opscode/oc_chef_wm — pull request #114 by bjfelton (2014-11-21 21:01:49+00:00)
Title: Fixes to support a group memberOf ldap filter

There are two changes here.

First, lines 86-92 allow for the specification of an optional group_dn parameter that will allow for a bit more granularity when searching for a user in LDAP/AD so that you're not opening Chef to every entity in base_dn. My original intent was to add far more granularity to the filtering, but the work involved was far beyond my skills (read: eldap has no magic function to convert a valid LDAP search string into the appropriate filter object).

Second, lines 161-164 handle down-casing the LoginAttr. If this is not done and a mixed-case LoginAttr is provided, the proplists:get_value call on 166 will throw an exception, which manifests in the erchef log as a 504/Gateway Timeout.

This needs to be coupled with a change to the oc_erchef.config.erb template to add a 'group_dn' entry in the ldap section. I'll be working on a separate pull request for that.

For testing, I compiled the changes and moved the resulting .beam it to the front-end nodes in a Chef 12 RC 6.1 HA cluster. After adding the new config entry, reconfiguring, and restarting, I got the desired behavior when users logged in. I also ran tests without ldap['group_dn'] configured, and logins worked

I did try to add unit test coverage, but since there was no suite around ldap, I was in over my head. This is my first foray into Erlang development, so please pardon any style errors.