redhat-cop / redhat-cop/group-sync-operator

Need an option of bringing the user names to a consistent (either lower or upper) case before adding them to groups

Open
#298 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
132
Forks
71
PR merge metrics
No merged PRs in 30d

Description

The issue is particularly related to sync from AD/LDAP since there is no guarantee the user name (from AD side sAMAccountName or userPrincipalName, or mail attributes) is always stored in a canonical form.
It creates a problem since OpenShift/k8s is case sensitive by nature, while LDAP is not.

At this point authentication layer is not a problem since it takes place on LDAP/AD side, but the authorization (ie. groups placed in role bindings) becomes a problem.

From what I was able to gather, there is no plans to change this on the platform side as it is implied the names sourced from the authentication backend are canonical. But I presume the feature can be fairly easy implemented in the group sync operator by introducing a couple parameters, for instance, lower_case: true and upper_case: true to bring all user names to the same case after reading them from AD/LDAP and before placing them in groups.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the group-sync operator's AD/LDAP synchronization path, focusing on where usernames are read and where they are added to groups. Define how the lower_case and upper_case options are configured and validated, then verify that usernames are normalized between those steps and group membership uses the consistent form.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authorization, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.