[
https://issues.apache.org/jira/browse/GUACAMOLE-996?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17074184#comment-17074184
]
Edgardo Rodriguez commented on GUACAMOLE-996:
---------------------------------------------
Think the following: ldap member attribute is defined to be *miembros*, but
ldap group search filter seeks objects containing the attribute *computers*
(and miembros is never defined on these kind of objects), why would be use
those as groups if the other condition logically excludes them (when matching
users with their corresponding groups ) when applying groups permissions?
I think of ldap group search filter as a complementary and finegrained way to
reduce ammount of objects retrieved by an admin.
> Provide configuration for filtering LDAP groups
> -----------------------------------------------
>
> Key: GUACAMOLE-996
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-996
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole-auth-ldap
> Reporter: Peter Ruhrmann
> Priority: Minor
> Attachments: UserGroupService_donotretrieveall.patch
>
>
> *Problem:*
> If you have an LDAP-Directory where Users and Groups are in the same subtree
> and you don't use LDAP for Connection-Storage (guacConfigGroup) you get all
> objects under the DN configured as ldap-group-base-dn returned as groups.
> *Example:*
> Our directory looks like this:
> DC=AD,DC=company,DC=de
> * OU=faculty
> ** Group1
> ** Group2
> ** Group3
> ** ...
> ** OU=students
> *** Student0001
> *** Student0002
> *** Student0003
> *** ...
> *** Student1999
> As ldap-group-base-dn I have to configure OU=faculty,DC=AD,DC=company,dc=de
> But then I get in the Web-UI all Groups and all Students as Group-Objects
> which makes no sense
> *Suggested fix*
> I have a fix for me but as I am not a programmer, I don't know how to
> implement it the right way.
> I changed in UserGroupService.java line 92 from:
> {{return new PresenceNode("objectClass");}}
> to
> {{return new AndNode(new EqualityNode("objectClass","group"));}}
> and added
> {{import org.apache.directory.api.ldap.model.filter.AndNode;}}
> at line 34.
> Thanks for making this great project!
>
> Peter
>
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
