enhancement
Until now, the records for user account synchronization have been identified as follows.
- Query the configured user group(s)
1a. Query the group members (as List<String> = DNs)
- Query the individual user records for these DNs
2a. A configurable query is additionally included as a filter in this query to exclude individual group member records from the user account synchronization.
From time to time, discussions arise regarding Step 1: Either querying the user group(s) is not possible or not permitted, or it is not effective because the identification of user accounts is to be handled by means other than group assignment.
Therefore, the following extension has been added:
Until now, the explicit configuration of at least one user group has been mandatory—it is evaluated as described above. If no user group is configured, this has previously resulted in a ConfigurationError.
Instead, this extension introduces the following: in this case (no user group configured), the LDAPQuery—which is already configurable—is used on its own to determine the relevant data records. In this case, it is expected that this query will completely and unambiguously identify all data records required for user account synchronization.
Group memberships can be encoded in this query just as other characteristics (attribute values, object classes, etc.) can be.
This creates, on the one hand, the ability to perform automatic user account synchronization without explicitly querying the user group(s) and, on the other hand, enables the identification of records for user account synchronization using characteristics other than group membership.
This feature is an add-on in the following sense:
- Existing configurations remain valid, and this extension has no impact on their functionality.
- A previously invalid configuration—“Specifying an LDAP query without specifying a user group”—is now valid and results in the specified query being evaluated on its own.
Test
No test