{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/546","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/546/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/546/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/546/events","html_url":"https://github.com/hashicorp/vault/issues/546","id":101972328,"number":546,"title":"Rewrite LDAP backend","user":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/vault/labels/accepted","name":"accepted","color":"009800"},{"url":"https://api.github.com/repos/hashicorp/vault/labels/auth/ldap","name":"auth/ldap","color":"207de5"},{"url":"https://api.github.com/repos/hashicorp/vault/labels/thinking","name":"thinking","color":"c7def8"}],"state":"open","locked":false,"assignee":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/3","html_url":"https://github.com/hashicorp/vault/milestones/0.4.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/3/labels","id":1266940,"number":3,"title":"0.4.0","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":0,"state":"open","created_at":"2015-08-21T21:19:39Z","updated_at":"2015-09-21T12:43:31Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2015-08-19T18:55:12Z","updated_at":"2015-09-21T14:31:42Z","closed_at":null,"body":"The LDAP backend tries to hide complexity from the user; instead it increases complexity by requiring an increasing amount of logic and role parameters to handle various LDAP setups.\r\n\r\nThe backend should follow the example of other LDAP-integrating programs and allow for flexible and expressive parameters that put the user in control. This will also simplify the internal logic quite a bit."},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/141999709","html_url":"https://github.com/hashicorp/vault/issues/546#issuecomment-141999709","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/546","id":141999709,"user":{"login":"jhaals","id":68980,"avatar_url":"https://avatars.githubusercontent.com/u/68980?v=3","gravatar_id":"","url":"https://api.github.com/users/jhaals","html_url":"https://github.com/jhaals","followers_url":"https://api.github.com/users/jhaals/followers","following_url":"https://api.github.com/users/jhaals/following{/other_user}","gists_url":"https://api.github.com/users/jhaals/gists{/gist_id}","starred_url":"https://api.github.com/users/jhaals/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhaals/subscriptions","organizations_url":"https://api.github.com/users/jhaals/orgs","repos_url":"https://api.github.com/users/jhaals/repos","events_url":"https://api.github.com/users/jhaals/events{/privacy}","received_events_url":"https://api.github.com/users/jhaals/received_events","type":"User","site_admin":false},"created_at":"2015-09-21T14:31:42Z","updated_at":"2015-09-21T14:31:42Z","body":"Yeah and \"features\" that should be added to the backend, some asked for a specific bind user and I have issues with the backend in it's current form due to our user DNs being `cn=Firstname Lastname,ou=users`, that does not match on posixGroups where the `memberUid:` maps to the users `uid`.\r\n\r\nI solved it with this patch for now which searches for the username before doing the bind to get around the problem with us having cn= instead of uid= in our dn\r\n```\r\n// Find dn for username\r\nsresult, err := c.Search(&ldap.SearchRequest{\r\n     BaseDN: cfg.UserDN,\r\n     Scope:  2, // subtree\r\n     Filter: fmt.Sprintf(\"(uid=%s)\", username),\r\n})\r\nif err != nil {\r\n     return nil, logical.ErrorResponse(fmt.Sprintf(\"LDAP bind failed: %v\", err)), nil\r\n}\r\nfor _, e := range sresult.Entries {\r\n     binddn = e.DN\r\n}\r\n```"}}