saltstack/salt — pull request #7799 by eliasp (2013-10-14 00:27:19+00:00)
Title: External auth LDAP improvements

I'm working on some improvements for the external auth LDAP support.
Current issues of the external auth LDAP module are:

1. It can only be used with `binddn` and `bindpw` specified, while the user's credentials could also be used. It is often desired not having to provide hardcoded credentials in config files.
2. When not using harcoded 'binddn' and 'bindpw', one had to login using the whole `DN` (e.g `cn=johndoe,ou=users,dc=mycompany,dc=tld`). Being able to just use the user's `CN` (e.g. `johndoe`) is way more comfortable.
3. It cannot be used with an LDAP URI instead of the LDAP server's hostname which is quite handy in large environments to rely on DNS SRV records to get an LDAP host instead of having to configure a hard-coded LDAP host

The current state of the pull request reflects only item#1 and item#2, but an update to also cover item#2 will follow soon.

An examples of how simplified the config could look like once item#2 is also finished:

**Active Directory:**

auth.ldap.uri: ldap:///dc=company,dc=tld
auth.ldap.basedn: ou=users,dc=company,dc=tld
auth.ldap.binddn: "{{ username }}@company.tld"

Please feel free to review/comment the current state as I'm rather new to Salt + Python.