...
moveUser API:
Jira | ||||||||
---|---|---|---|---|---|---|---|---|
|
What branch is this work being done in
Introduction
Tthe The current LDAP plugin implementation ties the full CloudStack infrastructure to a LDAP (OU) and creates an CloudStack account for every UID found. A user might want to have a customer create it's own ldap tree and/or add users to a shared account. Thus a user (i.e. domain admin) would be able to organise access to CloudStack using the OU/UID in their ldap.
In this feature multi tenancy is created and account to LDAP group binding. as a result each domain can have their own LDAP implementation and can define accounts for certain purposes, managing those accounts in their LDAP server.
The purpose of the document to specify the functionality of the domain level binding to an LDAP tree, allowing per customer administration.
...
S8 An admin moved a user into two distinct groups mapped to two different accounts in the same domain. The user will be refused logging in as in scenario S4. No move will be done. An error stating the situation and deferring to the LDAP admin will be returned. The user will not be removed but marked disabled, so a move can still be done after the issue is resolved.
The linking of LDAP groups It will be possible to add an ldap configuration for a specific domain. the domain id field will be optional to maintain backwards compatibility. Specific accounts can be linked to LDAP groups. This will be done on account-properties.by an account level property that has no global default value. (ldap.mapped.group)
The configuration mechanism will be extended to include domain level configuration items for LDAP. The basedn and bind attributes would be domain level attributes. For the use-cases described this is not strictly necessary but for users providing public offerings or large enterprise installations, this will improve the usability of the feature. The extra work involved will be not just adding the needed settings but also the enabling of settings on a domain level, which does not exist at the moment of writing.
...
A moveUser API will be added in favour of extending updateUser API for security, as users have access to updateUser API.
put the relevant use case/stories to explain how the feature is going to be used/work
...
prior ldap work has been done in these FSs.
This specification is about tying an ldap per domain (multi tenant) and an account per ldap group including auto moving and deleting of accounts as they are moved or deleted in ldap.
...
list changes to existing web services APIs and new APIs introduced with signatures and throughout documentation
...