I'm only speaking about membership, not the full ACL.

Apart that it is not clear to me because simply group membership are taken from LDAP instead from ACL (i suspect hystorical reason, too code to change in too many places ;), i propose a very simple task:

At every user login into phpgw, all the group membership of the user are reset (delete from phpgw_acl where acl_appname='phpgw_group' and acl_account=1000) and reinserted using as source the LDAP membership data.

Clearly this is a brute-force approach, a beter approach would be to verify every membership and add/remove only the needed one.

Clearly this could be achived by a global/config switch, not enabled by default. ;)

AFAI've understood phpgw, this could not pose any problem at all to phpgw, or at least not pose any problem more hard that modifing membership in Administration page by hand.


In this way i will be able to do user management with every interface i like.
Hope now it is clear, and hope also that i've not missed too many ``details''... O;-)))

Another little troublen handling accounts and group in LDAP.
I've tested it also in my new installation.

Now create my account using smbldap-tools, then i use a LDAP browser (GNOME GQ) to add PHPGW ObjectClass and data.

But in this way membership are not preseved, and i've to enter phpgw as administrator, edit user data and reset group membership.

This is a real pain, because:

+ this force me to use phpgw to handle membership
+ if for some reason i use some other tool to handle membership, it is easy to override/get lost this membership working on phpgw.

For me an ideal approach will be simply: at every login, ldap membership data have to be copied into phpgw_acl array as phpgw membership; to me this seems a simple and effective approach.