en Copyright 2025 Java http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#fb75804e73edf4af608854927a231691f3206614 Parse AD bind error messages for more info for the userThis is mainly to tell users when their password expired or needs to bechanged. List of files: /plugin/pureldap/classes/Client.php Thu, 17 Jul 2025 13:50:14 +0000 Andreas Gohr <gohr@cosmocode.de> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#8de38791cf886488409c01fa96863987a6ea7b51 fix potential issue where attributes return null List of files: /plugin/pureldap/classes/Client.php Wed, 02 Apr 2025 06:42:54 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#208fe81a1d46425114eb6a90e8eceeed153c5f2d automatic code style fixes List of files: /plugin/pureldap/classes/Client.php Tue, 05 Dec 2023 08:13:56 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#fde03b26149f0ebff6109fe8c2d86025aab47455 better debugging and handling of suffixPeople tend to configure the suffix with a prepended @. This will faillogins in non-obvious ways. We now strip the @ prefix and also give theconnecting user in the debug message List of files: /plugin/pureldap/classes/Client.php Mon, 21 Aug 2023 12:55:23 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#0f498d06932ad0cbbdcc8844b96d4913174c7968 implement password expiry warnings. fixes #4 List of files: /plugin/pureldap/classes/Client.php Thu, 03 Aug 2023 15:48:44 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#08ace392be71b69ddc8b1eda246fad47272b7606 support password changesInternally this also changes the behviour to stay authenticated as theactual user if the user logged in. This is needed to allow self-servicepassword changes.This commit also contains a few cleanups. List of files: /plugin/pureldap/classes/Client.php Wed, 02 Aug 2023 10:08:55 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#5dcabeda2fad4e4ee9d5e2783f1e5e830b0344f4 make use of file system caching optional List of files: /plugin/pureldap/classes/Client.php Fri, 30 Jul 2021 06:22:05 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#22654fdec35cb8c2bc6368625db77310d71208fb disable logout for SSO setups List of files: /plugin/pureldap/classes/Client.php Wed, 21 Jul 2021 07:37:15 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#bf69b89c042d8a8a10fdd1dd78cc14b8f933bfe1 first go at SSOThis basically copies the functionality from authAD List of files: /plugin/pureldap/classes/Client.php Wed, 21 Jul 2021 06:43:26 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#1a4f0e1fa6c42b78818a8d9f911c237f852b4b22 avoid duplicating defaultsWe need the defaults in the Client for better testability, but insteadof defining them twice, we can simply load the defaults file ourselves. List of files: /plugin/pureldap/classes/Client.php Thu, 15 Jul 2021 07:56:07 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#c2500b4410d7943a5b4952a0bb25d20d1a95cb79 make the primary group configurableBecause the Domain Users group can be localized, this makes itconfigurable. The authAD library had a config to use "real" primarygroups where it would look up the primary group by calculating the SIDand doing another check. We could copy that mechanism if needed lateron. List of files: /plugin/pureldap/classes/Client.php Thu, 15 Jul 2021 07:47:31 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#204fba68543421287b88b2a48c04b5dea32b5394 group handling improvements* properly handle uppercase group names* use constants for filter types* properly handle Domain Users lookups List of files: /plugin/pureldap/classes/Client.php Thu, 15 Jul 2021 07:01:54 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#c872f0e3c6049bf7ad80e5c90ad6194297b63953 improve logging mechanismsMakes use of the new error logging mechanism when running on master,uses allowdebug to print end user messages. List of files: /plugin/pureldap/classes/Client.php Thu, 08 Jul 2021 11:19:46 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#a1128cc0f2573cbe769f582d613c9ccb9fc94dee rework username handlingBackground Info---------------Active Directory has at least three different way how users areidentified:1) sAMAccountName: userThe sAMAccountName is what users usually know as their username. It'swhat they usually log in with on their workstation. It is howeverlacking the actual domain to which to login. Typically it is prefixed bya netbios domain for login. Eg. DOMAIN\userNote: The samaccount name is also limited to 20 characters because oflegacy reasons.2) userPrincipalName: user@domain.somethingThe userPrincipalName contains something that looks like a domain. Butit may be actually different to the Domain managed by the AD. Becauseof... reasons? See https://serverfault.com/a/9281163) bind ID: user@domain.extNow, loggin in (eg. doing a LDAP bind) can use different mechanisms. TheuserPrincipalName works, user@domain (different from the UPN) shouldwork too.DokuWiki requirements:----------------------In DokuWiki we need a unique username, that stays the same on everylogin. (logging in with or without the domain part should identify thesame user).We also need this name to be usable to run additional LDAP queries. Eg.find groups with this user name.We also want users to be able to login without having to type the domainpart.This patch----------So with this patch we use the samaccount name to identify a user. Forlogging in, we add the configured account suffix (aka the domain). Afterthat we only use the domainless user name everywhere.In a future update we may (re)introduce the multidomain support fromauthAD. When we do, this will probably force us to use the suffix partin the usernames to different different domain users (something theauthAD plugin doesn't do which is probably wrong). But for most peoplethe single suffix approach should be fine. List of files: /plugin/pureldap/classes/Client.php Thu, 08 Jul 2021 09:33:55 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#9c590892fd92272f32265b97584f4f97be2fffc7 only fetch the attributes we needthis should lower the memory requirements and might speed things up abit List of files: /plugin/pureldap/classes/Client.php Wed, 07 Jul 2021 11:14:48 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#b914569fe2bf0cc586f78951bd0c636bc6597916 allow fetching of additional user attributesCurrently we reuqest all attributes from the server and only filterlater. This needs fixing. List of files: /plugin/pureldap/classes/Client.php Wed, 07 Jul 2021 10:57:14 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#9446f9efcf6a07f32e7ce6e6706899c1a2a9ef42 fix admin user access List of files: /plugin/pureldap/classes/Client.php Wed, 07 Jul 2021 09:01:02 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#8b2677ed853ea95dff78fc187fcaa99cb99f824a give hint on failing admin access List of files: /plugin/pureldap/classes/Client.php Wed, 07 Jul 2021 08:41:58 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#6d90d5c87387cafcb884bda8c1b3c7ab80656146 some cleanup for the options List of files: /plugin/pureldap/classes/Client.php Wed, 07 Jul 2021 08:18:34 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/plugin/pureldap/classes/Client.php#80ac552f15be014c3406f65bcaa71e07c7c359c8 convert between simple and complex usernames List of files: /plugin/pureldap/classes/Client.php Wed, 01 Apr 2020 19:00:01 +0000 Andreas Gohr <andi@splitbrain.org>