utility of ldap patches to add

[Justin T Pryzby]

On Sun, Dec 16, 2012 at 01:29:14AM +0100, Tomasz Sterna wrote:
> Dnia 2012-12-15, sob o godzinie 15:46 -0700, Justin T Pryzby pisze:
> > Grammer, spelling and other fixes for clarity.  I'm using some but not
> Merged in 
> https://github.com/jabberd2/jabberd2/commit/4d29daee534d24cd33391c79cd607e32fda1a31a

Thanks (and thanks for noticing to patch the .in file :)

Can someone tell me if it's appropriate to patch storage_ldapvcard.c
to either: 1) make publishedattr optional; OR, 2) remove publishattr
entirely; OR (probably), 3) allow a custom <query>, as in authreg_ldap
module (but not ldapfull), which overrides both publishedattr and
validattr.

Currently, validattr and publishedattr are only used together.  If
validattr is unspecified, it is unused; if publishedAttr is
unspecified, it defaults to jabberPublishedItem.

    if( data->srvtype == LDAPVCARD_SRVTYPE_AD ) {
        if( data->validattr ) {
            snprintf(validfilter, 256, "(%s=TRUE)(%s=TRUE)", 
data->publishedattr, data->validattr);
        } else {
            snprintf(validfilter, 256, "(%s=TRUE)", data->publishedattr);
        }
    } else {
        if( data->validattr ) {
            snprintf(validfilter, 256, "(&(%s=*)(!(%s=0)))(%s=1)", 
data->publishedattr, data->publishedattr, data->validattr);
        } else {
            snprintf(validfilter, 256, "(&(%s=*)(!(%s=0)))", 
data->publishedattr, data->publishedattr);
        }
    }

Perhaps separate attributes will be useful in the future, if ldapvcard
handles driver types in addition to vcard, published-roster and
published-roster-groups.

Currently, using active directory, I use ldapvcard:

      <type>ldap</type>
      <publishedattr>sAMAccountName</publishedattr>

Then, validfilter="(&(sAMAccountName=*)(!(sAMAccountName=0)))",
(which is then combined with another sAMAccountName=*)...

That is a hack to get it working without (additionally) patching the
source, but (counter-intuitively) requires type=ldap instead of
type=ad.  Ideally, it would be possible to specify the (crazy) AD test
for "active" accounts:

        (!(userAccountControl:1.2.840.113556.1.4.803:=2))

Or test for group membership, as I do in c2s authreg_ldap using:
      
<query>(&amp;(sAMAccountName=%u)(objectClass=User)(memberof=CN=jabberusers,ou=trm,dc=ms,dc=norchemlab,dc=com))</query>

2nd question: is it reasonable to patch authreg_ldapfull to accept a
<query> parameter?  The current implementation doesn't allow testing
for group membership.  I think that's the only reason we can't
currently use ldapfull.  (Although I don't care which is used, it
would be nice if both ldap modules worked for what I think is a common
scenario, unless one is not intended to work for that, and documented
as such).

Justin