[Galene] Re: Experimental LDAP integration for Galene

["Michael Ströder" <michael@stroeder.com>]

On 8/3/22 11:51, Juliusz Chroboczek wrote:
> https://github.com/jech/galene-ldap
> 
> Probably not very useful yet, but a good platform for further
> experimentation.  If you're running LDAP, please try setting it up and
> share your ideas about how it could be made useful.

In general when implementing an LDAP auth client it's very helpful to 
make the LDAP filter for searching the user entry configurable with kind 
of template string.

Especially the hard-coded filter

(&(objectClass=posixAccount)(uid=%s))

won't work in most LDAP deployments which do not use this object class 
for accounts, with MS AD being the most prominent example.

Especially you could define for simple access control:

(&(uid=%s)(memberOf=cn=test-auth,dc=example,dc=org))

Or any other kind of attribute-based login access control.

BTW: While historically I have quite strong LDAP background I'm still 
convinced that an OpenID Connect (OIDC) integration would be more 
helpful for the future. So you could leave LDAP integration, 2FA etc. to 
the usual WebSSO suspects like Keycloak, Authelia, CAS, Authentik etc. 
And admins can choose whatever other authc mech they want.

Ciao, Michael.