Ldap Group Provider #17518

eformat · 2023-05-16T10:18:58Z

Reopening work previously closed - this PR supersedes #8335 #10116

Adds

ldap group provider

Please advise on what you think needs finishing off. I have tested this against a local FreeIPA ldap setup OK and have joined your trino slack dev channel as well. cheers.

cla-bot · 2023-05-16T10:19:00Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

Praveen2112

Thanks for working on this. It would be nice if we could have a PTs for this.

...o-password-authenticators/src/main/java/io/trino/plugin/password/ldap/LdapGroupProvider.java

...word-authenticators/src/main/java/io/trino/plugin/password/ldap/LdapGroupProviderConfig.java

plugin/trino-password-authenticators/src/test/java/io/trino/plugin/password/ldap/LdapUtil.java

.../trino-password-authenticators/src/test/java/io/trino/plugin/password/ldap/TestLdapUtil.java

eformat · 2023-05-16T22:14:19Z

PTs

ah yup .. Product Tests .. also i will write some Doco ;) for this .. WIP.

cla-bot · 2023-05-16T22:29:50Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-16T22:52:32Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-17T00:26:23Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-17T05:39:18Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-17T05:43:40Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-05-17T06:56:02Z

BTW i have filled in the CLA and emailed it back am ignoring the bot ;)

cla-bot · 2023-05-17T23:47:53Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-05-17T23:59:33Z

hi @Praveen2112 PTAL, i have added in support for these three common ldap schema use cases now.
this of course needs proper documentation. the test container in the code uses the scheme in (3), will need to find some schemas that can mimic (2),(3) for real life testing (unit tests cover the config though).

(1) RFC2307 (posix)

  dn: ou=users,dc=example,dc=com
  objectClass: organizationalUnit
  ou: users

  dn: cn=Jane,ou=users,dc=example,dc=com
  objectClass: person
  objectClass: organizationalPerson
  objectClass: inetOrgPerson
  cn: Jane
  sn: Smith
  displayName: Jane Smith
  mail: jane.smith@example.com

  dn: cn=Jim,ou=users,dc=example,dc=com
  objectClass: person
  objectClass: organizationalPerson
  objectClass: inetOrgPerson
  cn: Jim
  sn: Adams
  displayName: Jim Adams
  mail: jim.adams@example.com

  dn: ou=groups,dc=example,dc=com
  objectClass: organizationalUnit
  ou: groups

  dn: cn=admins,ou=groups,dc=example,dc=com 
  objectClass: groupOfNames
  cn: admins
  owner: cn=admin,dc=example,dc=com
  description: System Administrators
  member: cn=Jane,ou=users,dc=example,dc=com 
  member: cn=Jim,ou=users,dc=example,dc=com

The group is a first-class entry in the LDAP server (e.g. "cn=admins,ou=groups,dc=example,dc=com")
Members of a group are listed with an identifying reference as attributes on the group (e.g. "member")

(2) Active Directory

dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users

dn: cn=Jane,ou=users,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: testPerson
cn: Jane
sn: Smith
displayName: Jane Smith
mail: jane.smith@example.com
memberOf: admins 

dn: cn=Jim,ou=users,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: testPerson
cn: Jim
sn: Adams
displayName: Jim Adams
mail: jim.adams@example.com
memberOf: admins

The user’s group memberships are listed as attributes on the user, and the group does not exist as an entry on the server. e.g "memberOf"

(3) RFC2307bis (FreeIPA), Augmented Active Directory

dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users

dn: cn=Jane,ou=users,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: testPerson
cn: Jane
sn: Smith
displayName: Jane Smith
mail: jane.smith@example.com
memberOf: cn=admins,ou=groups,dc=example,dc=com 

dn: cn=Jim,ou=users,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: testPerson
cn: Jim
sn: Adams
displayName: Jim Adams
mail: jim.adams@example.com
memberOf: cn=admins,ou=groups,dc=example,dc=com

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups

dn: cn=admins,ou=groups,dc=example,dc=com 
objectClass: groupOfNames
cn: admins
owner: cn=admin,dc=example,dc=com
description: System Administrators
member: cn=Jane,ou=users,dc=example,dc=com
member: cn=Jim,ou=users,dc=example,dc=com

The user’s group memberships are listed as attributes on the user. e.g. "memberOf: cn=admins,ou=groups,dc=example,dc=com"

The group is a first-class entry on the LDAP server. e.g. "dn: cn=admins,ou=groups,dc=example,dc=com"

cla-bot · 2023-05-18T00:03:14Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-18T00:03:39Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-18T00:10:57Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-18T11:30:45Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-18T23:05:28Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-19T23:09:51Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-05-19T23:11:14Z

Commit 0d0c56a

Added testing support for active directory schema based testing.
Added testing support for multii-value attributes e.g memberOf

Tests will need this test image PR to merge - trinodb/docker-images#166

cla-bot · 2023-05-20T22:38:06Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-21T00:41:24Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-23T02:54:15Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-05-23T02:55:34Z

Documentation for LDAP Group provider now added in this commit.

eformat · 2023-05-23T04:26:59Z

CLA - i signed this and returned it on 16/5/23 cheers.

cla-bot · 2023-05-23T05:34:47Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2023-05-23T06:17:38Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-07-13T23:28:29Z

Can you rebase the PR. It looks like there were a few conflicts to be resolved

Done.

zach-overflow · 2023-07-27T21:41:25Z

Hi there! This is a very exciting PR (thank you so much for working on it @eformat ). Is there anything I could help here with? We would find this particular group provider extremely helpful for our own needs. I've not yet gone through the contributor agreements, but am happy to try to help if I'm able to get approved.

Praveen2112 · 2023-11-01T06:54:04Z

@eformat Any updates on this PR ?

eformat · 2023-11-02T06:48:10Z

@eformat Any updates on this PR ?

hi, no. it is complete from a while back ? just waiting to be merged really.

Praveen2112 · 2023-11-02T07:00:29Z

Some of the review comments were not yet addressed. Can we address them and rebase the PR ?

eformat · 2023-11-02T07:04:32Z

which comments please ? also it has been a long time .. so i dont have a lot of bandwidth on this at the moment so if you do intend on merging it , please let me know as i do not have bandwidth to continually rebase this over several months

…

On Thu, 2 Nov 2023 at 17:00, Praveen Krishna ***@***.***> wrote: Some of the review comments were not yet addressed. Can we address them and rebase the PR ? — Reply to this email directly, view it on GitHub <#17518 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFN7IH25ZRPLMTRFUVW2WTYCNAJPAVCNFSM6AAAAAAYDNP4L6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOJQGE3TMMRZGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Praveen2112 · 2023-11-02T07:19:20Z

Like this one - #17518 (comment), In this case can other members (or myself) work on top of your PR for applying the comments and rebasing, I will make sure you will be added as a co-author in the new PR.

eformat · 2023-11-02T07:28:18Z

Like this one - #17518 (comment), In this case can other members (or myself) work on top of your PR for applying the comments and rebasing, I will make sure you will be added as a co-author in the new PR.

this is endless. i did not see these on june 12 - sorry. sure - feel free to work on top of the existing code.

github-actions · 2024-01-15T17:03:54Z

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

mosabua · 2024-01-15T19:30:24Z

@Praveen2112 could you work with @eformat and continue this PR?

Also cc @dain @ksobolew

github-actions · 2024-02-07T17:03:01Z

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

github-actions · 2024-02-29T17:03:55Z

Closing this pull request, as it has been stale for six weeks. Feel free to re-open at any time.

eformat · 2024-03-01T06:40:56Z

FYI .. i am still keen to get this merged .. looks like its going to take a bit more effort .. i may have some bandwidth coming up to get that last mile in on this PR ....

ksobolew · 2024-03-01T08:09:09Z

BTW, there's a competing PR with similar functionality: #20157

eformat · 2024-03-01T21:19:30Z

thats fine - @Praveen2112 as discussed - is that a clone of this PR ? if so i will close this and you can attribute as appropriate

ksobolew · 2024-03-04T08:12:24Z

is that a clone of this PR ?

No, it is an independent effort

eformat mentioned this pull request May 16, 2023

LDAP trino group provider opendatahub-io-contrib/data-mesh-pattern#47

Open

Praveen2112 reviewed May 16, 2023

View reviewed changes

eformat changed the title ~~ldap group provider initial commit~~ Ldap Group Provider May 16, 2023

eformat mentioned this pull request May 19, 2023

Add ldap testing image with active directory schema trinodb/docker-images#166

Merged

github-actions bot added the docs label May 23, 2023

eformat marked this pull request as ready for review May 23, 2023 02:56

github-actions bot added bigquery BigQuery connector mongodb MongoDB connector labels Jul 13, 2023

eformat force-pushed the ldap-group-provider-2 branch from 161e5e2 to d145448 Compare July 13, 2023 22:21

eformat added 2 commits July 14, 2023 09:10

ldap group provider initial commit

94b179d

docker test images updated to use version 82

e4dc470

eformat force-pushed the ldap-group-provider-2 branch from 81540be to e4dc470 Compare July 13, 2023 23:11

This comment was marked as off-topic.

Sign in to view

github-actions bot added the stale label Jan 15, 2024

github-actions bot removed the stale label Jan 16, 2024

github-actions bot added the stale label Feb 7, 2024

github-actions bot closed this Feb 29, 2024

eformat reopened this Mar 1, 2024

eformat closed this Mar 4, 2024

Ldap Group Provider #17518

Ldap Group Provider #17518

Conversation

eformat commented May 16, 2023

cla-bot bot commented May 16, 2023

Praveen2112 left a comment

Choose a reason for hiding this comment

eformat commented May 16, 2023

cla-bot bot commented May 16, 2023

cla-bot bot commented May 16, 2023

cla-bot bot commented May 17, 2023

cla-bot bot commented May 17, 2023

cla-bot bot commented May 17, 2023

eformat commented May 17, 2023

cla-bot bot commented May 17, 2023

eformat commented May 17, 2023 • edited Loading

cla-bot bot commented May 18, 2023

cla-bot bot commented May 18, 2023

cla-bot bot commented May 18, 2023

cla-bot bot commented May 18, 2023

cla-bot bot commented May 18, 2023

cla-bot bot commented May 19, 2023

eformat commented May 19, 2023 • edited Loading

cla-bot bot commented May 20, 2023

cla-bot bot commented May 21, 2023

cla-bot bot commented May 23, 2023

eformat commented May 23, 2023

eformat commented May 23, 2023

cla-bot bot commented May 23, 2023

cla-bot bot commented May 23, 2023

eformat commented Jul 13, 2023

zach-overflow commented Jul 27, 2023

This comment was marked as off-topic.

This comment was marked as off-topic.

Praveen2112 commented Nov 1, 2023

eformat commented Nov 2, 2023

Praveen2112 commented Nov 2, 2023

eformat commented Nov 2, 2023 via email

Praveen2112 commented Nov 2, 2023

eformat commented Nov 2, 2023

github-actions bot commented Jan 15, 2024

mosabua commented Jan 15, 2024 • edited Loading

github-actions bot commented Feb 7, 2024

github-actions bot commented Feb 29, 2024

eformat commented Mar 1, 2024

ksobolew commented Mar 1, 2024

eformat commented Mar 1, 2024

ksobolew commented Mar 4, 2024

eformat commented May 17, 2023 •

edited

Loading

eformat commented May 19, 2023 •

edited

Loading

mosabua commented Jan 15, 2024 •

edited

Loading