Feature request: Automatic approval and role assignments from ldap groups

[tjuberg]

First off, love the plugin.

The only thing I find myself wishing it had is automatic approval and assignment of roles based on preset rules.

ie, I would like to have the ldap group staff automatically become approved as admins, and members of the ldap group students to become approved as contributors.

I know there are some ldap plugins that do this already, but this one seems to be the one that works the best so far.

[pkarjala]

Hey @tjuberg, thanks for the feature request. I'm not sure what @figureone has planned at this time in terms of integration with existing LDAP groups and role assignment, but we'll take this under consideration.

[tjuberg]

Thank you.

[figureone]

Yeah, this feature sounds like a great idea to me. I'd like to abstract it into its own section of the plugin options, so we can define "rules" that assign roles (or block access) to users when they log in. Those rules can be LDAP group memberships, CAS attributes, or some other identity information store (e.g., my institution uses the Internet2 project, Grouper, to track a lot of identity information).

No timeline on the feature yet, but I think it would make Authorizer a lot more applicable to different use cases. I'll keep this ticket open to update you on progress.

[Infthitbox]

This feature, particularly for CAS attribute role mapping, is one my institution is very interested in.

[CountryNerd]

++ 1 We have considered a few other plugins because groups would be a helpful feature.

[figureone]

If you're willing to use filter hooks, there should be a way to do this now. I still plan on building out a UI for defining group mappings in the Dashboard settings page, but in the meantime:

There is a filter called "authorizer_custom_role" that lets you inspect attributes returned from CAS or LDAP when a user logs in, and change the user's role to anything you'd like. Here's an example of its use:

/**
 * Filter the default role of the currently logging in user based on any of
 * their user attributes.
 *
 * @param string $default_role Default role of the currently logging in user.
 * @param array $user_data     User data returned from external service.
 */
function my_authorizer_custom_role( $default_role, $user_data ) {
  // Allow library guests to log in via CAS, but only grant them 'subscriber' role.
  if (
    isset( $user_data['cas_attributes']['eduPersonPrimaryAffiliation'] ) &&
    'library-walk-in' === $user_data['cas_attributes']['eduPersonPrimaryAffiliation']
  ) {
    $default_role = 'subscriber';
  }
  return $default_role;
}
add_filter( 'authorizer_custom_role', 'my_authorizer_custom_role', 10, 2 );

If you also want to automatically approve users based on data from CAS or LDAP (useful if you have the "Who can log into this site?" option set to "Only approved users"), skipping the "Pending User" step, I'm implementing a new filter called "authorizer_automatically_approve_login" that is similar. Here's an example of its use:

/**
 * Filter whether to automatically approve the currently logging in user
 * based on any of their user attributes.
 *
 * @param bool  $automatically_approve_login
 *   Whether to automatically approve the currently logging in user.
 * @param array $user_data User data returned from external service.
 */
function approve_all_faculty_logins( $automatically_approve_login, $user_data ) {
  // Automatically approve logins for all faculty members.
  if (
    isset( $user_data['cas_attributes']['eduPersonAffiliation'] ) &&
    'faculty' === $user_data['cas_attributes']['eduPersonAffiliation']
  ) {
    $automatically_approve_login = true;
  }
  return $automatically_approve_login;
}
add_filter( 'authorizer_automatically_approve_login', 'approve_all_faculty_logins', 10, 2 );

Version 2.6.8 should have that last filter, and it is due out in a day or two.

[pkarjala]

This feature has been around for a while now; closing this issue. Please comment or re-open if you would like to resume discussion.

[ochebotar]

I'm trying to use your function to map roles via LDAP but it isn't working.

 if (
   isset( $user_data['ldap_attributes']['plHUprimaryTypeCode'] ) &&
          '2' == $user_data['ldap_attributes']['plHUprimaryTypeCode']
  ) {
    $default_role = 'subscriber';
  }
  return $default_role;
}
add_filter( 'authorizer_custom_role', 'my_authorizer_custom_role', 10, 2 );

Need help, please

[figureone]

You should inspect any error messages in the web server's logs. Also inspect the values returned from the LDAP server...the attribute names may be all in lowercase.

error_log( print_r( $user_data['ldap_attributes'], true ) );

Finally, if you do not have Authorizer set to approve All authenticated users (All external service users and all WordPress users), then you'll also need to hook into authorizer_allow_login to grant certain users access before assigning them a custom role.
https://github.com/uhm-coe/authorizer/blob/master/readme.txt#L299-L316

[Scriptkiddi]

This feature has been around for a while now; closing this issue. Please comment or re-open if you would like to resume discussion.

i would like to reopend this issue since the feature is not really implemented

[figureone]

Still planning on building the mapping UI, that feature is being tracked here:
#75
In the meantime, using the hooks referenced above can get the same result (but with more effort).

[lagethomas]

I'm testing the plugin, but when I approve a user who tried to log in, it doesn't create the user in the wordpress database and the login doesn't happen.
I'm using ldap.

[pkarjala]

@lagethomas can you please create a separate issue for your request? Thanks.