Tickets :: Comment on [#8269] Tries to bind to LDAP as each user that has a gallery

* Your Email Address
* Spam protection	Enter the letters below: .__.. ..__ . ..__ \| \|\ /[__)\|__\|[__) \|__\ \/ \| \\| \|\|
Comment	> OK, I think I've figured this out... > > > > Horde uses the setting $conf[prefs][params][writedn] (which it says > is for "Bind to LDAP as which user when writing permissions to LDAP") > to bind with to read users' HordePrefs when opening Ansel (for all > Gallery owners), Wicked pages (for the page author) etc. Making that > setting a DN with minimum read access to all users HordePrefs > resolves these issues across all apps. Obviously if that user has > only read access however you can't change any of your own prefs. > > > > Setting it to a user with write access allows you to change your own > prefs, but also gives you rights (albeit with no obvious ability) to > change any users Prefs, not just read them. > > > > Set it to either "Bind As Admin" (or "Use Search Credentials" with > $conf[prefs][params][searchdn] set to a user with write access to all > users' HordePrefs etc) and no more Error 53 on LDAP binds. > > > > > > That doesn't seem right to me - this setting would appear to me to be > for the purpose of writing one's own prefs, not for reading other > users' prefs. > > > > What I have done as a 'work-around' is use the > cn=horde,ou=accounts,dc=simonandkate,dc=lan account that I have for > groups management, it's got (in slapd.conf): > > > > access to * > > attrs=@hordePerson > > by dn="cn=horde,ou=accounts,dc=simonandkate,dc=lan" write > > > > So all these bugs that I have raised appear to me to come back to a > Horde LDAP issue - with an LDAP backend it would appear that the > $conf[prefs][params][writedn] parameter needs to have all users > HordePerson attributes write access - using "Bind As User" in that > setting will cause the failures logged in the bugs I have raised when > trying to access another user's prefs. > > > > I would much rather have it set to Bind As User, and have an > additional setting that the Horde LDAP code uses to READ all users > HordePrefs etc. Along the lines of a setting > $conf[prefs][params][readdn] "User Horde uses to bind to LDAP to read > other users' preferences". > > > > Over to you PHP / LDAP gurus... :) > > > > Simon
Attachment
Watch this ticket

Saved Queries