Changes between Version 3 and Version 4 of LdapPlugin


Ignore:
Timestamp:
Nov 5, 2005, 1:28:34 AM (18 years ago)
Author:
Emmanuel Blot
Comment:

Typo/grammar

Legend:

Unmodified
Added
Removed
Modified

  • LdapPlugin

    v3 v4  
    44
    55LDAP support with group management has been added as a Trac extension. This
    6 extension allows to use existing LDAP groups to grant permissions, rather than
     6extension enables to use existing LDAP groups to grant permissions rather than
    77defining permissions for every single user on the system. The latest release also
    88permits to store permissions (both users and groups permissions) in the LDAP
    9 directory itself, rather than in the SQL backend.
     9directory itself rather than in the SQL backend.
    1010
    1111The original proposition about LDAP ACL is documented under ticket
    1212[http://projects.edgewall.com/trac/ticket/535 Trac#535] on the official web site.
    1313
    14 This software is [http://trac.edgewall.com/license.html licensed] with the same
     14This software is [http://trac.edgewall.com/license.html licenced] with the same
    1515license than Trac.
    1616
    … …  
    2020[http://python-ldap.sourceforge.net/ python-ldap].[[BR]] LdapPlugin has been
    2121tested on a Debian Linux Sarge/Sid (2.4.x and 2.6.x) server, as well as on a
    22 Windows XP SP2 workstation, both running Python 2.3, with Trac-0.9b2.
    23 
    24 To use the egg file, you need to have
     22Windows XP SP2 workstation, both running Python 2.3 with Trac-0.9b2.
     23
     24To use the egg file you need to have
    2525[http://peak.telecommunity.com/DevCenter/setuptools setuptools], version 0.6+
    2626installed.[[BR]]Please refer to the
    … …  
    4040 
    4141 * Source code is available from http://trac-hacks.swapoff.org/svn/ldapplugin [[BR]] It has been written against Trac [http://projects.edgewall.com/trac/changeset/2353 trunk:2353].
    42  * You can also find [wiki:LdapPlugin#Testing unit tests] at the same location, under the `tests` directory, which may help you to deploy the plugin.
     42 * You can also find [wiki:LdapPlugin#Testing unit tests] at the same location - under the `tests` directory -, which may help you deploy the plugin.
    4343
    4444== Installation ==
    4545
    46  * Build the ''egg'' file, following plugin packaging [http://projects.edgewall.com/trac/wiki/TracDev/PluginDevelopment#Packaginganddeployingplugins instructions]
     46 * Build the ''egg'' file following the plugin packaging [http://projects.edgewall.com/trac/wiki/TracDev/PluginDevelopment#Packaginganddeployingplugins instructions]
    4747 * Copy the `dist/LdapPlugin-0.y.z-py2.3.egg` file in your ''plugins'' project directory.
    4848
    … …  
    5151LdapPlugin does '''not''' perform authentication: Apache2 does, through the HTTP
    5252protocol, as with any other Trac installation.[[BR]]
    53 LdapPlugin retrieves the groups to which the authenticated user belongs, and
     53LdapPlugin retrieves the groups to which the authenticated user belongs and
    5454checks the [http://projects.edgewall.com/trac/wiki/TracPermissions TracPermissions]
    5555against these groups, along with the regular permissions for the user.
    5656
    5757You probably want to use Apache2 LDAP authentication as well.[[BR]]
    58 This topic is out of scope of this document, but you may find useful information
     58This topic is out of scope of this document but you may find useful information
    5959on the official Apache2 [http://httpd.apache.org/docs-2.0/mod/mod_ldap.html mod_ldap]
    6060web site.
    … …  
    8282    this extension.
    8383 1. Optionnally add the path to your plugin directory
    84  1. Configure the LDAP directives to fit to your LDAP server configuration
     84 1. Configure the LDAP directives to fit your LDAP server configuration
    8585
    8686The section may also contain the following options (which are presented down
    … …  
    127127}}}
    128128
    129 You'd probably want to define at least `enable=true` and the `basedn`[[BR]]
     129You probably want to define at least `enable=true` and the `basedn`[[BR]]
    130130The meaning of the options are pretty straightforward for LDAP administrators.
    131131
    132 A typical setup for group resolution would look like
     132A typical setup for group resolution would look like this:
    133133
    134134{{{
    … …  
    138138}}}
    139139
    140 A typical setup for all LDAP support (group resolution and permission store
    141 would look like
     140A typical setup for all LDAP support (group resolution and permission store)
     141would look like this:
    142142
    143143{{{
    … …  
    153153== Authenticated LDAP connections ==
    154154
    155 If your server requires an authenticated connection to retrieve group permissions,
    156 you want to set `group_bind = true` in the `[ldap]` section, and define
    157 the credentials, as follow:
     155If the server requires an authenticated connection to retrieve group permissions,
     156you want to set `group_bind = true` in the `[ldap]` section and define
     157the credentials as follows:
    158158
    159159{{{
    … …  
    164164}}}
    165165
    166 If your server requires an authenticated connection to modify group permissions,
    167 you want to set `store_bind = true` in the `[ldap]` section, and define
    168 the credentials, as follow:
     166If the server requires an authenticated connection to modify group permissions,
     167you want to set `store_bind = true` in the `[ldap]` section and define
     168the credentials as follows:
    169169
    170170{{{
    … …  
    192192}}}
    193193
    194 The extensions differenciates '''group permissions''' from '''user permission'''.
    195 This allow to use distinct objectclasses in the LDAP directory, to store
    196 permission. For example, thanks to the `groupattr` and `uidattr`
     194The extension differenciates '''group permissions''' from '''user permission'''.
     195This permits to use distinct objectclasses in the LDAP directory, to store
     196permission. For example thanks to the `groupattr` and `uidattr`
    197197attributes, you can define group permission to LDAP entries such as
    198198{{{
    … …  
    234234Please note that the LDAP permission store '''never''' attemps to create a new
    235235entry in the LDAP directory. To grant (or revoke) permissions to/from the LDAP
    236 directory, the targetted LDAP entry should exist in the directory, and the
     236directory, the targetted LDAP entry should exist in the directory and the
    237237attribute defined by the `permattr` option should be writtable for the
    238238`store_user` user.
    … …  
    273273LDAP group have the `WIKI_CREATE` and `WIKI_MODIFY` permission.
    274274
    275 You can obviously still use permissions for regular user, such as ''eblot'' in
    276 the aforementionned example.
    277 
    278 '''Note''': Please remember that ''anonymous'' and ''authenticated'' are special users,
     275You can obviously still use permissions for regular user such as ''eblot'' in
     276the example above.
     277
     278'''Note''': Please remember that ''anonymous'' and ''authenticated'' are special users
    279279but are considered by the permission backend just like any other regular user.[[BR]]
    280280This means that you need to add both these special users in your LDAP directory
    … …  
    287287
    288288 * Only LDAP v3 protocol is supported. This extension may work with v2 protocol
    289    as well, if the v3 specifier is removed from the code
     289   as well, if the v3 specifier is removed from the code.
    290290
    291291== !ToDo list ==
    292292 
    293  * Add user detail support, so that the full name and email address are
     293 * Add user detail support so that the full name and email address are
    294294   retrieved from the LDAP server. It would require a new extension point in
    295295   Trac engine.
    … …  
    298298== Testing ==
    299299
    300 The LdapPluginTests page gives some hint about how to test the Ldap extension for
     300The LdapPluginTests page gives some hints about how to test the Ldap extension for
    301301Trac
    302302
    303303== History ==
    304304
    305  * '''v0.0''': First attempt to write a LDAP bridge for Trac, based on Trac 0.8, which required some hacks into the Trac engine. Too bad
     305 * '''v0.0''': First attempt to write a LDAP bridge for Trac based on Trac 0.8, which required some hacks into the Trac engine.
    306306 * '''v0.1''': A new implementation has started on September, 1st '05, to profit from the new [http://projects.edgewall.com/trac/wiki/TracPlugins TracPlugins] module  architecture introduced in Trac 0.9-pre.[[BR]] This implementation should bring the following improvements:
    307307   * includes a cache to dramatically reduce LDAP requests
    308    * better handling of LDAP errors[[BR]]This extension works with Trac 0.9-pre1, and requires the [http://peak.telecommunity.com/DevCenter/setuptools setuptools], version 0.5a13
    309  * '''v0.2''': This new release fixes up a couple of bugs, and works with Trac 0.9-pre2. It requires the [http://peak.telecommunity.com/DevCenter/setuptools setuptools], version 0.6+.[[BR]]It introduces support for LDAP permission store: TracPermissions can now stored into the LDAP directory, rather than in the SQL backend.[[BR]]Each feature (LDAP as a provider of group permissions, LDAP as a permission store) are independent and can be enabled or disabled on demand.
     308   * better handling of LDAP errors[[BR]]This extension works with Trac 0.9-pre1 and requires the [http://peak.telecommunity.com/DevCenter/setuptools setuptools], version 0.5a13
     309 * '''v0.2''': This new release fixes up a couple of bugs and works with Trac 0.9-pre2. It requires the [http://peak.telecommunity.com/DevCenter/setuptools setuptools], version 0.6+.[[BR]]It introduces support for LDAP permission store: TracPermissions can now be stored into the LDAP directory, rather than in the SQL backend.[[BR]]Each feature (LDAP as a provider of group permissions, LDAP as a permission store) are independent and can be enabled or disabled on demand.
    310310
    311311== Author/Contributors ==