New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rlm_ldap: extract group name from group RDN #1788

Open
candlerb opened this Issue Oct 13, 2016 · 1 comment

Comments

Projects
None yet
2 participants
@candlerb
Contributor

candlerb commented Oct 13, 2016

Issue type

  • Feature request.

Defect/Feature description

If you configure a group membership query like this:

                membership_attribute = 'memberOf'
                name_attributes = 'cn'

and of course the memberOf attribute contains a DN, but the group RDN is cn=...., then we could avoid doing an LDAP query to map the DN to group name, and just extract it straight out of the DN. This would reduce the number of queries required (substantially, if the user is a member of many groups).

There is an edge case to consider: what if the group entry has multiple values for the cn attribute? Arguably, you might want to map the group to multiple names.

Personally I'd just want the primary cn (i.e. the one in the RDN). Having additional cn's would raise the risk that one group could masquerade as another. If there really are people who want this, the extraction of name_attributes from DN could be optional.

Example on the list

@alandekok alandekok added the v4.0.x label Feb 27, 2017

@alandekok

This comment has been minimized.

Show comment
Hide comment
@alandekok

alandekok Feb 27, 2017

Member

Unless the patch is small, we'll have to wait for v4 to get this fixed.

Member

alandekok commented Feb 27, 2017

Unless the patch is small, we'll have to wait for v4 to get this fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment