cockroachdb / cockroachdb/cockroach
ldapccl: support configurable ldap group list attribute
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
Currently ldap authentication/authorization method does not support configuring the ldap group list attribute. We use the attribute value as `member` which is a repeating field for group object and contain user distinguished names for users who are members of the group. https://github.com/cockroachdb/cockroach/blob/22bc13dadbe58981450ae81017d7fffbd50186f4/pkg/ccl/ldapccl/ldap_util.go#L114-L120
This could be changed to take a configurable value passed as an optional argument to HBA configuration as `ldapgrouplistattribute`.
link to conversation: https://cockroachlabs.slack.com/archives/C06S9FMQKK9/p1732623852425099?thread_ts=1732619220.954519&cid=C06S9FMQKK9
Proposal: add a configurable value to be passed as an optional argument to HBA configuration as `ldapgrouplistattribute`.
Jira issue: CRDB-45074
Epic CRDB-54682
Contributor guide
Research direction
Start with pkg/ccl/ldapccl/ldap_util.go around lines 114-120, then trace how LDAP options are parsed from HBA configuration. Confirm the proposed ldapgrouplistattribute option is accepted and that group membership lookup uses it instead of the fixed member attribute.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, authorization
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100