processone / processone/ejabberd

Adding Proxy Authorization Control as described by RFC 4370 support to eldap.erl

Open
#2,552 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component:LDAP Kind:Feature
Dominant language
Erlang
Stars
6.7k
Forks
1.6k
PR merge metrics
No merged PRs in 30d

Description

What version of ejabberd are you using?

18.06

What operating system (version) are you using?

Fedora 28 64bit from processone packages

How did you install ejabberd (source, package, distribution)?

https://www.process-one.net/downloads/downloads-action.php?file=/ejabberd/18.06/ejabberd-18.06-0.x86_64.rpm

Hi,

For all LDAP functions I would like to add support for RFC 4370 so that when a shared ldap vcard search is done or any other search, it's proxied as this for example:

authzID => 'dn:cn=%u,ou=people,o=myorg.com'

I see controls are not supported in http://erlang.org/doc/man/eldap.html either. It's similar to:

https://metacpan.org/pod/Net::LDAP::Control::ProxyAuth here:

https://metacpan.org/release/perl-ldap

This would allow you to use an unprivileged search user for auth and then proxy auth for actual searches to the jid user.

What the best place to start, client then config?

Thanks.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with eldap.erl and the Erlang eldap documentation, where the issue says LDAP controls are unsupported. Review RFC 4370 and the linked Net::LDAP::Control::ProxyAuth reference, then trace how ejabberd configures its LDAP client and searches. Done means agreeing on the client and configuration changes needed to proxy searches as the JID user.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.