Add opt-in recursive LDAP group resolution #75

Merged

qwc merged 1 commit from feature/ldap-recursive-groups into main

2026-02-17 10:47:30 +01:00

qwc commented

2026-02-17 10:45:08 +01:00

Owner

Summary

Adds recursive_groups and group_prefix config options to LDAP authentication
When enabled, walks up each group's memberOf chain to build the full transitive set of memberships before role/access matching
group_prefix filters recursion by CN prefix (e.g., "team-" only recurses into cn=team-a,... but not cn=editors,...), keeping unrelated groups out of the traversal
Group expansion runs while bound as the service account, before the user bind
Capped at 50 LDAP lookups to prevent runaway traversals

Test plan

Unit tests: linear chain, cycles, 50-iteration cap, CN prefix filtering, groupCN helper
Integration test: user in team-a → team-a member of editors → user gets editor role
Full test suite passes
Manual test with real LDAP directory using nested groups

🤖 Generated with Claude Code

## Summary - Adds `recursive_groups` and `group_prefix` config options to LDAP authentication - When enabled, walks up each group's `memberOf` chain to build the full transitive set of memberships before role/access matching - `group_prefix` filters recursion by CN prefix (e.g., `"team-"` only recurses into `cn=team-a,...` but not `cn=editors,...`), keeping unrelated groups out of the traversal - Group expansion runs while bound as the service account, before the user bind - Capped at 50 LDAP lookups to prevent runaway traversals ## Test plan - [x] Unit tests: linear chain, cycles, 50-iteration cap, CN prefix filtering, `groupCN` helper - [x] Integration test: user in `team-a` → `team-a` member of `editors` → user gets editor role - [x] Full test suite passes - [ ] Manual test with real LDAP directory using nested groups 🤖 Generated with [Claude Code](https://claude.com/claude-code)

qwc added 1 commit

2026-02-17 10:45:08 +01:00

Add opt-in recursive LDAP group resolution

CI / test (pull_request) Successful in 58s

Details

CI / build (pull_request) Successful in 42s

Details

CI / docker (pull_request) Has been skipped

Details

d0de8de8c2

Walk up each group's memberOf chain to resolve nested group memberships,
enabling role assignment via transitive groups (e.g., user in team-a,
team-a member of editors → user gets editor role). Controlled by
recursive_groups and group_prefix config options.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>