[KNOX-694] Enhance LDAP user search configurability

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.8.0
• Fix Version/s: 0.9.0
• Component/s: Server
• Assignee: Kevin Minder
• Reporter: Kevin Minder
• Created: 16/Mar/16 20:50
• Updated: 28/Mar/19 14:14
• Resolved: 17/Mar/16 15:41

Description

In very complex organizations the current configuration supported by KnoxLdapRealm my not be sufficient. Ideally it would be possible to:
1. Configure the LDAP search filter directly
2. Configure the LDAP search scope
3. Have portions of the search base and filter be derived from the input principal.
To clarify this, I'm thinking of provider configurations like these

<param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
<param name="main.ldapRealm.userDnTemplate" value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>

<param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
<param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qa,DC=company,DC=com"/>
<param name="main.ldapRealm.userSearchAttributeName" value="sAMAccountName"/>
<param name="main.ldapRealm.userSearchAttributeTemplate" value="{2}"/>

<param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
<param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qe,DC=company,DC=com"/>
<param name="main.ldapRealm.userSearchFilter" value="(&amp;(objectclass=person)(sAMAccountName={2}))"/>

<param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
<param name="main.ldapRealm.userSearchBase" value="CN={1},DC=qe,DC=company,DC=com"/>
<param name="main.ldapRealm.userSearchFilter" value="(&amp;(objectclass=person)(sAMAccountName={2}))"/>
<param name="main.ldapRealm.userSearchScope" value="onelevel"/>

<param name="main.ldapRealm.principalRegex" value="(.*?)\\(.*)"/>
<param name="main.ldapRealm.userSearchBase" value="CN={2},CN={1},DC=qa,DC=company,DC=com"/>
<param name="main.ldapRealm.userSearchScope" value="object"/>