janiussyafiq opened a new pull request, #13791: URL: https://github.com/apache/apisix/pull/13791
### Description Part 2 of 3 for the `ldap-auth-advanced` plugin (part 1: #13762). Adds group support: - Collect the authenticated user's groups, either from the `memberOf` attribute on the user entry (default, no extra round trip) or by searching `group_base_dn` as the service identity (never as the end user; `sizeLimit 0` so groups are never truncated). - `groups_required` authorization: outer OR of inner ANDs over group names, matched verbatim; an authenticated user failing it gets `403`, kept distinct from every `401` path. - Export collected group names to the upstream in `X-Authenticated-Groups` (toggle `set_groups_header`, default `true`; the inbound header is always stripped). - Consumers can now bind to a group instead of a user: `group_dn` (string, or array that must ALL contain the user), mutually exclusive with `user_dn`. An exact `user_dn` match always wins; among group matches the plugin picks deterministically (alphabetical group-DN order, more-specific array first) and logs a warning naming all candidates when more than one matches. Two implementation notes for reviewers: the plugin resolves Consumers through a plugin-local index cached per consumer config version instead of `consumer_mod.find_consumer`, because the shared cache error-logs every consumer missing the lookup key, which would spam logs for legitimate group-only consumers (observable behavior, including the 401 messages, is unchanged). Separately, writing a `user_dn` consumer while `group_dn` consumers exist triggers the core write-time duplicate check to error-log "missing consumer auth credential" for the valid group consumers; cosmetic only, and fixing it means touching core beyond this PR's scope. One existing test expectation was updated (`t/plugin/ldap-auth-advanced.t` TEST 52, one line): with `set_groups_header` defaulting `true`, the echoed headers now legitimately include the collected groups; the spoofed-inbound-value assertion is unchanged. #### Which issue(s) this PR fixes: Related: #8958 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (new success-path `X-Authenticated-Groups` header is additive; existing consumer `user_dn` configs are unchanged) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
