[ 
https://issues.apache.org/jira/browse/GRIFFIN-207?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16663110#comment-16663110
 ] 

ASF GitHub Bot commented on GRIFFIN-207:
----------------------------------------

Github user toyboxman commented on the issue:

    https://github.com/apache/incubator-griffin/pull/441
  
    LGTM


> LDAP auth is not supporting group filters and non-CN login names
> ----------------------------------------------------------------
>
>                 Key: GRIFFIN-207
>                 URL: https://issues.apache.org/jira/browse/GRIFFIN-207
>             Project: Griffin (Incubating)
>          Issue Type: Bug
>            Reporter: Nikolay Sokolov
>            Assignee: Nikolay Sokolov
>            Priority: Major
>
> Currently LDAP auth performs bind to principal with name 
> "${username}${ldap.email}", and searches through user objects 
> ldap.searchPattern. Result of search then only used to retrieve fullName of 
> the user.
> There are two problems here:
>  * login username can not be different than CN, as it is used to perform LDAP 
> bind
>  * it is not possible to restrict access to specific groups
> Typical approach used in other software products is to use separate bind 
> account, which would search through LDAP objects using search pattern, and 
> then use found object's DN to perform password check.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to