maziggy 29e6d28205 Resolve LDAP groups on lldap and OpenLDAP (#3197) ...

lldap and OpenLDAP's memberof overlay omit memberOf from "*", so every
lldap login fell through to the default group. Request memberOf by name
when the schema defines it, and on non-AD directories also search the
directory root for groupOfNames/groupOfUniqueNames entries listing the
user, since groups often sit outside the user search base and the
overlay tracks only one group class.

Also: skip ldap3's anonymous schema read after StartTLS, which AD and
Samba AD reject, so StartTLS works there; reword a server's StartTLS
refusal with an LDAPS hint; stop the bundle sanitizer masking part of
an OID as an IP; skip the sync right after auto-provisioning so the
default-group warning logs once.

2026-09-30 09:46:54 +02:00

..

routes

Resolve LDAP groups on lldap and OpenLDAP (#3197)

2026-09-30 09:46:54 +02:00

__init__.py

…