[LDAP connector] Document that 'DN' must be in capitals

[whereisaaron]

I was perplexed why my LDAP group searches were not working. But I noted on the otherwise excellent LDAP connector documentation page, that 'DN' was used in capitals, even though nothing else was.

I didn't think 'dn' was supposed to be case sensitive? Either way, I think this is worth specifically calling out in the documentation.

Fails with 'Login Error' screen:

      userSearch:
        baseDN: "ou=Users,dc=example,dc=com"
        filter: "(objectClass=inetorgperson)"
        username: cn
        idAttr: dn
        emailAttr: mail
        nameAttr: displayName
      groupSearch:
        baseDN: "ou=Groups,dc=example,dc=com"
        filter: "(objectClass=groupOfUniqueNames)"
        userAttr: dn
        groupAttr: uniqueMember
        nameAttr: cn

Works great, including groups:

      userSearch:
        baseDN: "ou=Users,dc=example,dc=com"
        filter: "(objectClass=inetorgperson)"
        username: cn
        idAttr: DN
        emailAttr: mail
        nameAttr: displayName
      groupSearch:
        baseDN: "ou=Groups,dc=example,dc=com"
        filter: "(objectClass=groupOfUniqueNames)"
        userAttr: DN
        groupAttr: uniqueMember
        nameAttr: cn

[whereisaaron]

I found a mention of the magic capitalization behavior here:
https://github.com/coreos/dex/blob/master/examples/config-ldap.yaml#L29

Just need the same in the connector documentation page.

[srenatus]

@whereisaaron I guess @OwenTuz's fine little change does the trick here, what do you think? (Optimistically, I'm closing this issue. Feel free to re-open.)

[whereisaaron]

It all helps @srenatus! I don't think 'DN' ought to be case specific when LDAP normally isn't, but so long as you know this connector behavior you can work with it.

[benjaminapetersen]

Does this mean ANY reference of DN? I am assuming yes. A couple examples from the above docs page just for clarification:

# Dex config example from dex docs
userSearch:
  idAttr: DN # this is caps, if it is DN 

# as well as this:
groupSearch:
  userMatchers:
  - userAttr: DN   # this is caps, again because DN, assuming DN (only) must always be caps
    groupAttr: member
  - userAttr: uid  # not caps, cuz not DN
    groupAttr: memberUid

Curious, does anyone know why DN gets this unique treatment?

[benjaminapetersen]

Updated link to the configuration page as the above references are broken links now.