LimeSurvey/LimeSurvey — pull request #225 by wilberth (2014-10-07 09:30:55+00:00)
Title: optionally autocreate users

This commit was requested as an update to pull request https://github.com/LimeSurvey/LimeSurvey/pull/176 in the first comment by mennodekker.

This commit offers the option to automatically create users in the user database. Any person that authenticates with 'search and bind' LDAP will be added if not present yet. Users will have their full name a
nd e-mail address set from the LDAP database at creation time. After automatic user creation, they will be able to log on with LDAP credentials or (after resetting their password) with internal database cred
entials.

IMO http://bugs.limesurvey.org/view.php?id=8865 is not an issue of AuthLDAP. It is intrinsic to AuthPluginBase or to authentication plugins in general. Solving this would require not using an authentication
plugin but a 'user database plugin'. As long as it is well understood that AuthLDAP and AuthWebserver offer an alternative authentication method for the existing user and not an additional user list, the cur
rent behaviour makes sense.

This commit does not use the newUserLogin event in an extra plugin as was proposed in the original code. I think user creation belongs in this plugin. Doing it in an extra plugin requires a second LDAP conne
ction in another plugin before this plugin closes the connection. The added complexity is IMO not worth it.

This commit does not produce informative error messages. This is intentional. No information should be given about login failure reasons for safety reasons. Getting all plugin settings correct can be nuisan
ce because of this. It is therefore advisable to make sure the 'search and bind' LDAP is functional before activating this addition.

Possible future improvements:
- New users will have only 'survey create' permission. Make this configurable.
- Allowing creation of users after simple bind authentication.