Univention Bugzilla – Bug 46336
Make portal entries visible only for authenticated users of certain groups
Last modified: 2018-03-20 09:12:17 CET
The portal should support adding a user group to its definition. If (and only if) a group is added to the entry, the entry is not visible for anonymous users. It is furthermore filtered for all users not in that particular group.
Fixed in univention-management-console 10.0.3-4A~4.3.0.201802191308 univention-appcenter (7.0.1-9) univention-directory-manager-modules (13.0.19-12) univention-ldap (14.0.2-10) univention-portal (2.0.0-3) The following LDAP attribute is now deprecated (without ever being useful): univentionPortalEntryAuthRestriction The feature requires the memberOf overlay to be working. This feature does not support groups in groups (it uses memberOf).
If have used Bug#46270 in the changelogs.
Wouldn't it be good to use os.initgroups(username, id)? That would fetch all group memberships via standard (nss) interfaces which also support caching.
Maybe os.getgrouplist would be better, but that seems to be only in Python 3, of the cuff I have no clue how getgrouplist relates to initgroups and nss.
Agreed, syscalls may be better. But only python3 supports the required method. We experienced performance issues with the methods in python2.7. So for now, we should stick to LDAP and no "groups in groups". We should reconsider after we upgraded Python.
OK: It works with users in more than 100 groups and with group unlauts. Fail: I'm unable to see the portal entries for my test user on the DC backup if the DC master slapd is stopped. That doesn't look right since I'm able to login in UMC on the backup even if the DC master slapd is stopped.
I'll try it again after fixing Bug #46376.
(In reply to Stefan Gohmann from comment #6) > OK: It works with users in more than 100 groups and with group unlauts. > > Fail: I'm unable to see the portal entries for my test user on the DC backup > if the DC master slapd is stopped. That doesn't look right since I'm able to > login in UMC on the backup even if the DC master slapd is stopped. Fixed through Bug #46376. Everything else works fine. (In reply to Dirk Wiesenthal from comment #1) > The feature requires the memberOf overlay to be working. > > This feature does not support groups in groups (it uses memberOf). I've added a note to the manual bug: Bug #46391.
UCS 4.3 has been released: https://docs.software-univention.de/release-notes-4.3-0-en.html https://docs.software-univention.de/release-notes-4.3-0-de.html If this error occurs again, please use "Clone This Bug".