georchestra/georchestra — pull request #91 by fvanderbiest (2013-04-17 10:06:29+00:00)
Title: LDAP groups memberUid vs member

Currently, our LDAP groups (objectClass: posixGroup) reference users by the way of memberUid attributes

eg:

dn: cn=SV_ADMIN,ou=groups,dc=georchestra,dc=org
objectClass: top
objectClass: posixGroup
gidNumber: 2
cn: SV_ADMIN
memberUid: uid=testadmin,ou=users,dc=georchestra,dc=org

As a result, geOrchestra uses filters such as this one

ldap.privilege.search.privilege.query=(&(objectClass=posixGroup)(memberUid=uid={0},${ldap.base.search.base},${ldap.base.dn})(cn=SV_*))

(see https://github.com/georchestra/georchestra/blob/master/config/defaults/geonetwork-main/webapp/WEB-INF/config-security.properties)

On the other hand, GeoBretagne uses memberUid like this:

memberUid: testadmin

rather than

memberUid: uid=testadmin,ou=users,dc=georchestra,dc=org

I found out that they are right : the memberUid attribute is meant to specify a uid, not a complete dn. See for instance http://www.rainingpackets.com/ldap-posixgroup-groupofnames/

As a result, we have to update the config files which specify how LDAP filters are defined.

To my knowledge, this impacts the security proxy, cas and geonetwork.