LdapNgPlugin

Query and display data from an LDAP directory

This plugin provides an interface to query an LDAP directory and display the results in a WikiApplication It is a complete rewrite of the Foswiki:Extensions/LdapPlugin by Gerard Hickey to provide greater flexibility and performance based on the Foswiki:Extensions/LdapContrib package.

Syntax Rules

LDAP

%LDAP{(filter=)"filter" ...}%

Query an LDAP directrory.

Parameters:

• filter: the LDAP query string
• host: host IP or name to connect to
• port: port to of the host
• version: protocol version; possible values: 2,3
• ssl: use ssl to bind to the server; possible values 0,1
• base: base dn of the (sub)tree to search in; if base is written in brackets (e.g. 'base="(ou=people)"') then it is prepended to the default base of the LdapContrib
• scope: scope of search; possible values: sub, base, one
• format: format string used to display a database record
• nullformat: format string to be used when no results have been found, defaults to the empty string
• header: header to prepend the output; default: '$dn'
• footer: footer to appended to the output
• separator: separator between database records; default: '$n'
• value_separator: separator when joining list values; default: ', '
• sort: name of attributes to sort the output (this feature is currently disabled)
• reverse: reverse the result set; possible values: on, off; default: off
• limit: maximum number of records to return; default: 0 (unlimited)
• skip: number of records in the hit set to skip before displaying them; default: 0
• exclude: regular expression matched against the dn of a returned record. the record will be skipped if it matches.
• casesensitive: switch this to off for the exclude and include parameter to operate in case-insensitive mode
• include: regular expression matched against the dn of a returned record. not matching record will be skipped.
• hidenull: wether to hide any output on an empty hit set; possible values: on, off; default: off
• clear: comma separated list of attributes to be removed from the output if they are not resolved
• cache: time in seconds the result of the ldap query will be cached and not fetched anew; defaults to $Foswiki::cfg{Ldap}{DefaultCacheExpire}, or 0 if not set.
• blob: comma separated list of attributes to be handled as blobs, like images stored in your LDAP directory.

Cgi Parameters:

• refresh: refresh the cache of blobs (i.e. jpegPhotos); possible values: on, off, ldap; default: off;

The header, format and footer format strings may contain the following variables:

• $percnt: % sign
• $dollar: $ sign
• $n: newline
• $count: the number of hits
• $index: the record number
• $<attr-name>: the value of the record attribute <attr-name>

LDAPUSERS

%LDAPUSERS{...}%

List all LDAP userinformation. Information is drawn from cache and not from the LDAP server. Use ?refreshldap=on to update.

Parameters:

• format: format string used to display a user record
• header: header to prepend the output
• footer: footer to appended to the output
• sep: separator between database records; default: '$n'
• limit: maximum number of records to return; default: 0 (unlimited)
• skip: number of records in the hit set to skip before displaying them; default: 0
• include: regular expression a user's WikiName must match to be included in the output
• exclude: regular expression a user's WikiName must not match
• casesensitive: switch this to off for the exclude and include parameter to operate in case-insensitive mode
• hideunknown: on/off, enable/disable filtering out users that did not log in yet and thus have no hometopic (e.g. created by Foswiki:Extensions/NewUserPlugin), defaults to 'on'

The format string may contain the following variables:

• $percnt: % sign
• $dollar: $ sign
• $n: newline
• $index: the record number
• $wikiName: the user's WikiName
• $loginName: the user's login name
• $displayName: a link pointing to the users hometopic in the Main web, if it exists, and '<nop>$wikiName' otherwise
• $emails: the list of all known email addresses

Examples

Query user accounts

%LDAP{"(objectClass=posixAccount)" 
  base="(ou=people)"
  limit="100" 
  cache="3600"
  header="| *Nr* | *Name* | *Mail* | *Telephone* |$n" 
  format="| $index | $cn | $mail | $telephoneNumber  |" 
  sort="cn"
  clear="$mail,$telephoneNumber, $cn"
}%

Query user groups

%LDAP{"(objectClass=posixGroup)" 
  base="(ou=group)" 
  limit="100" 
  cache="3600"
  header="| *Nr* | *Group* | *Members* |$n" 
  format="| $index | $cn | $memberUid |" 
  clear="$mail,$memberUid"
  sort="cn"
}%

Display cached users records

%LDAPUSERS{limit="10"}%

Plugin Settings

The LdapNgPlugin will use the default configuration of the LdapContrib in your LocalSite.cfg file, that is

• $Foswiki::cfg{Ldap}{Host} (overridable per query)
• $Foswiki::cfg{Ldap}{Port} (overridable per query)
• $Foswiki::cfg{Ldap}{Base} (overridable per query)
• $Foswiki::cfg{Ldap}{Version} (overridable per query)
• $Foswiki::cfg{Ldap}{SSL} (overridable per query)
• $Foswiki::cfg{Ldap}{BindDN}
• $Foswiki::cfg{Ldap}{BindPasswd}

Installation Instructions

You do not need to install anything in the browser to use this extension. The following instructions are for the administrator who installs the extension on the server.

Open configure, and open the "Extensions" section. "Extensions Operation and Maintenance" Tab → "Install, Update or Remove extensions" Tab. Click the "Search for Extensions" button. Enter part of the extension name or description and press search. Select the desired extension(s) and click install. If an extension is already installed, it will not show up in the search results.

You can also install from the shell by running the extension installer as the web server user: (Be sure to run as the webserver user, not as root!)

cd /path/to/foswiki
perl tools/extension_installer <NameOfExtension> install

If you have any problems, or if the extension isn't available in configure, then you can still install manually from the command-line. See https://foswiki.org/Support/ManuallyInstallingExtensions for more help.

If you are using LdapNgPlugin together with LdapContrib to integrate LDAP users to Foswiki you might also want to display an according list of all WikiUsers. Therefore LdapNgPlugin comes with a view template that you have to apply to the WikiUsers topic. Do so either by adding

   * Set VIEW_TEMPLATE = LdapWikiUsersView

or by adding

$Foswiki::cfg{Plugins}{AutoTemplatePlugin}{ViewTemplateRules} = {
...
    'WikiUsers' => 'LdapWikiUsersView',
...
};

to your LocalSite.cfg in case Foswiki:Extensions/AutoTemplatePlugin is installed as well.

Please do not use the LdapWikiUsersView template in case your are running Foswiki:Extensions/SolrPlugin as well which implements a fast solr-based person search with a different SolrWikiUsersView template.

Dependencies

Name	Version	Description
Foswiki::Contrib::LdapContrib	>=7.80	Required
Cache::Cache	>=1.05	Required

Change History

10 Oct 2017:	fixed decoding of dn
30 Aug 2017:	adjustments to recent changes in LdapContrib API
16 Jan 2017:	fix querying for users at all of the DNs configured in {UserBase}
02 Sep 2016:	added nullformat parameter to %LDAP macro
23 May 2016:	added value_separator to fetch multi-value attributes from LDAP
31 Aug 2015:	added support to index profile images stored in LDAP and indexed in Solr
16 Dec 2014:	added view template for WikiUsers; more robust extraction of user information while indexing profiles with Foswiki:Extensions/SolrPlugin; wrapping examples into verbatim sections not to expose usernames by default
18 Mar 2014:	disable sorting temporarily as Net::LDAP::Search::sorted() destroys the result set on directories with references; added IgnoreViewRightsInSearch feature when indexing UserTopics using SolrPlugin; properly recode strings coming from the directory
29 Nov 2012:	fixed performance problem for simple queries; fixes due to the latest changes in LdapContrib; fixed too many open file handles on long running solrindexing; don't index empty email fields using SolrPlugin
21 Nov 2012:	fixed switching off the %LDAP cache when there's a global default; rewrite of formatting code; fixed fetching referrenced objects
19 Nov 2012:	added casesensitive include/excluding
09 Nov 2012:	added integration into SolrPlugin's index process by augmenting user profiles with ldap attributes
20 Dec 2011:	added cache paremeter to %LDAP
17 Nov 2010:	added exclude and include parameter to %LDAP
17 Nov 2009:	renamed sep parameter to separator for consistency
27 Jan 2009:	syncing version number with LdapContrib
08 Jan 2009:	ported to foswiki
12 Jun 2008:	fixed yet another "sep" problem
13 Nov 2007:	fixed $nop
01 Oct 2007:	added LDAPUSERS, lined up to changes in LdapContrib-2.0
04 June 2007:	don't convert from/to utf8 if the site charset is already utf8
18 Dec 2006:	added support for addresses as specified in RFC4517
04 Dec 2006:	map utf8 strings from LDAP to the site's encoding and vice versa
30 Nov 2006:	replaced commonTagsHandler with a properly registered LDAP tag
31 Aug 2006:	added NO_PREFS_IN_TOPIC
19 Jul 2006:	public release
25 April 2006:	Initial (internal) version