cockroachdb / cockroachdb/cockroach

ldapccl: support configurable ldap group list attribute

Open
#136,455 0 comments 0 reactions 0 assignees View on GitHub
C-enhancement P-3 T-product-security
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

Currently ldap authentication/authorization method does not support configuring the ldap group list attribute. We use the attribute value as `member` which is a repeating field for group object and contain user distinguished names for users who are members of the group. https://github.com/cockroachdb/cockroach/blob/22bc13dadbe58981450ae81017d7fffbd50186f4/pkg/ccl/ldapccl/ldap_util.go#L114-L120
This could be changed to take a configurable value passed as an optional argument to HBA configuration as `ldapgrouplistattribute`.

link to conversation: https://cockroachlabs.slack.com/archives/C06S9FMQKK9/p1732623852425099?thread_ts=1732619220.954519&cid=C06S9FMQKK9

Proposal: add a configurable value to be passed as an optional argument to HBA configuration as `ldapgrouplistattribute`.

Jira issue: CRDB-45074

Epic CRDB-54682

Contributor guide

Open the contributing guide

Research direction

Start with pkg/ccl/ldapccl/ldap_util.go around lines 114-120, then trace how LDAP options are parsed from HBA configuration. Confirm the proposed ldapgrouplistattribute option is accepted and that group membership lookup uses it instead of the fixed member attribute.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, authorization
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.