Integration of SafeQ and Koha
We are trying to integrate users in SafeQ and our users in Koha. Koha is library system which stores it's users into relational database. To allow SafeQ system access to users we decided to implement LDAP protocol on top of our data scheme in Koha.
This is described in little more details at: http://blog.rot13.org/2009/03/integrating_systems_using_netldapserver_and_rdbms.html
Mapping configuration
Users
Examining UMgr-LDAP.conf configuration we came up with following mapping from our RDBMS to LDAP schema: http://svn.rot13.org/index.cgi/virtual-ldap/view/sql/hreduperson.sql
we are creating objectGUID with primary key in our database and rest of the fields should be self-explanatory.
This produce following result for LDAP search query:
dpavlin@koha-dev:/srv/virtual-ldap$ ldapsearch -h 10.60.0.13 -p 2389 -b dc=ffzg,dc=hr -x 'pager=E00401001F77965C'
# extended LDIF
#
# LDAPv3
# base <dc=ffzg,dc=hr> with scope subtree
# filter: pager=E00401001F77965C
# requesting: ALL
#
# dpavlin@ffzg.hr, SURAD, ffzg.hr
dn: uid=dpavlin@ffzg.hr,ou=SURAD,dc=ffzg,dc=hr
ou: SURAD
uid: dpavlin@ffzg.hr
objectGUID: 606
cn:: RG9icmljYSBQYXZsaW51xaFpxIc=
homeDirectory: /home/606
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: hrEduPerson
memberOf: SURAD
sn:: UGF2bGludcWhacSH
mail: dpavlin@rot13.org
pager: E00401001F77965C
givenName: Dobrica
displayName:: UGF2bGludcWhacSH
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
This works quite well, and I can see users with their's cards in SafeQ system.
Roles
Roles are mapped into groups using following mapping: http://svn.rot13.org/index.cgi/virtual-ldap/view/sql/group.sql
Which generate LDAP groups like this:
dn:cn=SURAD,ou=SURAD,dc=ffzg,dc=hr
members: uid=vivainfo,ou=SURAD,dc=ffzg,dc=hr
uid=dpavlin,ou=SURAD,dc=ffzg,dc=hr
ou: SURAD
cn: SURAD
description: Suradnici
objectClass: group
which produce groups in Role drop down:
Some more information about defining groups in ldap can be found at: http://blog.rot13.org/2009/04/ldap_haters_guide_to_groups.html
Const centre
Groups which we have defined in Koha are really only useful for reporting, so it seems that cost centres in SafeQ are the right place to import our groups.
We are trying to use following mapping: http://svn.rot13.org/index.cgi/virtual-ldap/view/sql/organizationalunit.sql
Idea is to expose same group data as organizationalUnits in SafeQ so we can get accounting by those groups. We would also like to have different prices for each group of users and ability to report using groups from Koha.
Changing configration to:
# Mapping of LDAP containers to SafeQ cost centres (departments)
# If enabled, all organisational units containers will be displayed in SafeQ as cost centres
# If disabled (no, false), attribute mapping is used - see ldap_ou
ldap_map_ou = yes
We get const centers mapped from our organizational units:
but all const centres have same number (0)
How can we supply SafeQ with correct cost center number so users can end up in correct one?
Possible bugs in SafeQ
LDAP search
I also found out something which seems like a bug in the way SafeQ search LDAP server: when you search for 'dpavlin' as login/alias I get following queries:
## filter and [
{ equalityMatch => { assertionValue => "HrEduPerson", attributeDesc => "objectclass" }, },
{ equalityMatch => { assertionValue => "dpavlin%", attributeDesc => "uid" }, },
]
objectclass is o.k., but uid looks like uid=dpavlin% which I think it should be uid=dpavlin* to be correct LDAP syntax.
This query doesn't return anything, but next one is o.k.:
## filter and [
{ equalityMatch => { assertionValue => "HrEduPerson", attributeDesc => "objectclass" }, },
{ substrings => { substrings => [{ any => "dpavlin" }], type => "uid" }, },
]
which is uid=*dpavlin* and it finds user.
Role/Cost Centere drop-down
Selecting role of const center doesn't change filtered output of users. I don't see any difference in LDAP search query when changing selected role and/or cost centar. Is that normal?