User import with LDAP

[thomsonza]

When checking assets out to users it would be great if it was possible to get a list of users from LDAP rather than having to add each of them individually.

[snipe]

This is a duplicate of #48, no?

[thomsonza]

I looked at #48 but it's not really the authentication, although the authentication part of it would be great. Not all of our users would have login access to the asset database but we would need to assign a computer to their name. I suppose they could be one and the same and just switch off logins for those users.

[snipe]

I had been sussing out how to handle that as well. Tracmor does this reasonably well, and it's worth considering to actually break it out the way they do, so you have contacts and users as a separate thing. Let me chew on that a little bit. I appreciate your input.

[technogenus]

We agree splitting system users and Asset assignable "contacts" is probably a better, more sustainable way to go. User would be LDAP authenticated, and Owners/Contacts would could easily be an LDAP sync or CSV import.

[snipe]

LDAP has always been on the roadmap, but it cannot be a requirement. The point of this project was to offer an IT asset management system to smaller organizations, and some of then won't have LDAP, or if they do, it may be difficult to accomplish integration within the organization.

I've looked at some LDAP packages which seem promising, so I doubt we'd need to reinvent the wheel, but it must remain an optional feature.

[technogenus]

Totally agree LDAP should always be an alternative auth mechanism. For our specific needs its a must (down the line... eventual... lower priority must), as well as an LDAP import/sync function but recognize we would be the minority case.

better wording:
User would be either dbstore Sentry or LDAP authenticated, and Owners/Contacts/People could easily be imported from LDAP, CSV, excel or other means.

[snipe]

Test server here may work for anyone looking to work on this feature: http://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/

[csayre]

OK. So I am a little confused here. I have read several requests dealing with LDAP integration for assigning devices to users. Is there a way to do this or not? I see that this case has the ready label. Does that mean that this has been implemented into SNIPE-IT?

[snipe]

No, this means it's ready to be worked on

[csayre]

Ah ok. I was a little confused. Any Idea of when it will be implemented?

[snipe]

Not sure - there aren't a lot of good libraries for LDAp at this point. I know a few people have mentioned they wanted to work on it, but I haven't heard anyone report back on progress, so I would assume it's not been started yet. (I know I haven't been working on it.)

[csayre]

The company that I am working for uses ticketos ( I know there were talks of integrating the two projects). Anything more on that? We need a solution that supports ad integration, i just stumbled upon this project today. I hope you guys get ldap or AD integration implemented relatively quickly, I would love to use this at our company, but that is a big selling point for our company.

[aalaily]

_If this is still of interest, I have created and tested an LDAP sync function. My goal was to create users that would never have access to the system but that use our services... hence I only need to track what they have and potentially communicate with them.
_How it works
You configure LDAP via an ldap.php file (url, usrename, password, search query, etc...) and then when you hit sync, the application connects to LDAP and fetches the required fields. Users are then created sequentially. For each user, a note is added to indicate that they were created using the LDAP sync script. In addition all accounts are automatically activated and no passwords are emailed. I've been able to import 5,000+ users in one go using it. I'm happy to submit a pull request but will need information on whether or not I need to create a specific branch (or the process defined for snipe-it)
_Some screenshots_
Screen 1

Screen 2

[snipe]

Hi @aalaily - nice work! A few questions:

• How does it handle existing users?
• How does it handle deleted users (users no longer in LDAP but still in Snipe-IT, OR users that were imported via LDAP sync and were marked as deleted in Snipe-IT)

[aalaily]

Hi Snipe,

_How does it handle existing users?_
If the user already exists in the system, the code simply skips over them and displays a message "exists" in the result page (which contains a summary of action for each user)
_How does it handle deleted users (users no longer in LDAP but still in Snipe-IT_
Right now the code doesn't cross-check. That is, if the user is not in LDAP but is still in Snipe-IT the user remains untouched. For this specific case, my thought was to mark them as inactive in Snipe-IT. That should be fairly easy to do.
_Users that were imported via LDAP sync and were marked as deleted in Snipe-IT_
That's a case I haven't tested yet... however, if the user still exists in the user table the code will simply not touch them.

_Extra functionality - LDAP authentication_
I've now been able to integrate LDAP into the login. If the user has "LDAP" in the "notes" field (as when they are imported by the sync script), the authentication goes against LDAP. This can be enhanced by adding a "authenticate against LDAP" checkbox in the user profile... but right now, it's looking at the "notes" field. Fort this functionality, the hook is added to the AuthController class's postSignin method.

[snipe]

This sounds great - I'd love a pull request against the develop branch so I can take a look. Thanks!

[aalaily]

No problem! I will submit a pull request and feedback will be much appreciated.

[aalaily]

OK... the pull request has been submitted.

[hansenc0705]

@aalaily - for existing users, is it matching off the LDAP username or email address?

[aalaily]

@kobie-chasehansen - it's matching on the username

[snipe]

This is now on develop

[ebjers]

How can I get the LDAP function added to my installation of Snipe-IT

I am using
Snipe-IT version v2.0-125-g9b04954
PHP Version 5.4.24
Laravel Version 4.2.17

running on 2012 R2

[snipe]

http://docs.snipeitapp.com/installation/configuration.html#optional-ldap-configuration

[ebjers]

Thank you

[klemenkobetic]

is this just an ldap importer (this means that each time i add an user to ldap i have to manually click import to import the user) or is it an adapter (it actually checks on ldap real time)? or both?

[ddreier]

Both-ish. It will import users from your directory into Snipe-IT, and then will attempt to authenticate against the directory for the users that have been imported.

AFAIK it is not actively/regularly checking for new users in your directory.

[snipe]

@ddreier You are correct - that's exactly how LDAP integration currently works. :)

[klemenkobetic]

interesting functionality. this means that i import users from ldap, change password in ldap and then it doesn't work anymore?

[snipe]

If LDAP is enabled, it will attempt to authenticate against the LDAP server before trying a local database user, IIRC

[snipe]

@NwaEze1 please open a new ticket - this one is closed.