From 0b41d0dd2cff3c7454667e1eb6d62bcce3315e11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Mon, 16 Jun 2025 14:43:37 +0200 Subject: [PATCH] allow nulls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/yellow-rats-argue.md | 16 ++++++++-------- .../catalog-backend-module-ldap/report.api.md | 12 +++--------- .../src/ldap/config.ts | 10 ---------- .../src/ldap/read.ts | 18 +++++++----------- 4 files changed, 18 insertions(+), 38 deletions(-) diff --git a/.changeset/yellow-rats-argue.md b/.changeset/yellow-rats-argue.md index 16f5468cb8..321498fd37 100644 --- a/.changeset/yellow-rats-argue.md +++ b/.changeset/yellow-rats-argue.md @@ -4,9 +4,9 @@ Added the ability to configure disabling one side of the relations tree with LDAP. -Groups have a `member` attribute and users have a `memberOf` attribute, however these often can drift out of sync, leaving weird states in the Catalog as we collate these results together and deduplicate them. +Groups have a `member` attribute and users have a `memberOf` attribute, however these can drift out of sync in some LDAP installations, leaving weird states in the Catalog as we collate these results together and deduplicate them. -You can chose to optionally disable one side of these relationships, or even both by providing config in `app-config.yaml` under either the `GroupConfig` or `UserConfig`: +You can chose to optionally disable one side of these relationships, or even both by setting the respective mapping to `null` in your `app-config.yaml` for your groups and/or users: ```yaml catalog: @@ -21,9 +21,9 @@ catalog: - dn: ou=people,ou=example,dc=example,dc=net options: filter: (uid=*) - parsing: - # this defaults to false, to disable use the following: - skipMemberOf: true + map: + # this ensures that outgoing memberships from users is ignored + memberOf: null groups: - dn: ou=access,ou=groups,ou=example,dc=example,dc=net options: @@ -32,7 +32,7 @@ catalog: description: l set: metadata.customField: 'hello' - parsing: - # this defaults to false, to disable use the following: - skipMember: true + map: + # this ensures that outgoing memberships from groups is ignored + members: null ``` diff --git a/plugins/catalog-backend-module-ldap/report.api.md b/plugins/catalog-backend-module-ldap/report.api.md index 9554f0ff19..8357a9ae38 100644 --- a/plugins/catalog-backend-module-ldap/report.api.md +++ b/plugins/catalog-backend-module-ldap/report.api.md @@ -52,9 +52,6 @@ export function defaultUserTransformer( export type GroupConfig = { dn: string; options: SearchOptions; - parsing?: { - skipMembers?: boolean; - }; set?: { [path: string]: JsonValue; }; @@ -66,8 +63,8 @@ export type GroupConfig = { displayName: string; email?: string; picture?: string; - memberOf: string; - members: string; + memberOf: string | null; + members: string | null; }; }; @@ -252,9 +249,6 @@ export type TLSConfig = { export type UserConfig = { dn: string; options: SearchOptions; - parsing?: { - skipMemberOf?: boolean; - }; set?: { [path: string]: JsonValue; }; @@ -265,7 +259,7 @@ export type UserConfig = { displayName: string; email: string; picture?: string; - memberOf: string; + memberOf: string | null; }; }; diff --git a/plugins/catalog-backend-module-ldap/src/ldap/config.ts b/plugins/catalog-backend-module-ldap/src/ldap/config.ts index 95e45f3d5f..8c7fd0dda5 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/config.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/config.ts @@ -91,11 +91,6 @@ export type UserConfig = { // default is scope "one" and attributes "*" and "+". options: SearchOptions; - // Additional parsing config - parsing?: { - // Whether to skip the memberOf attribute on the users to power the relations of users and groups - skipMemberOf?: boolean; - }; // JSON paths (on a.b.c form) and hard coded values to set on those paths set?: { [path: string]: JsonValue }; // Mappings from well known entity fields, to LDAP attribute names @@ -136,11 +131,6 @@ export type GroupConfig = { // Only the scope, filter, attributes, and paged fields are supported. options: SearchOptions; - // Additional parsing config - parsing?: { - // Whether to skip the members attribute on the groups to power the relations of users and groups - skipMembers?: boolean; - }; // JSON paths (on a.b.c form) and hard coded values to set on those paths set?: { [path: string]: JsonValue }; // Mappings from well known entity fields, to LDAP attribute names diff --git a/plugins/catalog-backend-module-ldap/src/ldap/read.ts b/plugins/catalog-backend-module-ldap/src/ldap/read.ts index aadaaae7cb..a3f3ce1e75 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/read.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/read.ts @@ -143,11 +143,9 @@ export async function readLdapUsers( return; } - if (!cfg.parsing?.skipMemberOf) { - mapReferencesAttr(user, vendor, map.memberOf, (myDn, vs) => { - ensureItems(userMemberOf, myDn, vs); - }); - } + mapReferencesAttr(user, vendor, map.memberOf, (myDn, vs) => { + ensureItems(userMemberOf, myDn, vs); + }); entities.push(entity); }); @@ -281,11 +279,9 @@ export async function readLdapGroups( ensureItems(groupMemberOf, myDn, vs); }); - if (!cfg.parsing?.skipMembers) { - mapReferencesAttr(entry, vendor, map.members, (myDn, vs) => { - ensureItems(groupMember, myDn, vs); - }); - } + mapReferencesAttr(entry, vendor, map.members, (myDn, vs) => { + ensureItems(groupMember, myDn, vs); + }); groups.push(entity); }); @@ -355,7 +351,7 @@ export async function readLdapOrg( function mapReferencesAttr( entry: SearchEntry, vendor: LdapVendor, - attributeName: string | undefined, + attributeName: string | undefined | null, setter: (sourceDn: string, targets: string[]) => void, ) { if (attributeName) {