Repository navigation
LDAP: mention FreeIPA in the distinguished-name group member option - #1122
Merged
Merged
Conversation
FreeIPA (389 Directory Server) stores group membership in the "member"
attribute as distinguished names, exactly like Samba/AD - not as login
names like a plain OpenLDAP setup.
The "Group member identification" radio button is labelled
"Distinguished name (Samba/AD)", so FreeIPA administrators tend to pick
the other option ("... user login name ... (OpenLDAP)") instead. With
that scheme the "groups of user" query builds the filter
"member=<login>", which never matches the DN values stored by FreeIPA,
and group-based access control silently stops working.
Add FreeIPA to the label so the correct scheme is obvious.
Member
|
Thanks for the contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FreeIPA (389 Directory Server) stores group membership in the
memberattribute as distinguished names, exactly like Samba/AD — not as login names like a plain OpenLDAP setup.The "Group member identification" radio button is labelled "Distinguished name (Samba/AD)", so FreeIPA administrators tend to pick the other option ("... user login name ... (OpenLDAP)") instead. With that scheme the groups of user query builds the filter
member=<login>, which never matches the DN values stored by FreeIPA, and group-based access control silently stops working.This was reported downstream as ALT bug #51651: the LDAP integration test fails until the user switches group member identification to "Distinguished name".
This change adds FreeIPA to the label so the correct scheme is obvious. UI-string-only change; translations are left to be picked up by the usual
lupdate/ Weblate workflow.