ldap authentication filter

[bsiara]

Is your feature request related to a problem? Please describe.

Hi,
I try to integrate rabbitmq authentication with my openldap server and I do not see option to filter users. This is my configuration:

auth_backends.1 = internal
auth_backends.2.authn = ldap
auth_backends.2.authz = internal 
auth_ldap.servers.1 = ldap.server.com
auth_ldap.port = 636
auth_ldap.timeout = 5000
auth_ldap.user_dn_pattern = uid=${username},ou=people,dc=server,dc=com
auth_ldap.connection_pool_size = 64
auth_ldap.idle_timeout = 300000
auth_ldap.log = network
auth_ldap.use_ssl = true
auth_ldap.ssl_options.cacertfile = /etc/rabbitmq/certs/ldap_ca.crt
auth_ldap.ssl_options.verify = verify_none
auth_ldap.ssl_options.fail_if_no_peer_cert = true

Can someone tell me how I can filter users? In auth_ldap.dn_lookup* options I also did not see filters.
Thanks

Describe the solution you'd like

Add user_dn_pattern_filter and dn_lookup_filter.

Describe alternatives you've considered

No response

Additional context

No response

[michaelklishin]

I'm afraid this is a very brief description to be an actionable issue. Consider describing what you are looking for and why in more detail.

LDAP support has been around for a good decade and somehow the current set of configurable queries has been enough for its numerous users (some use it at really non-trivial scale).

[bsiara]

Hi, thanks for your response. In my configuration I want to filter users which will be authenticated using ldap. For example I have user uid=user1,ou=people,dc=server,dc=com which belongs to class objectClass: inetOrgPerson and in configuration I want to filter users who belongs to this class. In ldap uri notation should looks like this:
ldap://ldap.server.com:389/ou=groups,dc=server,dc=com??sub?(objectClass=inetOrgPerson)
Tell me where in my configuration I can set filter: (objectClass=inetOrgPerson)?

[lukebakken]

This is not supported as far as I know. I am not an LDAP expert, but I can't see why this filter is necessary. What are you trying to accomplish?

[bsiara]

I'm try to limit user who can login to rabbitmq.

[lukebakken]

You will have to group users accordingly.