[NGO] Re: ldap vs generic plone authentication

[Sam Stainsby]

On Mon, 25 Sep 2006 17:29:01 +0200, sisi wrote:

 
> Can't I just use normal plone authentication and then use a script on
> the plone server to dump the information into ldap on our office network
> server?
> 
> Is there anyone who has used ldap on their plone site to communicate
> with an ldap server in a remote location? And why did you choose to do
> this? I'm just not a database expert, ldap is giving me a headache and I
> really can't remember why I made the decision I made anymore!

I'll plug this project again :-) I've mentioned the work before, but back
then it was only a possibility that it was going open source. Now I can
confirm that it is being open sourced. What it really needs is some
sponsorship in the form of funds and other resources to get it moving.

I have built such a system for a client, when Plone forms a
staff/volunteer/member/contact database, and then all of the details of
the users and groups (groups are committees, campaigns, offices, org.
units, etc.) are exported to an LDAP server every 15 minutes or so. The
LDAP server is then used for authentication and group-based authorisation
in other applications throughout their intranet (well, just a couple
currently, but the concept has been proven and it works). There is even
potential for controlling things like Postfix mail servers & mailing lists
through this approach (set up a group in the Plone membership database,
then check a box to create a mailing list for it). 

I'm currently working on an open source version of this, using Plone PAS &
membrane to make it simpler, and code donated from two of my clients that
have similar systems. Progress is very slow however, because I have no
resources other than the donated code and a tiny amount of spare time. If
people have resources that they could put into this project, then it would
progress much faster.

There is a lot more to it as well. Some features that are currently
implemented in the donated code:

* membership application and fee payment workflows
* regular fee/donation payment schedules
* form letters that can create a mail merge from any Plone "smart folder"
that generates contact lists - generated letters and mailing lists are
exported in PDF
* export of contact data into spreadsheets (CSV) from any Plone "smart
folder" that generates contact lists
* automatic workflow steps that detect due or overdue membership fees,
etc. and move members into - combined with the form letter generation,
this means you can send batches of letters to due and overdue members *
authentication provided to
members/staff, controlled by workflow (so can centrally disable their
account on all systems by changing their workflow state from, say,
"member" to "contact")
* email & SMS messaging for contacts or entire groups through the web

These are heavily customised for the clients, and so need to be made more
generic. The idea would be to separate the larger features into different
modules. Currently in the open sourced work, I have the new membrane-based
user authentication part working.