April 19, 2021 at 3:17 am #28532[email protected]Participant
I am trying to work out how to create alias entries within FRDS.
Here is my use case. I have a user who has multiple Roles within an organisation with each role being given different roles. i.e John uid=john
– in his Case Manager Role has the roles A and B
– in his Reviewer Role has the roles B ad C
I thought I could create an 2 Alias entries uid=john_casemanager and uid=john_reviewer and then add the appropriate uniquemember attributes to groups A, B and C. This way in FRAM I could create an Authentication Tree that would first look for uid=john and authenticate them, then get an roleAliases attribute that would contain Case Manager and Reviewer to allow the user to select the correct Role they need today. Then I could lookup and set the FRAM Profile to use the alias requested and that entry would have all the attributes of uid=john, whilst being uid=john_casemanager to find the correct roles (frds groups).
However it looks like the alias objectclass is not de-referencing the requested entry when an alias request is being made and reading the document it looks like it is not supported.
Has anybody found a way to make this work?
I could try and make FRIM create multiple entries and try and keep the profiles in sync, but that feels like a messy solution. Trying to keep multiple groups in sync with FRIM also feels messy, so the alias approach seemed to be the way to go.
Nicholas IrvingApril 26, 2021 at 10:39 am #28543LudoModerator
OpenDJ, like OpenDS, does support defining aliases, but doesn’t support alias dereferencing. It has always been mentioned in the known limitations.
Alias dereferencing seems like a nice feature, but adds a lot of complexity to the server’s query processing, especially around index processing and access controls. As it’s very rarely used, we’ve chosen not to clutter the server with it.
You must be logged in to reply to this topic.