bugphpGroupWare - Bugs: bug #14827, Modification of a user within...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #14827: Modification of a user within PHPGW that is created with smbldap-tools kills LDAP entry

Submitter:  Armando Ortiz <warpkat>
Submitted:  Wed 19 Oct 2005 04:53:41 PM UTC
   
 
Category:  API - phpGroupware API Item Group:  0.9.16.008
Severity:  3 - Normal Priority:  7 - High
Status:  None Privacy:  Public
Assigned to:  Caeies Open/Closed:  Closed
Component Version:  SVN Operating System:  GNU/Linux - SuSE
Reproducibility:  Every Time Planned Release:  None
Fixed Release:  0.9.16.010

Jump to the original submission

Sun 18 Dec 2005 09:14:18 AM UTC, comment #17: 

This has been fixed in CVS and should be available in the next
release.

Caeies <Caeies>
Group administrator
Fri 02 Dec 2005 05:56:46 PM UTC, comment #16: 


> Yes, UidNumber and GidNumber are still equal in case of creation.
> That's because the GidNumber is NEEDED in the schema, and that we
> don't have any GidNumber when you create the account.


Why not use the default group assigned to autocreated users (an options of setup page)?
Anyway, this is not really crucial: if you have samba or some other critical app that access LDAP data, i doubt you still use phpgw as interface to account creation... the real important thing is that phgw does not mess up ldap data. ;)


> PS: I guess I will commit the patch As soon as Dave will be ok
> with the changes ... But we need at least one more test.


To stable or HEAD? I've manually upgrade one of two installation of phpgw, say me if i have simply to do a cvs upgrade -dP or manually apply the patches.

Marco Gaiarin <gaio>
Fri 02 Dec 2005 12:17:49 PM UTC, comment #15: 

Hi marco,

Thanks for testing it.

Yes, UidNumber and GidNumber are still equal in case of creation. That's because the GidNumber is NEEDED in the schema, and that we don't have any GidNumber when you create the account.

BUT (yes there is a but), something was prepared to use a "default ldap group" (perhaps a gift from the probusiness group) and I agree that this should be an option in the setup (as the default structure). But as a first workaround, you can define the  $GLOBALS['phpgw_info']['server']['ldap_group_id'] = 'id_of_the_default_group' in the account_ldap constructor.

Cool to hear that it's not touching the gid anymore :)

Regards,

Caeies.

PS: I guess I will commit the patch As soon as Dave will be ok with the changes ... But we need at least one more test.

Caeies <Caeies>
Group administrator
Fri 02 Dec 2005 10:50:36 AM UTC, comment #14: 


> Could you test it ?


Sure! ;)

> I need for test, that you check that's you are still able to
> create an account, that this account is ok.


Ok, creation and deletion of accounts work; still newly created account have GID=UID, but this is a minor problem (if you do not create ldap users in phpgw ;), resolvable only if you add some sort of ``default group'' infromation.

> Then I need that you check that gidnumber are not modified when
> modifying the account using LDAP.


Works, gid number are not touched anymore, many thanks!!! ;)

Marco Gaiarin <gaio>
Fri 02 Dec 2005 10:16:07 AM UTC, comment #13: 


> IIRC the quota is not set in ldap but in acls for the .16 series.
> I could propose a patch for doing it in LDAP, but that's
> something like a "feature evolution" which should not occurs in
> this kind of release.


quota in ldap could be a usefoul feature, but this is not strictly needed... my trouble are that i modify quota for user gabri, but this information are not saved... if they are saved on LDAP or on DB/ACL it is not a problem. ;)

[strictly speaking: it make sense to me to save on LDAP all the common data that can be shared amongst application; if some data are strictly useful only to phpgw, saving it on LDAP or DB it is a simple matter of choice]


Marco Gaiarin <gaio>
Wed 30 Nov 2005 10:47:03 AM UTC, comment #12: 

Hi Marco,

That's an additional patch to the previous one.

Could you test it ?

I need for test, that you check that's you are still able to create an account, that this account is ok.
Then I need that you check that gidnumber are not modified when modifying the account using LDAP. (so you samba group account is ok)
If you think about more test to do, you're welcome to do them :)

Thanks in advance for feedback.

Regards,

Caeies

Caeies <Caeies>
Group administrator
Wed 30 Nov 2005 10:04:31 AM UTC, comment #11: 

Hi Marco,

For 1)
I guess that the samba tools are doing the change ... this is perhaps needed for them :/

2)
Yes That's a know "issue". I will try to look if something is doable to avoid "erasing" old value with new value.

3)
IIRC the quota is not set in ldap but in acls for the .16 series.
I could propose a patch for doing it in LDAP, but that's something like a "feature evolution" which should not occurs in this kind of release.

Regards.

Caeies

Caeies <Caeies>
Group administrator
Thu 24 Nov 2005 05:45:23 PM UTC, comment #10: 

Ok, patch works, bit i have some note/remarks:

1) all my ldap account was created with phpgw, i've only added the samba schema and data; seems strange to me that i need to use account insted of person, but...

2) still ldap mangle ldp data, eg, particulary insist to put GID=UID. On samba there's the SambaPrimaryGroupSID, and if this fiels and GID does not exists, strange things happens...
Seems to me that phpgw does not use at all GID filed (use insted group membership, but these are other things...), so please... don't bother with GID!!!

3) still i cannot modify the quota parameter, my choice are simply not saved. This is the reason (for me) to use phpgw account management tool... ;)))


Many thanks.

Marco Gaiarin <gaio>
Wed 23 Nov 2005 05:22:13 PM UTC, comment #9: 

Hi Marco,

Here's the new patch :

You need to edit the file after patching, and replace the line :
$GLOBALS['phpgw_info']['server']['ldap_structural_objectclass'] = 'account';

by
$GLOBALS['phpgw_info']['server']['ldap_structural_objectclass'] = 'person';

I can't test it myself, so that's a blend patch. I have no idea on possible side effect ...

Anyway, in next release, if it's working for you and Warpkat, we will add the possibility to change it in the setup configuration.

Hope this help.

Regards.

Caeies

Caeies <Caeies>
Group administrator
Wed 23 Nov 2005 05:10:43 PM UTC, comment #8: 

Hi Marco,

That's look better, and will help you to understand how difficult it is for us to work out this properly.

I don't know what's your skills in LDAP, but here's the problem :

In your case, you use the "person" objectclass to classify people, this is a "structural class" which means the "base".

In the case of phpgw the choice was done to use the "Account" objectclass as the "base" or "structural class".

As you can guess, having two structural classes is not an option, and ldap complains about objectclass violation.

The only simple solution I found, is that the admin user indicates what's the "structural class" is in his case ... so we should avoid the problem you get. We can't do this automatically because we have no convenient way to guess what's the structural class used ...

Now, answering to others remarks :
no data altered : of course, LDAP complains, so no modifcation are able to be done.
contacts added : that's still a consequence of the not being able to modify the classes ... because the contact_id is never stored and so phpgw decide to create a new one because for it it doesn't exist.

Last state :
No :) It's already the case ... this will not solve most problems which are in your case very specific.

Hope that clear,

A patch will follow in a few minutes.

Regards,

Caeies

Caeies <Caeies>
Group administrator
Wed 23 Nov 2005 02:47:45 PM UTC, comment #7: 

Ok, the error page still popup (AFAIK the same) but entry are not deleted.
Half done. ;)

I've noted that:
+ no data was altered (i was only putting quota to unlimited, but quota still are at 0).
+ every time i try to modify data, an entry are added to contacts (?!)


I restate (it is needed to open a feature request?): could be that simply phpgw can be forced to not touch LDAP data apart their (phpgw*) fields?
I've just my LDAP tools to handle users and groups properties and memberships...

I attach the error.

Marco Gaiarin <gaio>
Wed 23 Nov 2005 11:27:42 AM UTC, comment #6: 

Ok,

New version of the patch thanks to skwashd :)

Regards,

Caeies

Caeies <Caeies>
Group administrator
Wed 23 Nov 2005 08:57:33 AM UTC, comment #5: 

Ok I attached a tiny patch which could perhaps help. You need to check that you are using the latest LDAP Schema !

Thanks for testing it and confirm or infirm that's working for you !

Regards,

Caeies

Caeies <Caeies>
Group administrator
Wed 26 Oct 2005 09:30:35 AM UTC, comment #4: 

Hum is the user deleted from ldap after the ldap_add ?

I think I remember that yes ... So could you please, in  class.account_ldap.inc.php add near line 834 : (without + :)
+ _debug_array($account_info);
$oldEntry = $this->account_exists($account_info['account_id'], $dn);
+ _debug_array($oldEntry);

if ($oldEntry) // found an existing entry in LDAP
            {
                if ($this->createMode == 'replace')
                {
+                      _debug_array('Replacing it !');

You should, when trying to use Admin User Account see the first 2 debug_array (the one with oldEntry and the one with $account_info
but not the 'Replacing it'! one ...
(the last is just to be sure)
Can you post the result of the two debug array ?

Thanks in advance,

Caeies.

Caeies <Caeies>
Group administrator
Wed 26 Oct 2005 08:08:13 AM UTC, comment #3: 

Hi all,

Finally get some time to look at this.

Well, If a user is auto added, the first result is "ok", when looking at the code (I mean the new test user). Why ?
In fact, the auto_add function consider that the user doesn't exist in the ldap system ... he is just authenticated through ldap, and his account is "created". But the function responsible for the creation of an account find the old entry and replace it with new values ... So in some way this is the normal behavior (at least the documented one :)
Is this good or wrong ... well that's open discussion.

Then, about the admin failing to save values ... there is clearly a problem since the objectclass is missing
objectClass: inetOrgPerson
objectClass: shadowAccount
objectClass: sambaSamAccount
objectClass: inetLocalMailRecipient
But still gets its entries ...

So remaining question is why the create_account is ok in the auto_add function and deficient in the admin case ?
I'm investigating this now.

Anyway, Could you please check that your config is using the right values for group account and user account (min / max)

Caeies <Caeies>
Group administrator
Thu 20 Oct 2005 10:38:15 PM UTC, comment #2: 

The updated schema didn't work, I'm afraid...

Armando Ortiz <warpkat>
Wed 19 Oct 2005 11:24:48 PM UTC, comment #1: 

Please try using the updated schema in the stable branch of CVS, it should fix this issue.

Dave Hall <skwashd>
Group administrator
Wed 19 Oct 2005 04:53:41 PM UTC, original submission:  

Here is a BEFORE LDIFF dump of a newly created user using the smbldap-tools from IDEALX:
dn: uid=testuser,ou=Users,dc=test,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
objectClass: inetLocalMailRecipient
cn: Test User
sn: testuser
uid: testuser
uidNumber: 5167
gidNumber: 513
homeDirectory: /home/testuser
loginShell: /bin/bash
gecos: Test User
description: Test User
structuralObjectClass: inetOrgPerson
entryUUID: b1b96dd6-d50b-1029-988a-f296c74e6d44
creatorsName: cn=Manager,dc=test,dc=com
createTimestamp: 20051019164652Z
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaKickoffTime: 2147483647
sambaPwdCanChange: 0
displayName: Test User
sambaSID: S-1-5-21-301874603-235800216-848762693-11334
sambaLogonScript: STARTUP.BAT
sambaProfilePath: \\PDCSRV\profiles\testuser
sambaHomePath: \\PDCSRV\testuser
sambaPrimaryGroupSID: S-1-5-21-301874603-235800216-848762693-513
sambaHomeDrive: H:
mailLocalAddress: testuser
mail: -email is unavailable-
sambaLMPassword: 0F20048EFC645D0A944E2DF489A880E4
sambaAcctFlags: [U]
sambaNTPassword: D183983EAEA7BE9959C8F4C198ED0E68
sambaPwdLastSet: 1129740418
sambaPwdMustChange: 1133628418
userPassword:: e1NTSEF9ejlwL1FDOHB1N2xtZ1V4WVNqRVl4TWdKU3JaUWRXVk4=
entryCSN: 20051019164658Z#000002#00#000000
modifiersName: cn=Manager,dc=test,dc=com
modifyTimestamp: 20051019164658Z

Here is the same user, but after he has authenticated with PHPGW using the LDAP authentication method and storage:
dn: uid=testuser,ou=Users,dc=test,dc=com
loginShell: /bin/bash
structuralObjectClass: inetOrgPerson
entryUUID: b1b96dd6-d50b-1029-988a-f296c74e6d44
creatorsName: cn=Manager,dc=test,dc=com
createTimestamp: 20051019164652Z
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
objectClass: inetLocalMailRecipient
objectClass: phpgwAccount
phpgwAccountID: 6173
phpgwAccountExpires: -1
phpgwAccountStatus: A
cn: New User
uidNumber: 6173
uid: testuser
description: phpgw-created account
givenName: New
sn: User
userPassword:: e2NyeXB0fSQxJE5adnlwaGhFJFM4ZGNZMTNuOTBZTzdyVEFUTjJ2aC8=
homeDirectory: /home/testuser
gidNumber: 6173
gecos: Test User
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaKickoffTime: 2147483647
sambaPwdCanChange: 0
displayName: Test User
sambaSID: S-1-5-21-301874603-235800216-848762693-11334
sambaLogonScript: STARTUP.BAT
sambaProfilePath: \\PDCSRV\profiles\testuser
sambaHomePath: \\PDCSRV\testuser
sambaPrimaryGroupSID: S-1-5-21-301874603-235800216-848762693-513
sambaHomeDrive: H:
mailLocalAddress: testuser
mail: -email is unavailable-
sambaLMPassword: 0F20048EFC645D0A944E2DF489A880E4
sambaAcctFlags: [U]
sambaNTPassword: D183983EAEA7BE9959C8F4C198ED0E68
sambaPwdLastSet: 1129740418
sambaPwdMustChange: 1133628418
phpgwLastLogin: 1129740743
phpgwLastLoginFrom: 127.0.0.1
entryCSN: 20051019164811Z#000002#00#000000
modifiersName: cn=Manager,dc=test,dc=com
modifyTimestamp: 20051019164811Z

If I go into PHPGW as the administrator and try to EDIT this user through the User Accounts Administration tool, this is what I end up with:
Warning: ldap_add(): Add: Object class violation in /home/aortiz/public_html/phpgroupware/phpgwapi/inc/class.accounts_ldap.inc.php on line 1001
ldap_add FAILED: [65] Object class violation

Adds: uid=testuser,ou=Users,dc=test,dc=com

Array
(
    [objectclass] => Array
        (
            [0] => phpgwAccount
            [1] => phpgwContact
            [2] => posixAccount
            [3] => account
        )

    [phpgwaccountid] => 6173
    [phpgwaccountexpires] => -1
    [phpgwaccountstatus] => A
    [phpgwcontactid] => 13
    [cn] => New User
    [uidnumber] => 6173
    [uid] => testuser
    [description] => phpgw-created account
    [givenname] => New
    [sn] => User
    [homedirectory] => /home/testuser
    [gidnumber] => 6173
    [gecos] => Array
        (
            [0] => Test User
        )

    [sambalogontime] => Array
        (
            [0] => 0
        )

    [sambalogofftime] => Array
        (
            [0] => 2147483647
        )

    [sambakickofftime] => Array
        (
            [0] => 2147483647
        )

    [sambapwdcanchange] => Array
        (
            [0] => 0
        )

    [displayname] => Array
        (
            [0] => Test User
        )

    [sambasid] => Array
        (
            [0] => S-1-5-21-301874603-235800216-848762693-11334
        )

    [sambalogonscript] => Array
        (
            [0] => STARTUP.BAT
        )

    [sambaprofilepath] => Array
        (
            [0] => \\PDCSRV\profiles\testuser
        )

    [sambahomepath] => Array
        (
            [0] => \\PDCSRV\testuser
        )

    [sambaprimarygroupsid] => Array
        (
            [0] => S-1-5-21-301874603-235800216-848762693-513
        )

    [sambahomedrive] => Array
        (
            [0] => H:
        )

    [maillocaladdress] => Array
        (
            [0] => testuser
        )

    [mail] => Array
        (
            [0] => -email is unavailable-
        )

    [sambalmpassword] => Array
        (
            [0] => 0F20048EFC645D0A944E2DF489A880E4
        )

    [sambaacctflags] => Array
        (
            [0] => [U]
        )

    [sambantpassword] => Array
        (
            [0] => D183983EAEA7BE9959C8F4C198ED0E68
        )

    [sambapwdlastset] => Array
        (
            [0] => 1129740418
        )

    [sambapwdmustchange] => Array
        (
            [0] => 1133628418
        )

    [loginshell] => /bin/bash
    [userpassword] => {crypt}$1$NZvyphhE$S8dcY13n90YO7rTATN2vh/
    [phpgwlastlogin] => 1129740743
    [phpgwlastloginfrom] => 127.0.0.1
)

Armando Ortiz <warpkat>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #2504:  patch_ldap_groups.diff added by Caeies (1KiB - text/plain - Adding the "not handling of groups id by phpgw")
file #2630:  patch_trashing_accounts.patch added by Caeies (1KiB - text/x-patch - New version of the patch, Note tha you need to edit the file after the patch to correctly use it)
file #2627:  phpgw-err-20051123.txt added by gaio (2KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 12 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-12-18 Caeies Open/ClosedOpen Closed
    Fixed Release 0.9.16.010
2005-11-30 Caeies Attached File- Added patch_ldap_groups.diff, #3151
2005-11-23 Caeies Attached File#3125 Removed
2005-11-23 Caeies Attached File- Added patch_trashing_accounts.patch, #3128
2005-11-23 gaio Attached File- Added phpgw-err-20051123.txt, #3126
2005-11-23 Caeies Attached File#3124 Removed
2005-11-23 Caeies Attached File- Added patch_trashing_accounts.patch, #3125
2005-11-23 Caeies Attached File- Added patch_trashing_accounts.patch, #3124
    Carbon-Copy- Added -email is unavailable-
2005-10-20 Caeies Component VersionNone SVN
2005-10-20 Caeies Assigned toNone Caeies

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code