janiussyafiq opened a new pull request, #13782: URL: https://github.com/apache/apisix/pull/13782
### Description Group-based authorization for the `ldap-auth-advanced` plugin: - collect the authenticated user's groups, either by group search under `group_base_dn` or from the user entry's `memberOf` attribute (no extra round trip) - `groups_required` (outer array ORs, inner array ANDs) is enforced after authentication; a denied user gets a 403, distinct from the 401 paths - identity is exported to the upstream via `X-Authenticated-Username`, `X-Authenticated-User-Dn`, and `X-Authenticated-Groups`, each behind a `set_*_header` toggle (same idiom as `openid-connect`) This PR also removes the plugin's Consumer support: - with groups in play, mapping an authenticated user to a Consumer is unstable: a user who belongs to several groups cannot deterministically resolve to one Consumer - external-directory authentication does not need Consumers, matching the existing external auth plugins (`openid-connect`, `forward-auth`, `authz-keycloak`) which attach none -- the directory is the identity store; users who want Consumer-backed LDAP keep `ldap-auth` - attaching `ldap-auth-advanced` to a Consumer or Credential now fails with a clear error pointing at `ldap-auth` The plugin is not part of any released version, so this is not a breaking change. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
