[CAUSEWAY-1162] For Shiro Realm,Make LDAP attributes as permision generator

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: core-1.8.0
• Fix Version/s: 1.9.0
• Component/s: Security Shiro
• Assignee: Unassigned
• Reporter: sebastien diaz
• Created: 17/Jun/15 13:54
• Updated: 01/Sep/15 19:49
• Resolved: 10/Jul/15 12:48

Description

Add attribute for permission ldap extraction

I propose new permisions creation from LDAP attribute
Alternatively, permissions can be extracted from the base itself with the parameter searchUserBase,
the attribute list as userExtractedAttribute and the permission url as permissionByUserAttribute.
The idea is to extract attribute from the user or the group of the user and map directly to permission rule in replacing the string

{attribute}

by the extracted attribute (can me multiple).
See the sample for group and user attribute and mapping:
ldapRealm.searchUserBase = ou=users,o=mojo
ldapRealm.userObjectClass=inetOrgPerson
ldapRealm.userObjectClass=organizationnalPerson
ldapRealm.groupExtractedAttribute=street,country
ldapRealm.userExtractedAttribute=street,country
ldapRealm.permissionByGroupAttribute=attribute:Folder.

{street}:Read,attribute:Portfolio.{country}
ldapRealm.permissionByUserAttribute=attribute:Folder.{street}

:Read,attribute:Portfolio.

{country}

Issue Links

• links to: Pull request