processone / processone/ejabberd
Adding Proxy Authorization Control as described by RFC 4370 support to eldap.erl
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 6.7k
- Forks
- 1.6k
- PR merge metrics
- No merged PRs in 30d
Description
What version of ejabberd are you using?
18.06
What operating system (version) are you using?
Fedora 28 64bit from processone packages
How did you install ejabberd (source, package, distribution)?
Hi,
For all LDAP functions I would like to add support for RFC 4370 so that when a shared ldap vcard search is done or any other search, it's proxied as this for example:
authzID => 'dn:cn=%u,ou=people,o=myorg.com'
I see controls are not supported in http://erlang.org/doc/man/eldap.html either. It's similar to:
https://metacpan.org/pod/Net::LDAP::Control::ProxyAuth here:
https://metacpan.org/release/perl-ldap
This would allow you to use an unprivileged search user for auth and then proxy auth for actual searches to the jid user.
What the best place to start, client then config?
Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with eldap.erl and the Erlang eldap documentation, where the issue says LDAP controls are unsupported. Review RFC 4370 and the linked Net::LDAP::Control::ProxyAuth reference, then trace how ejabberd configures its LDAP client and searches. Done means agreeing on the client and configuration changes needed to proxy searches as the JID user.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authentication, authorization, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100