Explanation:
The LDAP User Data Provider performs two jobs:
- Authentication of a username and password.
- Retrieval of user attributes.
To achieve this, it first binds to base on the LDAP server url. If binddn is not present, it binds to the LDAP server anonymously, elsewise binddn and bindpw are used for authentication.
Next, a search searchPattern with scope searchScope is executed where "%LOGIN%" is replaced by the escaped version of the username.
The search returning no node or more than one node is treated as failure.
If passwordAttribute is set, and the node has an attribute with this name and this attribute's value starts with "{x-plain}", the password is checked against the rest of the value for equality. If passwordAttribute is not set, a second binding is attempted on the node using the password the user provided.
The user attribute keys specified in the mapping are then renamed according to the mapping and used for further processing (see the other modules of the login interceptor).
For the initial binding, connectTimeout can be used to specify a timeout in milliseconds. For the search, timeout can be used.
If readAttributesAsSelf is not set, the user attributes are collected from the search result. If it is set, an additional request is made after the second successful binding to retrieve the node's attributes.
Syntax
ldapUserDataProvider:
base: <string> # required
searchPattern: <string> # required
url: <string> # required
'$ref': <string>
binddn: <string>
bindpw: <string>
connectTimeout: <string>
map:
- <attribute>
passwordAttribute: <string>
readAttributesAsSelf: <boolean>
searchScope: object
ssl: {}
timeout: <string>
ldapUserDataProvider:
base: <string> # required
searchPattern: <string> # required
url: <string> # required
'$ref': <string>
binddn: <string>
bindpw: <string>
connectTimeout: <string>
map:
- <attribute>
passwordAttribute: <string>
readAttributesAsSelf: <boolean>
searchScope: object
ssl: {}
timeout: <string>
Sample
<ldapUserDataProvider
url="ldap://192.168.2.100"
base="dc=predic8,dc=de"
binddn="cn=Manager,dc=predic8,dc=de"
bindpw="secret"
searchPattern="(cn=%LOGIN%)"
searchScope="subtree"
timeout="1000"
connectTimeout="1000"
readAttributesAsSelf="true" >
<map>
<attribute from="telephoneNumber" to="sms" />
<attribute from="uidNumber" to="header-X-Security-UID" />
</map>
</ldapUserDataProvider>
<ldapUserDataProvider
url="ldap://192.168.2.100"
base="dc=predic8,dc=de"
binddn="cn=Manager,dc=predic8,dc=de"
bindpw="secret"
searchPattern="(cn=%LOGIN%)"
searchScope="subtree"
timeout="1000"
connectTimeout="1000"
readAttributesAsSelf="true" >
<map>
<attribute from="telephoneNumber" to="sms" />
<attribute from="uidNumber" to="header-X-Security-UID" />
</map>
</ldapUserDataProvider>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| $ref | false | - | Reference a component defined under components. | - |
| base | true | - | - | - |
| binddn | false | - | - | - |
| bindpw | false | - | - | - |
| connectTimeout | false | 1000 | - | - |
| passwordAttribute | false | - | - | - |
| readAttributesAsSelf | false | true | - | - |
| searchPattern | true | - | - | - |
| searchScope | false | subtree | - | - |
| timeout | false | 1000 | - | - |
| url | true | - | - | - |
Child Structure
| Element | Cardinality | Description |
|---|---|---|
| map | 0..* | |
| ssl | 0..1 | Configures a TLS context: the identity (key and certificate) presented to the peer, the certificates trusted from it, and handshake parameters such as protocol, ciphers, and client-certificate policy. Attach it to a serviceProxy/api to terminate inbound TLS, or to a target to make an outbound connection over TLS; most attributes and child elements apply to both directions, but a few - such as clientAuth and useAsDefault - only take effect on an inbound context. See tutorials/ssl-tls/10-TLS-Termination.yaml for inbound termination and tutorials/ssl-tls/20-Central-SSL-Config.yaml for sharing one ssl across several APIs via $ref. |