In some use-cases, one would like to login using either their username or email. Administrators now don't have to choose a single field but may specify multiple fields to count as "username".
Signed-off-by: Yarden Shoham <git@yardenshoham.com>
This commit enables universal nested group search support across a
variety of LDAP server implementations. It updates the code to allow
recursive group membership discovery during user authentication and
provides CI tests to validate the functionality.
Based on @paroque’s original https://github.com/dexidp/dex/pull/1058
PR.
- Removed `Recursive` boolean flag from config and logic
- Made recursion behavior dependant on presence of `RecursionGroupAttr`
- Updated log messages to reflect changes and follow `slog` structured format
Signed-off-by: Ethan Dieterich <ethandieterich@gmail.com>
When connecting to an LDAP server, there are three ways to connect:
1. Insecurely through port 389 (LDAP).
2. Securely through port 696 (LDAPS).
3. Insecurely through port 389 then negotiate TLS (StartTLS).
This PR adds support for the 3rd flow, letting dex connect to the
standard LDAP port then negotiating TLS through the LDAP protocol
itself.
See a writeup here:
http://www.openldap.org/faq/data/cache/185.html
Yarden Shoham
EthanDieterich
Mark Sagi-Kazar
Eric Chiang