You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "Kevin Minder (JIRA)" <ji...@apache.org> on 2016/03/17 16:42:33 UTC
[jira] [Resolved] (KNOX-694) Enhance LDAP user search
configurability
[ https://issues.apache.org/jira/browse/KNOX-694?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kevin Minder resolved KNOX-694.
-------------------------------
Resolution: Fixed
> Enhance LDAP user search configurability
> ----------------------------------------
>
> Key: KNOX-694
> URL: https://issues.apache.org/jira/browse/KNOX-694
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 0.8.0
> Reporter: Kevin Minder
> Assignee: Kevin Minder
> Fix For: 0.9.0
>
> Attachments: KNOX-694_001.patch
>
>
> In very complex organizations the current configuration supported by KnoxLdapRealm my not be sufficient. Ideally it would be possible to:
> 1. Configure the LDAP search filter directly
> 2. Configure the LDAP search scope
> 3. Have portions of the search base and filter be derived from the input principal.
> To clarify this, I'm thinking of provider configurations like these
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userDnTemplate" value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qa,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchAttributeName" value="sAMAccountName"/>
> <param name="main.ldapRealm.userSearchAttributeTemplate" value="{2}"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qe,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchFilter" value="(&(objectclass=person)(sAMAccountName={2}))"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qe,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchFilter" value="(&(objectclass=person)(sAMAccountName={2}))"/>
> <param name="main.ldapRealm.userSearchScope" value="onelevel"/>
> {code}
> {code}
> <param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
> <param name="main.ldapRealm.userSearchBase" value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>
> <param name="main.ldapRealm.userSearchScope" value="object"/>
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)