openSUSE/open-build-service — pull request #9 by totoroliu (2011-11-10 18:02:11+00:00)
Title: LDAP_OBSDB_FILTER feature required

In a large enterprise,
LDAP server is normally maintained by IT people,
but OBS server is normally maintained by CM group.
It's always inconvenient to ask IT to add/remove people from LDAP membership
to control access write.

To gain the advantage of using LDAP for one single password
and still use OBS's MySQL database for user access control,
LDAP_OBSDB_FILTER feature is required.

The work flow is as follows:
1.
When both LDAP_MODE and LDAP_OBSDB_FILTER are ":on",
it will first search the user in OBS database.
2.
If the user is not found in OBS database,
meaning the user has no access right,
it would fail the login without trying to query LDAP server.
If the user is found in OBS database,
meaning the user has access right,
it would continue to query LDAP server to check the password.

In this way,
CM group can control OBS access rights
by creating/removing user from OBS database
without involving IT personals,
and
end users can gain the advantage of using LDAP password.