Improving the LDAP implementation#615
Conversation
… dn by switching to ldapts
|
As posted in #582 i can confirm this fixes the issues i was having. |
There was a problem hiding this comment.
Thank you, that's great! Please see my other comment below.
Additionally, there was mentioned that setting an admin group doesn't work. For me the code looks fine, this is probably a configuration mistake, right?
| ? t("signup.input.username.placeholder") | ||
| : t("signin.input.email-or-username.placeholder") | ||
| } | ||
| label={t("signin.input.email-or-username")} |
There was a problem hiding this comment.
Because of const ldapUsername = dto.username || dto.email; in backend/src/auth/auth.service.ts the user can't sign in with email, just with an username that looks like an email. Shouldn't we display the label "Username" instead of "Email or username" in that case?
There was a problem hiding this comment.
I have not had time to test the admin group login yet, that was regiolisas. The dev branch made it appear that a non signed in user could upload i had to revert back to the main branch. i dont have a test system only production. :(
There was a problem hiding this comment.
Because of
const ldapUsername = dto.username || dto.email;inbackend/src/auth/auth.service.tsthe user can't sign in with email, just with an username that looks like an email. Shouldn't we display the label "Username" instead of "Email or username" in that case?
Well, good question. I think neither of the proposed solutions would be adequate, as we don't always know when someone uses LDAP if they are expecting to log in with a username or an email (like in the case of @Esperenza84, for example).
When looking at how GitLab handles this, they’ve taken a very clean approach by explicitly separating both types of login. Maybe that could be an applicable solution here as well?
There was a problem hiding this comment.
Oh, I mistakenly believed that signing in “normally” (without LDAP) is disabled when LDAP is enabled. However, I just realized that this isn’t the case. In such a scenario, it would be logical to display the “email or username” label.
The implementation of GitLab is indeed clean, but I believe we could create a separate pull request in the future if this feature is requested.
What do think?
There was a problem hiding this comment.
Yes absolutely, this seems to be out of the scope of this PR :)
|
Thanks again for your contribution :) |
This PR aims to address flaws encountered in the initial, rudimentary LDAP implementation. The following improvements have been made:
With this PR, the remaining LDAP-related issues should either be resolved or significantly easier to troubleshoot.