collectiveaccess/providence — pull request #133 by leftclickben (2014-07-28 05:56:35+00:00)
Title: Modifications for LDAP to be more configurable.

Notes for reviewer:

+ This works in our setup, which is Active Directory. YMMV with other directories.
+ THIS MAY BREAK for anyone using the old code. It is a better approach (see first point under details from commit message), which only uses a single LDAP search per login instead of sometimes requiring two. However the attribute name used by others is unknown, ours is "memberOf" but this may be different depending on directory (other default settings should be correct). Because of this I expect that this may not be merged, but if so then perhaps we can work out a middle ground, maybe a simple switch on "group_detection_method" or something like that, so that we can work out users based on groups (old method) or groups based on users (new method) depending on config.
+ You might want to ignore whitespaces as it will make actual changes clearer (e.g. append ?w=1 to github URL)

Details from commit message:

+ Change the way LDAP groups are checked. Previously it was searching for
the group, then looking for the user logging in in the group record's
"member" attribute. Now it is searching for the user, then looking for
the group in the user record's "memberOf" attribute (the actual name is
configurable).
+ Add configuration items for first name, last name and email attributes.
+ Add configuration items for the format of the RDN used in the bind()
operation, and the DN and filter used in the search() operation. These
configuration items can be built from other configuration items to
reduce repetition in the configuration.
+ Did some general code cleanup.