LDAP JAuthTools CB Problems

[megaburn]

Hi,
I'm having two problems with LDAP, JAuthTools, and CB.

First issue, when a user with an LDAP account logs into Joomla for the first time they get an error: "LDAP Modify failed: invalid syntax". Everything seems to work correctly, their account is created in Joomla and CB, with CB approval and validated email, but that error showing up confuses people. Best guess its trying to add the JoomlaUserParams attribute without setting a value, I ran into that problem earlier when I tried to add it manually - if no value is set the server says invalid syntax but I don't know what values to set manually (schema says free form text).

Second issue, this is more fundamental to how the JAuthTools User-LDAP plugin works... When a new user registers in Joomla their LDAP account is created immediately, regardless of if they use a valid email address. This poses a security issue in that they can then login on all other sub-sites which rely on that LDAP account for authentication but which do not recognize the JoomlaBlockUser attribute - including other phpBB3, MediaWiki, b2evolution, FusionForge, etc... Emailing them a random password would also suffice but the CB auto-confirm hack appears to break auto-generate password feature, it returns an error saying the username/password is already in use (then creates the account in Joomla, not LDAP, and without sending the welcome email with the random password). Is there a way to have User-LDAP delay creating the LDAP account until, either: their email address is confirmed -or- they login to Joomla for the first time (i.e. just after following the email confirmation link)? Is there an alternative to the CB auto-confirm hack?


Environment Details:
-- JAuthTools 1.5.4, only using User - LDAP plugin, not full SSO (yet)
-- CB 1.2.1, with auto confirm hack
-- Joomla 1.5.11
-- PHP 5.1.6
-- Apache 2.2.3
-- OpenLDAP 2.3.43
-- CentOS 5.2


Config Details:
-- CB Registration: Allow User Registration: Yes, independently of global setting; Autogenerate random registration password: no (broken, yes if fixed); Admin approval: no (required no); Require email confirmation: yes (required yes or email random password); Ajax Username Checker: no (broken, no LDAP check); Ajax Email Checker: no (broken, no LDAP check). Note plain install, no third-party CB plug-ins (yet).
-- Authentication - LDAP: Auth method bind and search, "correct" (admin) username and password set, config works. Load order is before Authentication - Joomla.
-- User - LDAP: Template "Joomla OpenLDAP", GID# 19 (author), UID Offset 1000, home dir empty, config works.
-- CB auto confirm and approve hack details here, fixes CB's broken handling of existing LDAP accounts.
-- LDAP Schema: Copied from JAuthTools wiki - LDAP Tools/Schema.

Note, overall this is consistent with the config described in the LDAP From Scratch tutorial, except that I'm starting with preexisting LDAP accounts and using CB for profiles.


LDIF Sample
dn: uid=username,ou=users,dc=example,dc=com
cn: displayname
givenName: firstname
JoomlaBlockUser: 0
JoomlaGroup: Author
mail: [email protected]
objectClass: inetOrgPerson
objectClass: JoomlaUser
objectClass: top
sn: lastname
uid: username
userPassword: {MD5}...

Can I add the JoomlaUserParams attribute with some placeholder value?


General Notes
This is for a non-profit open source game development community site, not an intranet, hosted on Linode VPS's. Fixing these basic auth problems is the last major issue in completing the first phase of building a large scale community site. Next phase is adding more VPS's, multiple Joomla portals, multiple FusionForge based game-specific "modforges" (FusionForge is similar to Gforge used on Joomlacode.org but its GPL), setting up LDAP group structure, and adding LDAP+Kerberos+HTTP site-wide SSO - this is a couple months off. Also want to get CB to sync user profile data with LDAP (haven't figured out how it works yet, and I'm not buying their docs for a non-profit project).

Any suggestions to improve this setup? Anyone interested in helping? (had to ask)


EDIT: I'm camped out on [url=irc://irc.freenode.net/joomla]FreeNode #Joomla[/url] helping people and asking for help, please drop in if you have any ideas for my problems or some free time to help others...


Thanks,
-Chris

[megaburn]

This can be marked as solved but bugs remain.

Solution: Import preexisting LDAP accounts into Joomla, remove CB auto-confirm hack, and enable random password generation with email confirmation disabled (both enabled garbles the password).

Better Solution: Develop a non-bugged solution to the CB auto-confirm problem -and- add a check to User-LDAP to ignore user accounts with an activation code, so they are auto created in LDAP on their first Joomla login, not at registration.