{"action":"opened","issue":{"url":"https://api.github.com/repos/twostairs/paperwork/issues/450","labels_url":"https://api.github.com/repos/twostairs/paperwork/issues/450/labels{/name}","comments_url":"https://api.github.com/repos/twostairs/paperwork/issues/450/comments","events_url":"https://api.github.com/repos/twostairs/paperwork/issues/450/events","html_url":"https://github.com/twostairs/paperwork/issues/450","id":95492525,"number":450,"title":"LDAP: improve binding/auth method","user":{"login":"DSpeichert","id":1254971,"avatar_url":"https://avatars.githubusercontent.com/u/1254971?v=3","gravatar_id":"","url":"https://api.github.com/users/DSpeichert","html_url":"https://github.com/DSpeichert","followers_url":"https://api.github.com/users/DSpeichert/followers","following_url":"https://api.github.com/users/DSpeichert/following{/other_user}","gists_url":"https://api.github.com/users/DSpeichert/gists{/gist_id}","starred_url":"https://api.github.com/users/DSpeichert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DSpeichert/subscriptions","organizations_url":"https://api.github.com/users/DSpeichert/orgs","repos_url":"https://api.github.com/users/DSpeichert/repos","events_url":"https://api.github.com/users/DSpeichert/events{/privacy}","received_events_url":"https://api.github.com/users/DSpeichert/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-16T18:11:51Z","updated_at":"2015-07-16T18:11:51Z","closed_at":null,"body":"Some LDAP servers require full path for a user to bind (authenticate). That full name is suffixed by Paperwork with base_dn from config/ldap.php but there may be more parts that are variable.\r\n\r\nExample:\r\nbase_dn => 'DC=sub,DC=domain,DC=com'\r\nusername = testuser\r\n\r\nPaperwork would, however, try to bind the above user as ```CN=testuser,DC=sub,DC=domain,DC=com```.\r\nFor some LDAP structures with more advanced trees, this will not work. In case of that user, it might be necessary to instead bind as: ```CN=testuser,OU=User Accounts,OU=North,DC=sub,DC=domain,DC=com```.\r\n\r\nClearly, the user should not be required to enter all that data every time they log in and more issues would arise while displaying that data as username.\r\n\r\nIt is possible to fix this by altering the LDAP logic slightly to do the following:\r\n1. Search LDAP tree for CN=testuser\r\n2. If found, take the full DN\r\n3. Bind as the DN from previous step to authenticate\r\n\r\nI've tested a patch that does that and it's completely backwards compatible. I'll submit a PR soon."}}