[
https://issues.apache.org/jira/browse/KNOX-694?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15198613#comment-15198613
]
Larry McCay commented on KNOX-694:
----------------------------------
This seems complex but very flexible/powerful.
Complex problems require complex solutions sometimes - when possible at all.
This looks great.
I imagine that order of the config is important - if so, make sure that it is
clear in the docs.
> Enhance LDAP user search configurability
> ----------------------------------------
>
> Key: KNOX-694
> URL: https://issues.apache.org/jira/browse/KNOX-694
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 0.8.0
> Reporter: Kevin Minder
> Assignee: Kevin Minder
> Fix For: Future
>
> Attachments: KNOX-694_001.patch
>
>
> In very complex organizations the current configuration supported by
> KnoxLdapRealm my not be sufficient. Ideally it would be possible to:
> 1. Configure the LDAP search filter directly
> 2. Configure the LDAP search scope
> 3. Have portions of the search base and filter be derived from the input
> principal.
> To clarify this, I'm thinking of provider configurations like these
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userDnTemplate"
> value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase"
> value="CN={1},DC=qa,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchAttributeName" value="sAMAccountName"/>
> <param name="main.ldapRealm.userSearchAttributeTemplate" value="{2}"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase"
> value="CN={1},DC=qe,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchFilter"
> value="(&(objectclass=person)(sAMAccountName={2}))"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase"
> value="CN={1},DC=qe,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchFilter"
> value="(&(objectclass=person)(sAMAccountName={2}))"/>
> <param name="main.ldapRealm.userSearchScope" value="onelevel"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase"
> value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchScope" value="object"/>
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
