ISSUE: LDAP provider integration

[justin-stephenson]

After adding a SCIM plugin with the LDAP integration domain, I needed to change in sssd.conf as it was 'dn=ldap, dn=test'

ldap_search_base = dc=ldap, dc=test
and also add
ldap_default_authtok = Password

This allowed me to id the user, but infopipe will not find the correct user attributes if the default user LDAP schema does not contain sn or givenName.

ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname

A solution should be investigated, which requires consideration for different LDAP schemas that SSSD can work with.

[f-trivino]

Hi @justin-stephenson, I sent quick fix for ldap_search_base and ldap_default_authtok:

#35

Ref LDAP schema issue you are pointing out, the automation is supposed to grab the content from "User extra attributes"

e.g. "mail:mail, sn:sn, givenname:givenname"

and set accordingly:

[domain/ldap.test]
ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname

[ifp]
user_attributes = +mail, +givenname, +sn, +lock

I think if infopipe is configured with supported LDAP attrs then it will work.

probably I didn't understand well the issue.

[justin-stephenson]

Hi @justin-stephenson, I sent quick fix for ldap_search_base and ldap_default_authtok:

#35

Ref LDAP schema issue you are pointing out, the automation is supposed to grab the content from "User extra attributes"

e.g. "mail:mail, sn:sn, givenname:givenname"

and set accordingly:

[domain/ldap.test]
ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname

[ifp]
user_attributes = +mail, +givenname, +sn, +lock

I think if infopipe is configured with supported LDAP attrs then it will work.

probably I didn't understand well the issue.

Retrieving users via SCIM bridge with the LDAP provider was not working last I tested, IIRC the sssd.conf still needs to be tuned properly to retrieve the users stored in 389 ds base, as they do not have sn or givenname attributes (like they do in the IPA case)