totoroliu/open-build-service — comment on commit 5a65582e7315ab8ca1a3bf5cb49f37dbb08273ba
File:  line 0
By totoroliu:

Hi Andrian,

The work flows for using new_user_registration and this new LDAP_OBSDB_FILTER feature are different.

new_user_registration: confirmation:
In this way, although CM Admin has controls of granting access to new users,
there are some down sides:
1.
CM Admin has to maintain the password.
In large enterprise, LDAP / AD password is normally expired in 90 days.
When they changed new LDAP/AD password,
the end-user needs to
either ask CM Admin to update password (it's bad because end-user needs to release his LDAP/AD password),
or needs to remember 2 different passwords.
2.
By current default,
if ldap_mode is on,
new_user_registration is disabled.

With this new feature (LDAP_OBSDB_FILTER):
The first part of work flow is similar to new_user_registration,
CM Admin creates account in database using secret password (not released to end-user).
Once account is created,
the end-user uses his own LDAP/AD password to login.
Even after the end-user updates / changes LDAP/AD password,
the end-user just login using new password and CM Admin doesn't need to worry about.

Moreover,
this is different than using default LDAP mode in that:
1.
While using membership filter in LDAP,
only IT staff has control of adding/removing end-user from LDAP membership.
CM Admin doesn't have the control.

Rick