{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/35023294","id":35023294,"diff_hunk":"@@ -0,0 +1,105 @@\n+# Syncing LDAP Groups to OpenShift Groups\n+\n+Linking OpenShift `Groups` to their representations on LDAP servers allows for administrators to have an easier way to manage `Groups` inside OpenShift. This additional functionality will require no additional fields on the OpenShift `Group` object. The sync job will indicate that an OpenShift `Group` mirrors an external representation by setting the `openshift.io/externalRecordProvider` `Annotation` in the `Group` as well as adding a `Label` such as `openshift.io/externalRecordProvider/LDAP` to the `Group`. Other information (e.g. last sync time or resource version) will be stored as `Annotations` on the OpenShift `Group`. Logistical information for the LDAP sync will be stored in an `LDAPSyncOptions` that the administrator will need to provide.\n+\n+### Use Cases\n+1. I want to sync all LDAP groups I've configured in a sync job (e.g. a specific LDAP server configuration) to OpenShift `Groups`\n+* I want to sync specific OpenShift `Groups` with their `externalRecordProviders`\n+* I want to sync a speficic set of LDAP groups to OpenShift `Groups`\n+* I want to run a destructive sync that will remove OpenShift groups that were created or updated by a previous sync if the LDAP server no longer contains their record\n+* I want to map an LDAP group to an existing OpenShift `Group`\n+\n+## Supported LDAP Group Schemas\n+The three LDAP schemas supported are\n+\n+1. groups as first-class LDAP entries that contain lists of members of the group\n+2. users as first-class LDAP entries that contain lists of groups they are a member of\n+3. schema 2 above, also including first-class groups to store metadata\n+\n+### Data Flow\n+* Determine list of LDAP groups to be synced\n+* Find LDAP group members\n+* Determine OpenShift `Identities` from LDAP group members\n+* Determine OpenShift `Users` from OpenShift `Identities`\n+* Determine OpenShift `Group` from LDAP group\n+* Populate new OpenShift `Group`'s `Users` from resulting OpenShift `UserIdentityMappings`, update OpenShift `Group` metadata fields tied to LDAP attributes, leave other OpenShift `Group` fields unchanged\n+\n+##  Determining Which LDAP Groups To Sync\n+An `LDAPGroupLister` determines what LDAP groups needs to be synced and outputs the result as a set of unique identifier strings. The other objects that take these unique identifiers need to understand the format of this string (e.g. these objects will be tightly coupled). For example, an `LDAPGroupLister` for schema 1 above cannot be used with a `LDAPGroupDataExtractor` for schema 2. The four `LDAPGroupLister` implementations that are necessary are:","path":"docs/proposals/ldap-group-sync.md","position":28,"original_position":28,"commit_id":"21e3598a3f0a2554a65cd1714cfd4e85cd7df38a","original_commit_id":"21e3598a3f0a2554a65cd1714cfd4e85cd7df38a","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"\"as a set of unique identifier strings, called LDAP groupUIDs\" so we can reasonable refer to them in the rest of the doc.","created_at":"2015-07-20T17:55:36Z","updated_at":"2015-07-20T17:55:36Z","html_url":"https://github.com/openshift/origin/pull/3700#discussion_r35023294","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/3700","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/35023294"},"html":{"href":"https://github.com/openshift/origin/pull/3700#discussion_r35023294"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/3700"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/3700","id":39943333,"html_url":"https://github.com/openshift/origin/pull/3700","diff_url":"https://github.com/openshift/origin/pull/3700.diff","patch_url":"https://github.com/openshift/origin/pull/3700.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/3700","number":3700,"state":"open","locked":false,"title":"LDAP group sync proposal","user":{"login":"stevekuznetsov","id":7328370,"avatar_url":"https://avatars.githubusercontent.com/u/7328370?v=3","gravatar_id":"","url":"https://api.github.com/users/stevekuznetsov","html_url":"https://github.com/stevekuznetsov","followers_url":"https://api.github.com/users/stevekuznetsov/followers","following_url":"https://api.github.com/users/stevekuznetsov/following{/other_user}","gists_url":"https://api.github.com/users/stevekuznetsov/gists{/gist_id}","starred_url":"https://api.github.com/users/stevekuznetsov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevekuznetsov/subscriptions","organizations_url":"https://api.github.com/users/stevekuznetsov/orgs","repos_url":"https://api.github.com/users/stevekuznetsov/repos","events_url":"https://api.github.com/users/stevekuznetsov/events{/privacy}","received_events_url":"https://api.github.com/users/stevekuznetsov/received_events","type":"User","site_admin":false},"body":"Proposal for support for LDAP group sync. Builds on #3627 \r\n\r\n@deads2k PTAL","created_at":"2015-07-14T17:56:09Z","updated_at":"2015-07-20T17:55:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8dad86d94bd7fa7da42925be2f73f590f4cdd472","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/3700/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/3700/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3700/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/21e3598a3f0a2554a65cd1714cfd4e85cd7df38a","head":{"label":"stevekuznetsov:skuznets/ldap-group-sync-proposal","ref":"skuznets/ldap-group-sync-proposal","sha":"21e3598a3f0a2554a65cd1714cfd4e85cd7df38a","user":{"login":"stevekuznetsov","id":7328370,"avatar_url":"https://avatars.githubusercontent.com/u/7328370?v=3","gravatar_id":"","url":"https://api.github.com/users/stevekuznetsov","html_url":"https://github.com/stevekuznetsov","followers_url":"https://api.github.com/users/stevekuznetsov/followers","following_url":"https://api.github.com/users/stevekuznetsov/following{/other_user}","gists_url":"https://api.github.com/users/stevekuznetsov/gists{/gist_id}","starred_url":"https://api.github.com/users/stevekuznetsov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevekuznetsov/subscriptions","organizations_url":"https://api.github.com/users/stevekuznetsov/orgs","repos_url":"https://api.github.com/users/stevekuznetsov/repos","events_url":"https://api.github.com/users/stevekuznetsov/events{/privacy}","received_events_url":"https://api.github.com/users/stevekuznetsov/received_events","type":"User","site_admin":false},"repo":{"id":35963136,"name":"origin","full_name":"stevekuznetsov/origin","owner":{"login":"stevekuznetsov","id":7328370,"avatar_url":"https://avatars.githubusercontent.com/u/7328370?v=3","gravatar_id":"","url":"https://api.github.com/users/stevekuznetsov","html_url":"https://github.com/stevekuznetsov","followers_url":"https://api.github.com/users/stevekuznetsov/followers","following_url":"https://api.github.com/users/stevekuznetsov/following{/other_user}","gists_url":"https://api.github.com/users/stevekuznetsov/gists{/gist_id}","starred_url":"https://api.github.com/users/stevekuznetsov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevekuznetsov/subscriptions","organizations_url":"https://api.github.com/users/stevekuznetsov/orgs","repos_url":"https://api.github.com/users/stevekuznetsov/repos","events_url":"https://api.github.com/users/stevekuznetsov/events{/privacy}","received_events_url":"https://api.github.com/users/stevekuznetsov/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/stevekuznetsov/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/stevekuznetsov/origin","forks_url":"https://api.github.com/repos/stevekuznetsov/origin/forks","keys_url":"https://api.github.com/repos/stevekuznetsov/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/stevekuznetsov/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/stevekuznetsov/origin/teams","hooks_url":"https://api.github.com/repos/stevekuznetsov/origin/hooks","issue_events_url":"https://api.github.com/repos/stevekuznetsov/origin/issues/events{/number}","events_url":"https://api.github.com/repos/stevekuznetsov/origin/events","assignees_url":"https://api.github.com/repos/stevekuznetsov/origin/assignees{/user}","branches_url":"https://api.github.com/repos/stevekuznetsov/origin/branches{/branch}","tags_url":"https://api.github.com/repos/stevekuznetsov/origin/tags","blobs_url":"https://api.github.com/repos/stevekuznetsov/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/stevekuznetsov/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/stevekuznetsov/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/stevekuznetsov/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/stevekuznetsov/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/stevekuznetsov/origin/languages","stargazers_url":"https://api.github.com/repos/stevekuznetsov/origin/stargazers","contributors_url":"https://api.github.com/repos/stevekuznetsov/origin/contributors","subscribers_url":"https://api.github.com/repos/stevekuznetsov/origin/subscribers","subscription_url":"https://api.github.com/repos/stevekuznetsov/origin/subscription","commits_url":"https://api.github.com/repos/stevekuznetsov/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/stevekuznetsov/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/stevekuznetsov/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/stevekuznetsov/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/stevekuznetsov/origin/contents/{+path}","compare_url":"https://api.github.com/repos/stevekuznetsov/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/stevekuznetsov/origin/merges","archive_url":"https://api.github.com/repos/stevekuznetsov/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/stevekuznetsov/origin/downloads","issues_url":"https://api.github.com/repos/stevekuznetsov/origin/issues{/number}","pulls_url":"https://api.github.com/repos/stevekuznetsov/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/stevekuznetsov/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/stevekuznetsov/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/stevekuznetsov/origin/labels{/name}","releases_url":"https://api.github.com/repos/stevekuznetsov/origin/releases{/id}","created_at":"2015-05-20T17:28:25Z","updated_at":"2015-05-20T17:28:28Z","pushed_at":"2015-07-20T17:39:16Z","git_url":"git://github.com/stevekuznetsov/origin.git","ssh_url":"git@github.com:stevekuznetsov/origin.git","clone_url":"https://github.com/stevekuznetsov/origin.git","svn_url":"https://github.com/stevekuznetsov/origin","homepage":"http://www.openshift.org","size":121740,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"169546163c30fbea531271b0ddbe6f464a9bd6be","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-07-20T12:20:16Z","pushed_at":"2015-07-20T17:39:17Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":192849,"stargazers_count":557,"watchers_count":557,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":306,"mirror_url":null,"open_issues_count":434,"forks":306,"open_issues":434,"watchers":557,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/3700"},"html":{"href":"https://github.com/openshift/origin/pull/3700"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/3700"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/3700/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/3700/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/3700/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/21e3598a3f0a2554a65cd1714cfd4e85cd7df38a"}}}}