Request to add support for Dynamic Base in LDAP Connector

[Ullfig, Roberto Alfredo]

We'd like to request the ability to specify dynamic baseDN values for the LDAP data connector

<DataConnector...
baseDN= (currently fixed value)

To reduce query times of nested groups Microsoft AD has this feature:

"BO (fBASEONLY, 0x00000800): Specifies that the attribute is not to be returned by search operations that are not scoped to a single object. Read operations that would otherwise return an attribute that has this search flag set instead fail with operationsError / ERROR_DS_NON_BASE_SEARCH."

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7c1cdf82-1ecc-4834-827e-d26ff95fb207

This requires a dynamic base. Currently what we do is query attributes elsewhere (perl Net::LDAP supports dynamic base) and store it in a MySQL database which then in turn is queried by the IDP. We want to cut out this middleware and query AD directly. Thanks!


---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220727/f9205b3c/attachment.htm>