From 9824c75bbe29d111cd491081dd1838221acaece3 Mon Sep 17 00:00:00 2001 From: prabhat-hashi <111032280+prabhat-hashi@users.noreply.github.com> Date: Fri, 3 Mar 2023 12:31:06 +1100 Subject: [PATCH 1/2] Docs - update ldap page to add clarity around sAMAccountName Updated https://developer.hashicorp.com/vault/docs/secrets/ldap#active-directory-ad-1 to clarify customers configure username properly using username_template when sAMAccountName is involved. --- website/content/docs/secrets/ldap.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/website/content/docs/secrets/ldap.mdx b/website/content/docs/secrets/ldap.mdx index 86f5b072120d..a7444270d0e3 100644 --- a/website/content/docs/secrets/ldap.mdx +++ b/website/content/docs/secrets/ldap.mdx @@ -225,6 +225,8 @@ password and enable the account. Windows NT systems and has a limit of 20 characters. Keep this in mind when defining your `username_template`. See [here](https://docs.microsoft.com/en-us/windows/win32/adschema/a-samaccountname) for additional details. +Since the default `username_template` is longer than 20 characters which follows the template of `v_{{.DisplayName}}_{{.RoleName}}_{{random 10}}_{{unix_time}}`, we recommend customising the `username_template` on the role configuration to generate accounts with names less than 20 characters. Please refer to the [username templating document](https://developer.hashicorp.com/vault/docs/concepts/username-templating) for more information. + With regard to adding dynamic users to groups, AD doesn't let you directly modify a user's `memberOf` attribute. The `member` attribute of a group and `memberOf` attribute of a user are [linked attributes](https://docs.microsoft.com/en-us/windows/win32/ad/linked-attributes). Linked attributes are From 0a0d832c6db48d8695e3b521862016c12287d9fa Mon Sep 17 00:00:00 2001 From: prabhat-hashi <111032280+prabhat-hashi@users.noreply.github.com> Date: Fri, 3 Mar 2023 12:42:03 +1100 Subject: [PATCH 2/2] Docs - edit on last update for ldap page Fixed the link /vault/docs/concepts/username-templating --- website/content/docs/secrets/ldap.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/content/docs/secrets/ldap.mdx b/website/content/docs/secrets/ldap.mdx index a7444270d0e3..f9d6a5e44f92 100644 --- a/website/content/docs/secrets/ldap.mdx +++ b/website/content/docs/secrets/ldap.mdx @@ -225,7 +225,7 @@ password and enable the account. Windows NT systems and has a limit of 20 characters. Keep this in mind when defining your `username_template`. See [here](https://docs.microsoft.com/en-us/windows/win32/adschema/a-samaccountname) for additional details. -Since the default `username_template` is longer than 20 characters which follows the template of `v_{{.DisplayName}}_{{.RoleName}}_{{random 10}}_{{unix_time}}`, we recommend customising the `username_template` on the role configuration to generate accounts with names less than 20 characters. Please refer to the [username templating document](https://developer.hashicorp.com/vault/docs/concepts/username-templating) for more information. +Since the default `username_template` is longer than 20 characters which follows the template of `v_{{.DisplayName}}_{{.RoleName}}_{{random 10}}_{{unix_time}}`, we recommend customising the `username_template` on the role configuration to generate accounts with names less than 20 characters. Please refer to the [username templating document](/vault/docs/concepts/username-templating) for more information. With regard to adding dynamic users to groups, AD doesn't let you directly modify a user's `memberOf` attribute. The `member` attribute of a group and `memberOf` attribute of a user are