ldap['group_dn'] should work without the memberOf overlay
Open
Nobody has claimed this yet.
Component: ldap
Status: To be prioritized
- Dominant language
- Erlang
- Stars
- 303
- Forks
- 211
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 5
Description
Currently when chef-server uses the ldap['group_dn'] attribute to construct queries requires the memberOf overlay to be installed, which cannot be done after groups have already been created in the directory.
This breaks this feature for us - we need to be able to look up posixGroup membership without using this overlay so that we can lock down access to chef-manage.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the ldap['group_dn'] setting constructs group-membership queries and identify the current dependency on the memberOf overlay. Verify that posixGroup membership can be looked up without that overlay and that the result still controls access to chef-manage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100