Redmine

I tried the patch against 0.87 released code - I'm afraid the patch didn't apply cleanly.

I also read through the patch though, and it still requires you to authenticate/bind with a userid/password from the configuration prior to attempting to authenticate/bind with the user's provided account and credentials. I tried a variation on the theme, but found I needed to prefix the domain to the login to authenticate/bind to AD over LDAPS.

Hello Joe,

I whipped up the patch on trunk, so I'm not too surprised it didn't work on stable. Regarding usernames with AD: yeah, AD is a little picky, but you'ld have to prefix the login with the domain either way, even with the stock LDAP implementation, but I think it's mentioned in the guide (I've never worked with AD though, so that's all hear-say more than evidence).

Regarding the need to connect to the LDAP server with the "global" credentials upfront:

To avoid this, it is good practice in the LDAP world to use the "application" LDAP user to look up the DN corresponding to a username, and then look up additional attributes when connected as the user itself, not as the "application" user.

Basically, most LDAP servers will only let you connect using a DN, you can't just use the "login" redmine uses, so the authentication scheme first must find the DN corresponding to the login name using the "redmine" DN, and can then connect to the LDAP server with the user DN. Currently, all operation are done through the redmine DN, which forces you to have a user in LDAP that has read rights on the names and mail addresses of everyone, with the approach of first looking up the DN corresponding to the login, you only need the redmine user to have search rights on the login attribute in LDAP.

I'm sorry if that's not very clear, but english is "only" the third language I learned. Tell me if there still is any understanding problems so I can try to be clearer.

Any news on this suggestion? I'm sure the patch won't work with the current trunk. But the basic idea behind it sounds good.