Skip to content

Ldap enhancements#970

Open
dbenesj wants to merge 3 commits into
cibseven:mainfrom
dbenesj:ldap-enhancements
Open

Ldap enhancements#970
dbenesj wants to merge 3 commits into
cibseven:mainfrom
dbenesj:ldap-enhancements

Conversation

@dbenesj
Copy link
Copy Markdown

@dbenesj dbenesj commented May 7, 2026

Enhancement and fixes for LdapUserProvider:

  1. do not perform full LDAP search from configured base when verifying whether user can login
    1. this is not comonly allowed for general users
    2. instead of that retrieve only currently logged in user
  2. allow to modify LDAP objectClass for users instead of current hardcoded value
  3. do not fail when attribute for display name is not defined for user that is trying to login

This way it makes the LdapUserProvider usable in more environments.

cogniware added 3 commits May 7, 2026 13:14
Regular users are not in general allowed to do that.
Instead retrieve just the node of the user that is trying to log in, which is generally allowed.
if (result.getAttributes().get(ldapDisplayNameAttribute) != null) {
user.setDisplayName(result.getAttributes().get(ldapDisplayNameAttribute).get().toString());
} else {
log.debug("User " + login.getUsername() + " does not have attribute " + ldapDisplayNameAttribute + " defined.");
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
log.debug("User " + login.getUsername() + " does not have attribute " + ldapDisplayNameAttribute + " defined.");
user.setDisplayName(user.getUserID());
log.debug("User " + login.getUsername() + " does not have attribute " + ldapDisplayNameAttribute + " defined.");

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't that be a duplication of the logic that is already in CIBUser.getDisplayName()?

	@Override
	public String getDisplayName() {
		if((displayName != null)&&(!displayName.isEmpty())) return displayName;
		else return userID;
	}

personaly I would prefer to not be setting the display name and leave that logic only in CIBUser.getDisplayName(), but no strong opinion 😉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants