rlm_ldap: extract group name from group RDN #1788

Open
candlerb opened this Issue Oct 13, 2016 · 0 comments

Projects

None yet

1 participant

@candlerb
Contributor

Issue type

  • Feature request.

Defect/Feature description

If you configure a group membership query like this:

                membership_attribute = 'memberOf'
                name_attributes = 'cn'

and of course the memberOf attribute contains a DN, but the group RDN is cn=...., then we could avoid doing an LDAP query to map the DN to group name, and just extract it straight out of the DN. This would reduce the number of queries required (substantially, if the user is a member of many groups).

There is an edge case to consider: what if the group entry has multiple values for the cn attribute? Arguably, you might want to map the group to multiple names.

Personally I'd just want the primary cn (i.e. the one in the RDN). Having additional cn's would raise the risk that one group could masquerade as another. If there really are people who want this, the extraction of name_attributes from DN could be optional.

Example on the list

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment