Apache LDAP pass through authentication works fine for us as is with the security branch. I haven't tried it with the current trunk. The Galaxy roles/groups interface is being managed by our IRB admin - very easy and attractive option - but of course, independent and out of sync with our ldap groups.
Mind you, in some ways the separation is convenient...in other ways it's inconsistent and redundant - but not a showstopper for us as we currently only have about 30 users (out of 1000+ in the LDAP tree!) who have IRB approvals to manage.
The problem of using LDAP to manage groups and have Galaxy use those is that AFAIK there are no decent tools a non-tech savy administrator can use to administer an LDAP tree - we've written our own based on an LDAP adapter I wrote for Zope a long time ago, but LDAP really is a bit of a pain for non technical administrators and we don't want our system administrator wasting time with it if we can avoid that! So, I'm not even sure I'd swap away from the currently redundant but very convenient_to_manage situation, even if/when Galaxy can retrieve groups from an LDAP server.
On Thu, Apr 2, 2009 at 3:00 AM, galaxy-user-request@bx.psu.edu wrote:
Message: 4 Date: Wed, 01 Apr 2009 10:48:15 -0400 From: Nate Coraor nate@bx.psu.edu Subject: Re: [galaxy-user] Is Galaxy LDAP-aware? To: erant@psb.vib-ugent.be Cc: galaxy galaxy-user@bx.psu.edu Message-ID: 49D37EAF.2060907@bx.psu.edu Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Erick Antezana wrote:
is it possible to use LDAP authentication in the Galaxy framework? If not, any plans to consider it?
Hi Erick,
Authentication can be delegated to an upstream proxy server (e.g. Apache). Instructions for this are in our wiki:
http://g2.trac.bx.psu.edu/wiki/HowToInstall/ApacheProxy
There are plans for Galaxy to at least support LDAP for user and group management, but this has not yet been implemented.