sugarcrm/sugarcrm_dev — pull request #150 by jda (2013-02-18 17:18:09+00:00)
Title: Added option to use LDAP user DN when checking group membership

The User DN was not used when checking if a LDAP user was a member of a directory.
This causes a problem if you have users in different OUs that overlap.
For example, you have a staff member jsmith and a student jsmith. Their LDAP path is different as they are in different OUs.

cn=jsmith,ou=staff,dc=example,dc=edu
cn=jsmith,ou=students,dc=example,dc=edu.

Using the User DN setting we can set sugar to search ou=staff,dc=example,dc=edu. Now, let's say only staff members that are in the group crm-users should be allowed to log in. Sugar checks group membership but only uses the username as the attribute value. Ie it searches for jsmith, not cn=jsmith,ou=staff,dc=example,dc=edu. This will fail as "jsmith" isn't a member of the group.

I've added a option to the LDAP Support settings, With User DN, that checks for group membership using the user DN and user attribute. When enabled a user is checked for membership as user_attribute=username,user_dn (cn=jsmith,ou=staff,dc=example,dc=edu instead of jsmith).

![sugarcrm ldap](https://f.cloud.github.com/assets/147783/168037/08336e96-79ee-11e2-8940-e6d13ac09ce1.png)