[CXF-6303] Multi Group and User BaseDN Support for LdapGroupClaimsHandler

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.1, 2.7.16, 3.0.5
• Component/s: STS
• Labels: Claim STS
• Estimated Complexity: Advanced
• Assignee: Colm O hEigeartaigh
• Reporter: Christian Schmülling
• Created: 18/Mar/15 14:38
• Updated: 30/Apr/15 15:41

Description

The current implementation of the LdapGroupClaimsHandler only allows to define a single DN for your group and user search base. In cases when groups and users are spread in multiple OUs which do not share a common OU, it is not possible to collect claims for all the users.

Sample:
CN=group1,OU=Internal-Group,DC=MY,DC=DOMAIN,DC=COM
CN=group2,OU=External-Group,DC=MY,DC=DOMAIN,DC=COM

Setting the "groupBaseDN" to "OU=Internal-Group,DC=MY,DC=DOMAIN,DC=COM" would cause that roles for Bob could not be resolved.

My proposal is to add properties "groupBaseDNs" and "userBaseDNs" to the LdapGroupClaimsHandler containing a List<String> of groupBaseDN and userBaseDN.