+11

roles liked to AD Group(s)

yguillemot 5 years ago 0

First, escuse me for my english, i'm french... :-)

I'm IT Manager and i want to use teampass in my organization for all users.

I have a problem: I would like to be able to link each role to one or more ldap groups, which would allow me not to have to manage the rights individually. Therefore, when authenticating the user, the ldap groups to which it belongs should be checked, and the assigned roles should be updated.

I think we should simply:
- if ldap authentication is enabled, add a field when changing roles on directories (manage_roles) that lists all ldap groups (multiple selection)
- In the database table, save the selected groups in the "roles_values" table
- Add a parameter that enables automatic role updates based on LDAP groups
- when authenticating a user, check if the user is a member of a ldap group linked to a role, if it is the case modify the roles assigned to it (on database / users table / function_id)
- also do the opposite: no longer assign roles if the user is no longer a member of the linked ldap group.

I looked at the source code, tried to copy some parts of the code to do that, but I do not know php ...