[KARAF-606] JAAS: Allow LDAPLoginModule to supply role "DN" from LDAP group search

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 2.2.1, 2.2.5, 3.0.0
• Component/s: karaf

Environment

Windows/any

• Assignee: Jean-Baptiste Onofré
• Reporter: Kurt Westerfeld
• Created: 02/May/11 02:33
• Updated: 14/Sep/18 08:37
• Resolved: 06/Dec/11 14:36

Description

The LDAPLoginModule has the ability to supply a configuration variable (role.name.attribute) to use when creating a role. This value can be changed from "cn" to any of a number LDAP attributes. However it cannot access the actual distinguished name of the queried groups while processing a login, as "dn" or "distinguishedName", "entryDN", etc., are not universally supported across LDAP implementations as an attribute.

Proposal to special case "dn" and use javax.naming.directory.SearchResult.getNameInNamespace(), which returns the dn of the found groups when converting to a role.

This is a very small change; will provide a patch.