Latest package with LDAP add-on
-
@imc67 Ah, you're right, it's the username. I was using my email on my Cloudron user account, not the Cloudron username itself. This is unfortunate though, I prefer to login with my email address whenever possible. Oddly enough, this has worked before (this is how I currently login to all of my Managed Cloudron app instances), so I wonder why this behaviour has changed recently.
-
@d19dotca said in Latest package with LDAP add-on:
@imc67 You had to install the plug-in? That doesn’t make sense though... LDAP option has to install that automatically. Maybe that’s the issue here then.
It was because I migrated a unmanaged WP to a developer WP
-
@d19dotca I checked in 2 separate cloudrons and I can login immediately with my cloudron credentials. Cloudron uses get editor role, by default. You can change this as an admin though in the WP Admin Panel -> Settings -> authLdap -> Default Role.
Also, to double check what @imc67 said, are you logging in by username or email? Logging in by email is not supported.
-
-
@Lonk said in Latest package with LDAP add-on:
Is this a Cloudron LDAP limitation or just a Wordpress LDAP integration limitation? Because some web apps only have email and password for login
This is just for consistency across all apps (not just WP). The general flow we are going for is:
- You have an admin user. Admin user is important to exist in the case the LDAP is not working (for whatever reason like networking issue).
- Cloudron users can login with username into apps (not email). Only exception is webmail apps, that require email to login.
- The admin user can make a cloudron user an administrator inside the app. We want to delegate all role/permission management to the app itself. Cloudron will only do authentication and not authorization.
Note that we arrived at this flow from experience and trial/error. So, it's just being pragmatic.
-
@girish said in Latest package with LDAP add-on:
@Lonk said in Latest package with LDAP add-on:
Is this a Cloudron LDAP limitation or just a Wordpress LDAP integration limitation? Because some web apps only have email and password for login
This is just for consistency across all apps (not just WP). The general flow we are going for is:
- You have an admin user. Admin user is important to exist in the case the LDAP is not working (for whatever reason like networking issue).
- Cloudron users can login with username into apps (not email). Only exception is webmail apps, that require email to login.
- The admin user can make a cloudron user an administrator inside the app. We want to delegate all role/permission management to the app itself. Cloudron will only do authentication and not authorization.
Note that we arrived at this flow from experience and trial/error. So, it's just being pragmatic.
Thanks for such a detailed explanation of your thought pattern and flow. But it does make me wonder why email wouldn’t be included in making a user have the ability to login. Wordpress only user usernames for years but so many people installed a “login via email” that they gave in. So I was wondering why wouldn’t Cloudron’s LDAP consider both email or username as a valid “username” for LDAP purposes. Or is that a limitation of the LDAP protocol?
-
@Lonk said in Latest package with LDAP add-on:
So I was wondering why wouldn’t Cloudron’s LDAP consider both email or username as a valid “username” for LDAP purposes.
On Cloudron, you can change the email (but not username). So, If you change the email, then try to login to the app, it may not work anymore because some apps store the email in their local database and to get them to change the email address, they have to "sync" with the cloudron directory correctly. This again depends on each app but for the end user it just causes confusion sometimes that they cannot login (especially since the browser remembered the email as their previous login...)
-
@girish Sorry I thought I already responded yesterday but apparently didn't save my comment. lol. So yeah, the issue was the format of the username, it was what @imc67 noted earlier.
What's strange to me though here is that this was never a restriction before, right? I currently log into all my Managed WordPress installs using my email for Cloudron LDAP. Was this restriction to username only recently added?
Any way to change back the behaviour to email too? I know you said this is from a lot of learning and experience with trial and error, but for WordPress the login page says "username or email address", so I would expect us to login with either, not just one, otherwise the login page isn't exactly accurate at that point.
-
@girish said in Latest package with LDAP add-on:
If you change the email, then try to login to the app, it may not work anymore because some apps store the email in their local database and to get them to change the email address, they have to "sync" with the cloudron directory correctly.
Is there perhaps a way to make it so that when a Cloudron user logs into WordPress that their email is not-configurable and therefore must match what is in Cloudron LDAP? I'm thinking similar to how the website URL and such in WP Settings is not configurable through the GUI because it's set in the lower level files.
--
Dustin Dauncey
www.d19.ca -
@d19dotca said in Latest package with LDAP add-on:
Is there perhaps a way to make it so that when a Cloudron user logs into WordPress that their email is not-configurable and therefore must match what is in Cloudron LDAP?
The WP LDAP plugin we use does not allow users to lock the email address. It doesn't support syncing either. I do note that there is another plugin which supports syncing - https://wordpress.org/plugins/ldap-login-for-intranet-sites/ which wasn't around before.
Also, correct, I recently removed the email login to make it consistent with non-WP apps.
-
@girish said in Latest package with LDAP add-on:
@d19dotca said in Latest package with LDAP add-on:
Is there perhaps a way to make it so that when a Cloudron user logs into WordPress that their email is not-configurable and therefore must match what is in Cloudron LDAP?
The WP LDAP plugin we use does not allow users to lock the email address. It doesn't support syncing either. I do note that there is another plugin which supports syncing - https://wordpress.org/plugins/ldap-login-for-intranet-sites/ which wasn't around before.
Also, correct, I recently removed the email login to make it consistent with non-WP apps.
If I put in the work for this would you re-consider email attribute being considered in your Cloudron LDAP system, if only for Wordpress' sake?
Tbh, it was an uphill battle getting them to allow us to use our email addresses in the WP Core (almost everyone uses a plugin to do it previous to it being in core). Anyway, if syncing is your only issue, and if I was able to rectify that issue somehow, would this be a consideration for you to re-allow?
-
@girish Thank you for confirming. Glad to know I wasn't going completely crazy, haha. I'd love to be able to login with username and email, not limited to just one. I'd love to see that decision to only allow usernames be reconsidered, if possible.
--
Dustin Dauncey
www.d19.ca -
@d19dotca said in Latest package with LDAP add-on:
@girish Thank you for confirming. Glad to know I wasn't going completely crazy, haha. I'd love to be able to login with username and email, not limited to just one. I'd love to see that decision to only allow usernames be reconsidered, if possible.
I'm of the same mind, if only because I'm such a heavy Wordpress user and we all were so excited for email logins. So, if you're willing to switch stances, I'll cover whatever you need to happen on the Wordpress side (such as writing the code to sync user emails).
-
Another way of looking at it too (maybe I'm overthinking this though)... if the application itself states it can be "username or email" as WordPress login page does, then theoretically I should be able to login with both (either of them) as that is what the app allows. And if I can only use one, then I would view this new restriction to username-only as an artificial Cloudron limitation which wouldn't be made clear to people using the app from the app's login page. This could easily cause confusion with users who are expecting to login with their email because that's what it says they can do, but then we'd have to explain to them as admins that they can't actually do what the login page says.
In other words... if the app states I can use username or email, then I should not be restricted to only one, IMO.
--
Dustin Dauncey
www.d19.ca -
@d19dotca bain of a Sys Admins life logins eh!
Would love to see a Cloudron oAuth-type solution. I need some sponsored apps alive in the App Store first @Lonk
, then maybe we can assist with that.Web Design https://www.evergreen.je
Development https://brandlight.org
Life https://marcusquinn.com -
The "username or email" text is present in login screen of many apps - wekan, rocket.chat. gitlab, etc. The issue is that many of the apps do not sync the "email" field when they are changed on the cloudron side. Which means suddenly login won't work. The email login comes from the past where we didn't pay attention to these issues (just like we didn't pay attention to how many apps support OAuth and blindly implemented it).
I am not disagreeing with you guys here
I see both sides of it and one has to compromise somewhere. Maybe we can to spend time to go through all the apps and make email login work. Just having it work with 1 or 2 apps is causing confusion (how do you say it works in app x,y,z but not in others?). -
@girish said in Latest package with LDAP add-on:
Just having it work with 1 or 2 apps is causing confusion
Totally agreed. We should be consistent, for sure. I tried recently as a result of this to deploy Matomo for a test instance, and could login fine with the email still, so even at the "username-only" mantra it isn't consistent either.
-
@girish said in Latest package with LDAP add-on:
Maybe we can to spend time to go through all the apps and make email login work.
That works for me. We can revisit this in 2021 when we believe we can dedicate time to all apps to add the email field. LDAP is a simple enough protocol so it shouldn't be too hard but def a 2021 kinda thing.
Thanks for the insight, as always girish!
-
Yeah, I want to prioritize making the LDAP addon "dynamic" before spending time on this email login. i.e you can choose at whatever you want at install time. But later, you can always turn LDAP on/off dynamically.
-
@marcusquinn said in Latest package with LDAP add-on:
. I need some sponsored apps alive in the App Store first @Lonk , then maybe we can assist with that.
I had to finish my full app following all of Cloudron practices. So I underestimated how much time that was going to take. I made the last update to it today and it's ready for the store. So, now, I feel ready packing more now that I've finished mine completely.
