Restrict user access to scalar for a particular domain about scalar

[ccc2lu]

@pguerr061703 -- those LDAP settings look generally correct to me. Here's what I use at Lehigh University, with the hostname of the LDAP server just redacted:

$config['use_ldap'] = 1; // Default: off
$config['ldap_server'] = "ldap.server.name.lehigh.edu";
$config['ldap_port'] = 389;
$config['ldap_basedn'] = "dc=lehigh,dc=edu";
$config['ldap_uname_field'] = "uid";

I recommend just doing some testing with an LDAP utility to make sure doing LDAP searches finds users with the username field and base DN settings you're using. To get to the values I have above, I used a phpldapadmin instance that we have here -- I experimented with the search filter to determine that it was the uid attribute in our LDAP configuration that contained the part of our e-mail address that matches usernames here. Do you have access to someone at Fordham who knows details about your LDAP configuration, and could help you get setup with a utility like phpldapadmin to do test searches?

[craigdietrich]

Hi @pguerr061703

If you'all use an LDAP server, there's room for that already built into Scalar; see the LDAP fields in the config file: https://github.com/anvc/scalar/blob/master/system/application/config/local_settings.php

Other than that, you could add some lines of code to the login model at https://github.com/anvc/scalar/blob/master/system/application/models/login_model.php that does a simple string search for "fordham.edu" ... I don't see why this wouldn't work like you need.

Let us know how it goes!
Craig

[pguerr061703]

Excellent suggestions. I will test them out. Thank you.
-Patrick

[pguerr061703]

Will this work ? I want to confirm before implementing? Should the use_ldap variable be set to true?

$config['use_ldap'] = true; // LDAP authentication is off by default
$config['ldap_server'] = "university-LDAP-server.edu";
$config['ldap_port'] = university-port;
$config['ldap_basedn'] = "ou=people,o=university.edu,o=cp";
$config['ldap_uname_field'] = "university-LDAP-account";

[craigdietrich]

LDAP isn't my specialty but that looks right. I say go for it :)

[pguerr061703]

LDAP entries. It didn't work. Not sure why. Can you provide me a line I could use to add to login_model.php to only allow emails with "fordham.edu" to register to scalar. This may be an easier alternative.

I am not PHP admin, so I am unsure how to do this.
thank you

[craigdietrich]

Real quick, if @ccc2lu is watching this thread, he added the LDAP settings, so he might be able to help out with that. @ccc2lu any thoughts?

[pguerr061703]

It didn't work. I am not sure I want to configure LDAP.
Can someone please assist with adding lines to login_model.php to only allow emails with "fordham.edu" to register to scalar

[craigdietrich]

@pguerr061703 Why don't you give this a try: if you open up the user model,

https://github.com/anvc/scalar/blob/master/system/application/models/user_model.php

Then search for the "register" function, I think you could simply place this at the top of the function (ie, before the line that says "// ReCAPTCHA version 1"):

if (!stristr($array['email'], 'fordham.edu')) throw new Exception('Only email addresses under the fordham.edu domain may register on this Scalar install');

This will cause the register page to return that error message if the email address isn't a fordham one....

Let me know how it goes?

[pguerr061703]

You are awesome!!! Thank you kindly! Much appreciated.

[craigdietrich]

You bet @pguerr061703!