From 9d47beed8a234141930753e3ffea6d2a7315c794 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Sat, 28 Sep 2024 11:56:50 +0200 Subject: [PATCH 01/11] scripts: add pin-workspace-versions Signed-off-by: Patrik Oldsberg Signed-off-by: John Redwood --- scripts/pin-workspace-versions.js | 59 +++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100755 scripts/pin-workspace-versions.js diff --git a/scripts/pin-workspace-versions.js b/scripts/pin-workspace-versions.js new file mode 100755 index 0000000000..cbfb0c720b --- /dev/null +++ b/scripts/pin-workspace-versions.js @@ -0,0 +1,59 @@ +#!/usr/bin/env node +/* + * Copyright 2024 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// This switches all `workspace:^` dependencies in the project to instead use `workspace:*` +// This is used for next releases in order to avoid the `^` range that is otherwise likely to cause issues. +// For example, a `^0.5.0-next.0` range will match `0.5.0-next.0`, `0.5.0-next.1`, and even `0.5.2`. +// This can often lead to issues as there might be breaking changes across these versions, and in practice +// it will only be possible to install the most recent release without a lot of hassle. + +const fs = require('fs-extra'); +const { getPackages } = require('@manypkg/get-packages'); +const { resolve } = require('path'); + +const depTypes = ['dependencies', 'devDependencies', 'peerDependencies']; + +async function main() { + const rootPath = resolve(__dirname, '..'); + const { packages } = await getPackages(rootPath); + + for (const pkg of packages) { + let changed = false; + for (const depType of depTypes) { + const deps = pkg.packageJson[depType]; + if (deps) { + for (const depName of Object.keys(deps)) { + if (deps[depName] === 'workspace:^') { + deps[depName] = 'workspace:*'; + changed = true; + } + } + } + } + + if (changed) { + await fs.writeJson(resolve(pkg.dir, 'package.json'), pkg.packageJson, { + spaces: 2, + }); + } + } +} + +main(process.argv.slice(2)).catch(error => { + console.error(error.stack || error); + process.exit(1); +}); From 884a86c89f1284740d9c46804b542769f972f5a3 Mon Sep 17 00:00:00 2001 From: John Redwood Date: Tue, 1 Oct 2024 21:37:31 +1000 Subject: [PATCH 02/11] fix: ldap allow case sensitivity settings to force dn and memberOf to be lowercase Signed-off-by: John Redwood --- .changeset/early-cobras-compare.md | 5 + .../catalog-backend-module-ldap/report.api.md | 2 + .../src/ldap/config.ts | 8 + .../src/ldap/read.test.ts | 289 ++++++++++++++++++ .../src/ldap/read.ts | 28 +- .../src/ldap/vendors.ts | 6 + 6 files changed, 335 insertions(+), 3 deletions(-) create mode 100644 .changeset/early-cobras-compare.md diff --git a/.changeset/early-cobras-compare.md b/.changeset/early-cobras-compare.md new file mode 100644 index 0000000000..5a107fedaa --- /dev/null +++ b/.changeset/early-cobras-compare.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-catalog-backend-module-ldap': patch +--- + +Fixed user/group membership mapping for case insensitive returned dn results for catalog-ldap diff --git a/plugins/catalog-backend-module-ldap/report.api.md b/plugins/catalog-backend-module-ldap/report.api.md index e8b20073a3..551800d9b4 100644 --- a/plugins/catalog-backend-module-ldap/report.api.md +++ b/plugins/catalog-backend-module-ldap/report.api.md @@ -205,6 +205,7 @@ export type LdapProviderConfig = { export type LdapVendor = { dnAttributeName: string; uuidAttributeName: string; + dnCaseSensitive?: boolean; decodeStringAttribute: (entry: SearchEntry, name: string) => string[]; }; @@ -274,6 +275,7 @@ export type UserTransformer = ( export type VendorConfig = { dnAttributeName?: string; uuidAttributeName?: string; + dnCaseSensitive?: boolean; }; // Warnings were encountered during analysis: diff --git a/plugins/catalog-backend-module-ldap/src/ldap/config.ts b/plugins/catalog-backend-module-ldap/src/ldap/config.ts index 6fdf682b42..4b53034d36 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/config.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/config.ts @@ -181,6 +181,13 @@ export type VendorConfig = { * Attribute name for the unique identifier (UUID) of an entry, */ uuidAttributeName?: string; + + /** + * Attribute to determine if we need to force the DN and members/memberOf values to be forced to same case. + * Some providers may provide lowercase members but multicase DN names which causes the group filtering to break. + * The default is off, but turning this on forces the inbound DN values and all member values to lowercase. + */ + dnCaseSensitive?: boolean; }; const defaultUserConfig = { @@ -256,6 +263,7 @@ function readVendorConfig( return { dnAttributeName: c.getOptionalString('dnAttributeName'), uuidAttributeName: c.getOptionalString('uuidAttributeName'), + dnCaseSensitive: c.getOptionalBoolean('dnCaseSensitive'), }; } diff --git a/plugins/catalog-backend-module-ldap/src/ldap/read.test.ts b/plugins/catalog-backend-module-ldap/src/ldap/read.test.ts index 5a7e625577..20917a0fcc 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/read.test.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/read.test.ts @@ -330,6 +330,128 @@ describe('readLdapUsers', () => { new Map([['dn-value', new Set(['x', 'y', 'z'])]]), ); }); + + it('transfers all attributes from for vendorDN case sensitivity', async () => { + const vendor = DefaultLdapVendor; + vendor.dnCaseSensitive = true; + client.getVendor.mockResolvedValue(vendor); + client.searchStreaming.mockImplementation(async (_dn, _opts, fn) => { + await fn( + searchEntry({ + uid: ['uid-value'], + description: ['description-value'], + cn: ['cn-value'], + mail: ['mail-value'], + avatarUrl: ['avatarUrl-value'], + memberOf: ['x', 'Y', 'z'], + entryDN: ['dn-VALUE'], + entryUUID: ['uuid-value'], + }), + ); + }); + const config: UserConfig[] = [ + { + dn: 'ddd', + options: {}, + map: { + rdn: 'uid', + name: 'uid', + description: 'description', + displayName: 'cn', + email: 'mail', + picture: 'avatarUrl', + memberOf: 'memberOf', + }, + }, + ]; + const { users, userMemberOf } = await readLdapUsers(client, config, vendor); + // reset dnCaseSensitivity + vendor.dnCaseSensitive = false; + expect(users).toEqual([ + expect.objectContaining({ + metadata: { + name: 'uid-value', + description: 'description-value', + annotations: { + [LDAP_DN_ANNOTATION]: 'dn-value', + [LDAP_RDN_ANNOTATION]: 'uid-value', + [LDAP_UUID_ANNOTATION]: 'uuid-value', + }, + }, + spec: { + profile: { + displayName: 'cn-value', + email: 'mail-value', + picture: 'avatarUrl-value', + }, + memberOf: [], + }, + }), + ]); + expect(userMemberOf).toEqual( + new Map([['dn-value', new Set(['x', 'y', 'z'])]]), + ); + }); + it('fails to transfer all attributes from for due case sensitivity', async () => { + const vendor = DefaultLdapVendor; + client.getVendor.mockResolvedValue(vendor); + client.searchStreaming.mockImplementation(async (_dn, _opts, fn) => { + await fn( + searchEntry({ + uid: ['uid-value'], + description: ['description-value'], + cn: ['cn-value'], + mail: ['mail-value'], + avatarUrl: ['avatarUrl-value'], + memberOf: ['x', 'Y', 'z'], + entryDN: ['dn-VALUE'], + entryUUID: ['uuid-value'], + }), + ); + }); + const config: UserConfig[] = [ + { + dn: 'ddd', + options: {}, + map: { + rdn: 'uid', + name: 'uid', + description: 'description', + displayName: 'cn', + email: 'mail', + picture: 'avatarUrl', + memberOf: 'memberOf', + }, + }, + ]; + const { users, userMemberOf } = await readLdapUsers(client, config, vendor); + expect(users).toEqual([ + expect.objectContaining({ + metadata: { + name: 'uid-value', + description: 'description-value', + annotations: { + [LDAP_DN_ANNOTATION]: 'dn-VALUE', + [LDAP_RDN_ANNOTATION]: 'uid-value', + [LDAP_UUID_ANNOTATION]: 'uuid-value', + }, + }, + spec: { + profile: { + displayName: 'cn-value', + email: 'mail-value', + picture: 'avatarUrl-value', + }, + memberOf: [], + }, + }), + ]); + + expect(userMemberOf).toEqual( + new Map([['dn-VALUE', new Set(['x', 'Y', 'z'])]]), + ); + }); + it('can process a list of UserConfigs', async () => { client.getVendor.mockResolvedValue(DefaultLdapVendor); client.searchStreaming.mockImplementation(async (_dn, _opts, fn) => { @@ -955,3 +1077,170 @@ describe('defaultGroupTransformer', () => { }); }); }); + +/** + * Case Insensitivity Tests + */ +describe('defaultUserTransformerWithCaseSensitiveDNs', () => { + it('can set things safely', async () => { + const config: UserConfig = { + dn: 'ddd', + options: {}, + map: { + rdn: 'uid', + name: 'uid', + displayName: 'cn', + email: 'mail', + memberOf: 'memberOf', + }, + set: { + 'metadata.annotations.a': 1, + 'metadata.annotations': { a: 2, b: 3 }, + }, + }; + + const entry = searchEntry({ + uid: ['uid-value'], + description: ['description-value'], + cn: ['cn-value'], + mail: ['mail-value'], + avatarUrl: ['avatarUrl-value'], + memberOf: ['x', 'y', 'z'], + entryDN: ['dn-VALUE'], + entryUUID: ['uuid-value'], + }); + + const vendor = DefaultLdapVendor; + vendor.dnCaseSensitive = true; + let output = await defaultUserTransformer(vendor, config, entry); + expect(output).toEqual({ + apiVersion: 'backstage.io/v1beta1', + kind: 'User', + metadata: { + annotations: { + 'backstage.io/ldap-dn': 'dn-value', + 'backstage.io/ldap-rdn': 'uid-value', + 'backstage.io/ldap-uuid': 'uuid-value', + a: 2, + b: 3, + }, + name: 'uid-value', + }, + spec: { + memberOf: [], + profile: { displayName: 'cn-value', email: 'mail-value' }, + }, + }); + + (output!.metadata.annotations as any).c = 7; + + // exact same inputs again + output = await defaultUserTransformer(vendor, config, entry); + // reset dnCaseSensitivity + vendor.dnCaseSensitive = false; + expect(output).toEqual({ + apiVersion: 'backstage.io/v1beta1', + kind: 'User', + metadata: { + annotations: { + 'backstage.io/ldap-dn': 'dn-value', + 'backstage.io/ldap-rdn': 'uid-value', + 'backstage.io/ldap-uuid': 'uuid-value', + a: 2, + b: 3, + }, + name: 'uid-value', + }, + spec: { + memberOf: [], + profile: { displayName: 'cn-value', email: 'mail-value' }, + }, + }); + }); +}); + +describe('defaultGroupTransformerWithCaseSensitiveDNs', () => { + it('can set things safely', async () => { + const config: GroupConfig = { + dn: 'ddd', + options: {}, + map: { + rdn: 'uid', + name: 'uid', + displayName: 'cn', + email: 'mail', + description: 'description', + type: 'type', + members: 'members', + memberOf: 'memberOf', + }, + set: { + 'metadata.annotations.a': 1, + 'metadata.annotations': { a: 2, b: 3 }, + }, + }; + + const entry = searchEntry({ + uid: ['uid-value'], + description: ['description-value'], + cn: ['cn-value'], + mail: ['mail-value'], + avatarUrl: ['avatarUrl-value'], + memberOf: ['x', 'y', 'z'], + entryDN: ['dn-VALUE'], + entryUUID: ['uuid-value'], + }); + + const vendor = DefaultLdapVendor; + vendor.dnCaseSensitive = true; + + let output = await defaultGroupTransformer(vendor, config, entry); + expect(output).toEqual({ + apiVersion: 'backstage.io/v1beta1', + kind: 'Group', + metadata: { + annotations: { + 'backstage.io/ldap-dn': 'dn-value', + 'backstage.io/ldap-rdn': 'uid-value', + 'backstage.io/ldap-uuid': 'uuid-value', + a: 2, + b: 3, + }, + description: 'description-value', + name: 'uid-value', + }, + spec: { + type: 'unknown', + children: [], + profile: { displayName: 'cn-value', email: 'mail-value' }, + }, + }); + + (output!.metadata.annotations as any).c = 7; + + // exact same inputs again + output = await defaultGroupTransformer(vendor, config, entry); + // reset dnCaseSensitivity + vendor.dnCaseSensitive = false; + expect(output).toEqual({ + apiVersion: 'backstage.io/v1beta1', + kind: 'Group', + metadata: { + annotations: { + 'backstage.io/ldap-dn': 'dn-value', + 'backstage.io/ldap-rdn': 'uid-value', + 'backstage.io/ldap-uuid': 'uuid-value', + a: 2, + b: 3, + }, + description: 'description-value', + name: 'uid-value', + }, + spec: { + type: 'unknown', + children: [], + profile: { displayName: 'cn-value', email: 'mail-value' }, + }, + }); + }); +}); diff --git a/plugins/catalog-backend-module-ldap/src/ldap/read.ts b/plugins/catalog-backend-module-ldap/src/ldap/read.ts index e1cfc0730e..6fbd2a7e86 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/read.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/read.ts @@ -80,7 +80,10 @@ export async function defaultUserTransformer( entity.metadata.annotations![LDAP_UUID_ANNOTATION] = v; }); mapStringAttr(entry, vendor, vendor.dnAttributeName, v => { - entity.metadata.annotations![LDAP_DN_ANNOTATION] = v; + entity.metadata.annotations![LDAP_DN_ANNOTATION] = getCaseSensitivityValue( + v, + vendor, + ); }); mapStringAttr(entry, vendor, map.displayName, v => { entity.spec.profile!.displayName = v; @@ -122,6 +125,8 @@ export async function readLdapUsers( vendorConfig?.dnAttributeName ?? vendorDefaults.dnAttributeName, uuidAttributeName: vendorConfig?.uuidAttributeName ?? vendorDefaults.uuidAttributeName, + dnCaseSensitive: + vendorConfig?.dnCaseSensitive ?? vendorDefaults.dnCaseSensitive, decodeStringAttribute: vendorDefaults.decodeStringAttribute, }; const transformer = opts?.transformer ?? defaultUserTransformer; @@ -190,7 +195,10 @@ export async function defaultGroupTransformer( entity.metadata.annotations![LDAP_UUID_ANNOTATION] = v; }); mapStringAttr(entry, vendor, vendor.dnAttributeName, v => { - entity.metadata.annotations![LDAP_DN_ANNOTATION] = v; + entity.metadata.annotations![LDAP_DN_ANNOTATION] = getCaseSensitivityValue( + v, + vendor, + ); }); mapStringAttr(entry, vendor, map.type, v => { entity.spec.type = v; @@ -240,6 +248,8 @@ export async function readLdapGroups( vendorConfig?.dnAttributeName ?? vendorDefaults.dnAttributeName, uuidAttributeName: vendorConfig?.uuidAttributeName ?? vendorDefaults.uuidAttributeName, + dnCaseSensitive: + vendorConfig?.dnCaseSensitive ?? vendorDefaults.dnCaseSensitive, decodeStringAttribute: vendorDefaults.decodeStringAttribute, }; @@ -341,11 +351,23 @@ function mapReferencesAttr( const values = vendor.decodeStringAttribute(entry, attributeName); const dn = vendor.decodeStringAttribute(entry, vendor.dnAttributeName); if (values && dn && dn.length === 1) { - setter(dn[0], values); + if (vendor.dnCaseSensitive) { + setter( + dn[0].toLowerCase(), + values.map(v => v.toLowerCase()), + ); + } else { + setter(dn[0], values); + } } } } +/** Validates value exists and if required forced sensitivty value to lowercase */ +function getCaseSensitivityValue(value: string, vendor: LdapVendor) { + return value && vendor.dnCaseSensitive ? value.toLowerCase() : value; +} + // Inserts a number of values in a key-values mapping function ensureItems( target: Map>, diff --git a/plugins/catalog-backend-module-ldap/src/ldap/vendors.ts b/plugins/catalog-backend-module-ldap/src/ldap/vendors.ts index 9f4e365c38..8b84002c20 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/vendors.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/vendors.ts @@ -30,6 +30,12 @@ export type LdapVendor = { * The attribute name that holds a universal unique identifier for an entry. */ uuidAttributeName: string; + + /** + * The attribute that determines behaviour of the (dn,members,memberOf) for entries. + */ + dnCaseSensitive?: boolean; + /** * Decode ldap entry values for a given attribute name to their string representation. * From f313538eba1e73f20752606502bb470f721318c5 Mon Sep 17 00:00:00 2001 From: John Redwood Date: Tue, 1 Oct 2024 22:30:06 +1000 Subject: [PATCH 03/11] patch: add docs for ldap org Signed-off-by: John Redwood --- docs/integrations/ldap/org.md | 40 ++++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index b1aa460bd6..b84e87a4da 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -53,7 +53,9 @@ backend.add(import('@backstage/plugin-catalog-backend-module-ldap')); ## Configuration The following configuration is a small example of how a setup could look for -importing groups and users from a corporate LDAP server. +importing groups and users from a corporate LDAP server. + +Users and Groups can be configured for multiple `dn` entries as an array. ```yaml catalog: @@ -65,7 +67,7 @@ catalog: dn: uid=ldap-reader-user,ou=people,ou=example,dc=example,dc=net secret: ${LDAP_SECRET} users: - dn: ou=people,ou=example,dc=example,dc=net + - dn: ou=people,ou=example,dc=example,dc=net options: filter: (uid=*) map: @@ -73,7 +75,7 @@ catalog: set: metadata.customField: 'hello' groups: - dn: ou=access,ou=groups,ou=example,dc=example,dc=net + - dn: ou=access,ou=groups,ou=example,dc=example,dc=net options: filter: (&(objectClass=some-group-class)(!(groupType=email))) map: @@ -82,8 +84,8 @@ catalog: metadata.customField: 'hello' ``` -These config blocks have a lot of options in them, so we will describe each -"root" key within the block separately. + +These config blocks have a lot of options in them, so we will describe each "root" key within the block separately. > NOTE: > @@ -303,6 +305,34 @@ map: members: member ``` +## Optional Vendor Configuration + +In case the LDAP vendor isn't available as a provided configuration, A new optional `vendor` configuration section is available which allows overriding the location for `dn` and `uuid` settings, and a case sensitivity function. + +#### vendor.dnAttributeName + +Allows ability to override non standard `entryDN` values. + +#### vendor.uuidAttributeName + +Allows ability to override non standard `entryUUID` values. + +#### vendor.dnCaseSensitive + +Provides the ability to ignore case sensitivity issues with user/group mappings. If set to true will still link user/members to groups by forcing the inbound values from `dn`, `member`, `memberOf` to lowercase. + +```yaml +vendor: + # Attribute name override for the distinguished name (DN) of an entry. + dnAttributeName: dn + # Attribute name override for the unique identifier (UUID) of an entry. + uuidAttributeName: uuid + # Attribute to force values provided from dn and members/memberOf values all to lowercase. + # This is to resolve potential user/group mapping issues if case differences on dn strings. + dnCaseSensitive: true +``` + + ## Customize the Provider In case you want to customize the ingested entities, the provider allows to pass From dd92cbcbdcccf066ff811736d77ab20afe3d7b61 Mon Sep 17 00:00:00 2001 From: John Redwood Date: Tue, 1 Oct 2024 23:35:16 +1000 Subject: [PATCH 04/11] fix: run prettier Signed-off-by: John Redwood --- docs/integrations/ldap/org.md | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index b84e87a4da..88d6dc60fd 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -53,7 +53,7 @@ backend.add(import('@backstage/plugin-catalog-backend-module-ldap')); ## Configuration The following configuration is a small example of how a setup could look for -importing groups and users from a corporate LDAP server. +importing groups and users from a corporate LDAP server. Users and Groups can be configured for multiple `dn` entries as an array. @@ -67,24 +67,23 @@ catalog: dn: uid=ldap-reader-user,ou=people,ou=example,dc=example,dc=net secret: ${LDAP_SECRET} users: - - dn: ou=people,ou=example,dc=example,dc=net - options: - filter: (uid=*) - map: - description: l - set: - metadata.customField: 'hello' + - dn: ou=people,ou=example,dc=example,dc=net + options: + filter: (uid=*) + map: + description: l + set: + metadata.customField: 'hello' groups: - - dn: ou=access,ou=groups,ou=example,dc=example,dc=net - options: - filter: (&(objectClass=some-group-class)(!(groupType=email))) - map: - description: l - set: - metadata.customField: 'hello' + - dn: ou=access,ou=groups,ou=example,dc=example,dc=net + options: + filter: (&(objectClass=some-group-class)(!(groupType=email))) + map: + description: l + set: + metadata.customField: 'hello' ``` - These config blocks have a lot of options in them, so we will describe each "root" key within the block separately. > NOTE: @@ -332,7 +331,6 @@ vendor: dnCaseSensitive: true ``` - ## Customize the Provider In case you want to customize the ingested entities, the provider allows to pass From 92abd8953d2fb533b5a1605bc1c4983b46d695c9 Mon Sep 17 00:00:00 2001 From: John Date: Wed, 9 Oct 2024 07:07:32 +1100 Subject: [PATCH 05/11] Update .changeset/early-cobras-compare.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: John --- .changeset/early-cobras-compare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/early-cobras-compare.md b/.changeset/early-cobras-compare.md index 5a107fedaa..591d1377f3 100644 --- a/.changeset/early-cobras-compare.md +++ b/.changeset/early-cobras-compare.md @@ -2,4 +2,4 @@ '@backstage/plugin-catalog-backend-module-ldap': patch --- -Fixed user/group membership mapping for case insensitive returned dn results for catalog-ldap +Added a `dnCaseSensitive` flag to support LDAP servers with mixed-case attributes. From ea01f7a536f23bd5a65189597853cc97ec1dff18 Mon Sep 17 00:00:00 2001 From: John Date: Wed, 9 Oct 2024 07:07:47 +1100 Subject: [PATCH 06/11] Update docs/integrations/ldap/org.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: John --- docs/integrations/ldap/org.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index 88d6dc60fd..d735ce4b19 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -306,7 +306,7 @@ map: ## Optional Vendor Configuration -In case the LDAP vendor isn't available as a provided configuration, A new optional `vendor` configuration section is available which allows overriding the location for `dn` and `uuid` settings, and a case sensitivity function. +In case the LDAP vendor isn't automatically detected by the module, an optional `vendor` configuration section is available which allows overriding the location for `dn` and `uuid` settings, and a case sensitivity setting. #### vendor.dnAttributeName From b64deda6a4888619d4aec46c142d37401f35d5ae Mon Sep 17 00:00:00 2001 From: John Date: Wed, 9 Oct 2024 07:07:59 +1100 Subject: [PATCH 07/11] Update docs/integrations/ldap/org.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: John --- docs/integrations/ldap/org.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index d735ce4b19..cb5d697b76 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -310,7 +310,7 @@ In case the LDAP vendor isn't automatically detected by the module, an optional #### vendor.dnAttributeName -Allows ability to override non standard `entryDN` values. +Allows explicitly defining the name of the attribute that stores each entry's DN. #### vendor.uuidAttributeName From 6cc341dd2d329fc2b2f1e4f63d7e6ed1ac8c276c Mon Sep 17 00:00:00 2001 From: John Date: Wed, 9 Oct 2024 07:08:16 +1100 Subject: [PATCH 08/11] Update docs/integrations/ldap/org.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: John --- docs/integrations/ldap/org.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index cb5d697b76..7ae500b96a 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -314,7 +314,7 @@ Allows explicitly defining the name of the attribute that stores each entry's DN #### vendor.uuidAttributeName -Allows ability to override non standard `entryUUID` values. +Allows explicitly defining the name of the attribute that stores each entry's UUID. #### vendor.dnCaseSensitive From f3e6e87702520148a3280481e7ad5b883b540455 Mon Sep 17 00:00:00 2001 From: John Date: Wed, 9 Oct 2024 07:08:27 +1100 Subject: [PATCH 09/11] Update docs/integrations/ldap/org.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: John --- docs/integrations/ldap/org.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index 7ae500b96a..962cc51597 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -318,7 +318,7 @@ Allows explicitly defining the name of the attribute that stores each entry's UU #### vendor.dnCaseSensitive -Provides the ability to ignore case sensitivity issues with user/group mappings. If set to true will still link user/members to groups by forcing the inbound values from `dn`, `member`, `memberOf` to lowercase. +Provides the ability to ignore case sensitivity issues with user/group mappings. If set to true, the ingestion will link user/members to groups whether their `dn`, `member`, or `memberOf` values have the right case or not. ```yaml vendor: From 01e3254efb87baf9263f2cfafaaa66c23a37d77e Mon Sep 17 00:00:00 2001 From: John Date: Tue, 8 Oct 2024 20:15:54 +0000 Subject: [PATCH 10/11] fix: modifiy locales to force en-US on toLowercase() Signed-off-by: John --- plugins/catalog-backend-module-ldap/src/ldap/read.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/catalog-backend-module-ldap/src/ldap/read.ts b/plugins/catalog-backend-module-ldap/src/ldap/read.ts index 6fbd2a7e86..0bc55901a5 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/read.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/read.ts @@ -353,8 +353,8 @@ function mapReferencesAttr( if (values && dn && dn.length === 1) { if (vendor.dnCaseSensitive) { setter( - dn[0].toLowerCase(), - values.map(v => v.toLowerCase()), + dn[0].toLocaleLowerCase('en-US'), + values.map(v => v.toLocaleLowerCase('en-US')), ); } else { setter(dn[0], values); @@ -365,7 +365,7 @@ function mapReferencesAttr( /** Validates value exists and if required forced sensitivty value to lowercase */ function getCaseSensitivityValue(value: string, vendor: LdapVendor) { - return value && vendor.dnCaseSensitive ? value.toLowerCase() : value; + return value && vendor.dnCaseSensitive ? value.toLocaleLowerCase('en-US') : value; } // Inserts a number of values in a key-values mapping From f1ef8fb97cb2b62aca75499dc0b301eeccfff68e Mon Sep 17 00:00:00 2001 From: John Redwood Date: Wed, 9 Oct 2024 19:36:13 +1100 Subject: [PATCH 11/11] fix: prettier file Signed-off-by: John Redwood --- plugins/catalog-backend-module-ldap/src/ldap/read.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/plugins/catalog-backend-module-ldap/src/ldap/read.ts b/plugins/catalog-backend-module-ldap/src/ldap/read.ts index 0bc55901a5..2ec663d7fe 100644 --- a/plugins/catalog-backend-module-ldap/src/ldap/read.ts +++ b/plugins/catalog-backend-module-ldap/src/ldap/read.ts @@ -365,7 +365,9 @@ function mapReferencesAttr( /** Validates value exists and if required forced sensitivty value to lowercase */ function getCaseSensitivityValue(value: string, vendor: LdapVendor) { - return value && vendor.dnCaseSensitive ? value.toLocaleLowerCase('en-US') : value; + return value && vendor.dnCaseSensitive + ? value.toLocaleLowerCase('en-US') + : value; } // Inserts a number of values in a key-values mapping