[GitHub] [guacamole-client] necouchman commented on a change in pull request #497: GUACAMOLE-996: Add support for configuring group filter.

[GitBox <gi...@apache.org>]

necouchman commented on a change in pull request #497:
URL: https://github.com/apache/guacamole-client/pull/497#discussion_r449907496



##########
File path: extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/ConfigurationService.java
##########
@@ -321,6 +322,26 @@ public ExprNode getUserSearchFilter() throws GuacamoleException {
         );
     }
 
+    /**
+     * Returns the search filter that should be used when querying the
+     * LDAP server for Guacamole groups.  If no filter is specified,
+     * a default of "(objectClass=group)" is returned.
+     *
+     * @return
+     *     The search filter that should be used when querying the
+     *     LDAP server for groups that are valid in Guacamole, or
+     *     "(objectClass=group)" if not specified.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public ExprNode getGroupSearchFilter() throws GuacamoleException {
+        return environment.getProperty(
+            LDAPGuacamoleProperties.LDAP_GROUP_SEARCH_FILTER,
+            new EqualityNode("objectClass","group")

Review comment:
       @mike-jumper: Thoughts on this?  The above change will essentially change the default group filter from `(objectClass=*)` to `(objectClass=group)`.  While I suspect that's probably okay and what we want in the long-run, I worry about catching unsuspecting admins off-guard...




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org