Skip to content

Create PRIVACY.md for LDAP #11852

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
selyesa wants to merge 1 commit into
base: trunk
Choose a base branch
from
+105 −0
Open

Create PRIVACY.md for LDAP #11852

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
105 changes: 105 additions & 0 deletions components/ILIAS/LDAP/PRIVACY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
# LDAP Privacy

> **Disclaimer: This documentation does not guarantee completeness or accuracy. Please report any missing or incorrect information by submitting a [Pull Request](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/docs/development/contributing.md#pull-request-to-the-repositories) or, if you prefer, via the [ILIAS bug tracker](https://mantis.ilias.de). When using the bug tracker, please select the corresponding component in the **Category** field.**


## General Information

The LDAP component provides integration with external LDAP directory servers for user authentication
and account synchronisation. It allows ILIAS to authenticate users against one or more LDAP servers,
automatically create or update ILIAS user accounts based on LDAP attributes, and assign roles based
on LDAP group membership or attribute values.

The LDAP component itself does not store end-user personal data directly. Instead, it stores
**server configuration** (including LDAP bind credentials), **attribute mapping rules**, **role
assignment rules**, and **role-to-group mapping settings**. All actual user profile data that
is synchronised from LDAP is written to the ILIAS user account via the User component.

User synchronisation can occur in two ways: **on login** (when the user authenticates) or via a
**cron job** (`ldap_sync`) that periodically synchronises all LDAP users. Both mechanisms use
the `ilUserImportParser` from the User component to create or update ILIAS user accounts. The cron
job can also **deactivate** ILIAS user accounts that no longer exist in the LDAP directory.

The LDAP component provides a plugin slot (`LDAPHook`) that allows third-party plugins to
influence role assignment decisions.

## Integrated Components

- The LDAP component employs the following components, please consult the respective PRIVACY.md files:
- [AccessControl](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/AccessControl/PRIVACY.md) – manages permissions for LDAP server
administration and controls who can view and modify LDAP configuration settings.
- User – the LDAP component delegates all user account creation and update operations to
the User component via `ilUserImportParser`. Synchronised LDAP attributes (e.g., name,
email, institution) are written to ILIAS user profiles by the User component.
- Cron – the LDAP component registers a cron job (`ldap_sync`) for periodic user
synchronisation. The Cron service manages job scheduling and execution.

## Data being stored

The LDAP component stores configuration data in four database tables. While the core configuration
is not personal data, two aspects involve credentials or affect personal data processing:

- **LDAP bind user credentials** (`bind_user`, `bind_pass`): The `ldap_server_settings` table
stores the **distinguished name** and **password** of the LDAP service account used to bind to
the LDAP directory. These are technical service account credentials, not end-user credentials.
A separate pair (`role_bind_dn`, `role_bind_pass`) is stored when role synchronisation uses
a different bind account.
- **Attribute mapping rules**: The `ldap_attribute_mapping` table stores mappings between LDAP
attribute names and ILIAS user profile fields (e.g., mapping `givenName` to `firstname`). These
rules determine which personal data fields are synchronised from LDAP into ILIAS user accounts.
The `perform_update` flag controls whether each mapping is applied on subsequent logins.
- **Role assignment rules**: The `ldap_role_assignments` table stores rules that map LDAP group
memberships or attribute values to ILIAS roles. Each rule references a **role ID**, an LDAP
**distinguished name** or **attribute name/value pair**, and flags controlling whether the
assignment should be updated or removed on subsequent logins.
- **Role-to-group mapping settings**: The `ldap_rg_mapping` table stores bidirectional mappings
between ILIAS roles and LDAP groups. When a user is assigned to or deassigned from an ILIAS
role, the LDAP component can propagate this change back to the LDAP directory. Each mapping
references an LDAP **server ID**, **group DN**, **member attribute**, and an ILIAS **role ID**.

The LDAP component does **not** store end-user personal data (such as names, email addresses, or
user IDs) in its own tables. All synchronised personal data is written to the ILIAS user account
tables by the User component.

## Data being presented

- **Persons with the "read" permission** on the LDAP administration (External Authentication
Services) can:
- view the list of configured LDAP servers, including the **number of user accounts** associated
with each server.
- view all LDAP server settings, attribute mappings, role assignment rules, and role-to-group
mappings.
- **Persons with the "write" permission** on the LDAP administration can additionally:
- create, edit, activate, deactivate, and delete LDAP server configurations.
- create, edit, and delete attribute mappings, role assignment rules, and role-to-group mappings.
- trigger a test connection to the LDAP server.

No end-user personal data (such as usernames, names, or email addresses) is presented within the
LDAP administration interface. The user count per server is an aggregate number without
individual-level detail.

## Data being deleted

- **When an LDAP server configuration is deleted** by a person with the "write" permission:
- the server settings record is deleted from `ldap_server_settings`.
- all associated attribute mappings are deleted from `ldap_attribute_mapping`.
- all associated role assignment rules are deleted from `ldap_role_assignments`.
- all associated role-to-group mappings are deleted from `ldap_rg_mapping`.
- ILIAS user accounts that were created through this LDAP server are **not** deleted. They
remain as local ILIAS accounts with their LDAP authentication mode.
- **When individual role assignment rules are deleted**: the rule record is removed from
`ldap_role_assignments`. Existing role assignments of users are not retroactively changed.
- **When individual role-to-group mappings are deleted**: the mapping record is removed from
`ldap_rg_mapping`. Existing LDAP group memberships are not retroactively changed.
- **When a user account is deleted** from ILIAS: the LDAP component's `ilLDAPRoleGroupMapping`
class removes the user from all mapped LDAP groups via its `deleteUser()` method, provided
role synchronisation is active.
- **When a role is deleted** from ILIAS: the LDAP component deassigns all users from the
corresponding LDAP group(s) via `ilLDAPRoleGroupMapping::deleteRole()`, and the role-to-group
mapping records for that role are deleted from `ldap_rg_mapping`.

## Data being exported

The LDAP component does not provide any export functionality for its configuration data or for
user data. User data synchronised from LDAP is managed by the User component, which has its own
export mechanisms.
Loading