[#CONF-8307] Allow authenticating OSUser LDAP users by bind only without search

Confluence

Allow authenticating OSUser LDAP users by bind only without search

Created: 22/Apr/07 10:09 PM Updated: 25/Oct/07 11:45 AM

Component/s:

Users & Groups

Affects Version/s:

2.3.3, 2.4.5

Fix Version/s:

None

Time Tracking:

Not Specified

Participants:	Matt Ryall [Atlassian], Patrick Berry and Tom Davies [Atlassian]
Since last comment:	42 weeks, 5 days ago
Labels:

Description

« Hide

Currently, LDAP users must be authenticated in OSUser by doing a bind (i.e. by logging in) then performing a search.

Some LDAP servers are configured to deny users access to search, and we could support those servers by allowing users to customise whether the search is performed as part of the authentication or not.

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Patrick Berry added a comment - 23/Apr/07 09:32 AM

Is OSUser in Confluence fundamentally different than JIRA? If so, is it related to the ability to manage groups inside of LDAP? I only ask because we got JIRA patched many moons ago so that we could work with our current LDAP.

[ Permlink | « Hide ]

Tom Davies [Atlassian] added a comment - 23/Apr/07 05:40 PM

Confluence uses a customised version of osuser, so the patch made for JIRA is not applicable to Confluence.

[ Permlink | « Hide ]

Patrick Berry added a comment - 25/Oct/07 11:45 AM

We're about to move Confluence out of pilot and into "production", but this issue will be a killer for us. We have user data that cannot be public and currently our permissions on LDAP are set so that some users cannot even bind as themselves (I assume this is because binding as a user first does a search for that record and then binds using the results from the search).

Is there any way to work around this in confluence other than a) reconfiguring LDAP to do things we don't want it to do or b) creating local Confluence accounts for these users. Both options are less than optimal for us.