[OAK-3119] Allow to validate connections to LDAP with a different request than a request towards the Root DSE

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.3.2
• Component/s: auth-ldap
• Assignee: Unassigned
• Reporter: Konrad Windszus
• Created: 17/Jul/15 13:38
• Updated: 17/Jul/15 13:38

Description

In https://issues.apache.org/jira/browse/OAK-2897 the option was introduced to disable the validation of the LDAP connections in the pool.
But I guess there is a good reason to validate those connections (to prevent all sort of connection issues afterwards).
So what about making the request which is done to validate the connection configurable? Currently it only issues requests towards the Root DSE, which is often forbidden for specific users (https://github.com/apache/jackrabbit-oak/blob/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/UnboundLookupConnectionValidator.java#L44).
What about using a request towards the user base DN?

Issue Links

• relates to: OAK-2783 Make LDAP connection pool 'testOnBorrow' configurable