Kanboard: LDAP grops not getting syncronized

[stertingen]

Regarding: https://docs.kanboard.org/en/latest/admin_guide/ldap_groups.html

Actual behaviour

LDAP groups are not getting synronized into Kanboard groups, but admin and manager permissions are assigned correctly.

Expected behaviour

I would expect a list of all LDAP groups in the Kanboard group overview.

Steps to reproduce

1. Set up Kanboard and LDAP server (389-DS in our case) with POSIX groups
2. set up LDAP configuration as described below
3. Log in using an LDAP user
4. View groups

Logs

Nothing, really.

Configuration

• Kanboard version: Commit efed94b23d592647f889ef03b144a91e8fbb6098
• Database type and version: sqlite 3.8.7.1
• PHP version: 5.6.40-0+deb8u4
• OS: Server: Debian GNU/Linux 8.11 (jessie), Linux 3.16
• Browser: Chromium

config.php (interesting parts, skipping LDAP user authentication, which works fine)

166 // LDAP DN for administrators
167 // Example: CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local
168 define('LDAP_GROUP_ADMIN_DN', 'cn=turag_admin,ou=Groups,dc=fsr,dc=et,dc=tu-dresden,dc=de');
169 
170 // LDAP DN for managers
171 // Example: CN=Kanboard Managers,CN=Users,DC=kanboard,DC=local
172 define('LDAP_GROUP_MANAGER_DN', 'cn=turag_mod,ou=Groups,dc=fsr,dc=et,dc=tu-dresden,dc=de');
173 
174 // Enable LDAP group provider for project permissions
175 // The end-user will be able to browse LDAP groups from the user interface and allow access to specified projects
176 define('LDAP_GROUP_PROVIDER', true);
177 
178 // LDAP Base DN for groups
179 define('LDAP_GROUP_BASE_DN', 'ou=Groups,dc=fsr,dc=et,dc=tu-dresden,dc=de');
180 
181 // LDAP group filter
182 // Example for ActiveDirectory: (&(objectClass=group)(sAMAccountName=%s*))
183 define('LDAP_GROUP_FILTER', '(&(objectClass=posixGroup)(cn=%s*))');
184 
185 // LDAP user group filter
186 // If this filter is configured, Kanboard will search user groups in LDAP_GROUP_BASE_DN with this filter
187 // Example for OpenLDAP: (&(objectClass=posixGroup)(memberUid=%s))
188 define('LDAP_GROUP_USER_FILTER', '(&(objectClass=posixGroup)(memberUid=%s))');
189 
190 // LDAP attribute for the group name
191 define('LDAP_GROUP_ATTRIBUTE_NAME', 'cn');

[rafacamargo123]

I've read the documentation (https://docs.kanboard.org/en/latest/admin_guide/ldap_groups.html) and made some tests.
This is how it works:

• On project permission page, groups section, what you type on the group name field will be added to LDAP_GROUP_FILTER to search for the group name. All of your LDAP groups that matches your settings will appear there. You can change the filter from ...cn=%s*... to ...cn=*%s*... to find groups containing that string on any portion of the name, not only at the beginning.
• AFTER you add a LDAP group to a project, this group will be created on kanboard and you will be able to see it on Groups page.
• AFTER a group is added to a project, hence created on the application, when a user that belongs to this group logs in it will be added to the group.
• Groups are not automatically created on login.

So, first, try to search the groups on a project permission page.
Then, add that group to a project. At this step, groups should be created and appear on Groups page.
Then, ask for the users to log out and then login again to the application. At this step, group membership should be updated based on which groups the users belongs to.

[stertingen]

Works great, thank you!

To make this easier for new admins, a small note in the docs would be nice. (Something like the above comment)

[tareko]

Thank you for that! It took me a while to figure it out. It would definitely make more sense to allow group assignment...

tarek : )