to 1, the authenticated user has to be a member of the specific group. Otherwise all users can authenticate, and will be either level 0 or you may set ```$config['auth_ad_global_read']``` to 1 and all users will have read only access unless otherwise specified.
> Cleanup of old accounts is done using the authlog. You will need to set the cleanup date for when old accounts will be purged which will happen AUTOMATICALLY.
> Please ensure that you set the $config['authlog_purge'] value to be greater than $config['active_directory]['users_purge'] otherwise old users won't be removed.

7
html/includes/authentication/active_directory.inc.php
View File

@@ -156,6 +156,11 @@ function get_userlevel($username)
global $config, $ldap_connection;
$userlevel = 0;
if (isset($config['auth_ad_require_groupmembership']) && $config['auth_ad_require_groupmembership'] == 0) {
if (isset($config['auth_ad_global_read']) && $config['auth_ad_global_read'] === 1) {
$userlevel = 5;
}
}
// Find all defined groups $username is in
$search = ldap_search(
@@ -254,7 +259,7 @@ function get_userlist()
'email' => $userhash[$key]['email']
);
}
return $userlist;
}