Separate LDAP lookup fields from User lookup fields #273
Description
It seems that the LDAP lookup names are the same as the User lookup names (both taken from LDAP_AUTH_USER_LOOKUP_FIELDS. I'd like them to be allowed to be separate.
My scenario occurs with Active Directory. I don't know whether it can occur with OpenLDAP.
As an example, I would like to use sAMAccount name to authenticate as AD, but use the object GUID to look up the user. That way, if a user's sAMAccountName changes, their permissions will remain associated with their object guid instead of losing their permissions or, worse, assuming someone else's permissions who previously had that sAMAccount name. I think the same could apply to upn. This does introduce the edge case of an "old" username conflicting with a "new" username in the database.
To address this, i would:
- Create a setting LDAP_AUTH_USER_BIND_FIELDS
- Use this value or, if empty, use LDAP_AUTH_USER_LOOKUP_FIELDS, when binding to LDAP
- When getting the user, if the user lookup fields are different than the bind fields, look up the user on each set and compare them.
- If the user object is the same or the username lookup failed to retrieve an object, then there is no conflict and the current behavior is fine.
- If there is a conflict, then the current object guid can retain the current LDAP lookup fields, and the LDAP lookup fields for the other user object need to be updated to eliminate the conflict. A default AD implementation would be to look up the conflicting user on their object guid and update their user record to reflect the current sAMAccountName for that object.