{"action":"opened","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/603","repository_url":"https://api.github.com/repos/floragunncom/search-guard","labels_url":"https://api.github.com/repos/floragunncom/search-guard/issues/603/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard/issues/603/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard/issues/603/events","html_url":"https://github.com/floragunncom/search-guard/issues/603","id":388502235,"node_id":"MDU6SXNzdWUzODg1MDIyMzU=","number":603,"title":"feature request: skip_users config option for authc section","user":{"login":"packetrevolt","id":11772104,"node_id":"MDQ6VXNlcjExNzcyMTA0","avatar_url":"https://avatars2.githubusercontent.com/u/11772104?v=4","gravatar_id":"","url":"https://api.github.com/users/packetrevolt","html_url":"https://github.com/packetrevolt","followers_url":"https://api.github.com/users/packetrevolt/followers","following_url":"https://api.github.com/users/packetrevolt/following{/other_user}","gists_url":"https://api.github.com/users/packetrevolt/gists{/gist_id}","starred_url":"https://api.github.com/users/packetrevolt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/packetrevolt/subscriptions","organizations_url":"https://api.github.com/users/packetrevolt/orgs","repos_url":"https://api.github.com/users/packetrevolt/repos","events_url":"https://api.github.com/users/packetrevolt/events{/privacy}","received_events_url":"https://api.github.com/users/packetrevolt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-07T04:33:00Z","updated_at":"2018-12-07T04:33:00Z","closed_at":null,"author_association":"NONE","body":"\r\nThe use case is having multiple LDAP authentication sources that have no access (Active Directory trust relationship) to cross authenticate users from a different LDAP domain.  This means that each LDAP domain will have its own set of LDAP authc and authz sections.  To make life easier with this multiple LDAP configuration the username is specified in the userPrincipalName format.  user1@foo.com and user2@bar.com as two examples.  \r\n\r\nFor authz, having the skip_users option field is amazing since it is very easy to configure a regex for the skip user that catches the domain of the other domain.  This prevents LDAP authorization requests from being issued against LDAP domains that do not contain that user.  This would be similarly very useful on the authc section to prevent LDAP authentication attempts being made against LDAP domains that do not have the ability to authenticate that user.\r\n\r\nConfig snippet below shortened to only show the above concept.  The two authc skip_users options highlighted in yellow\r\n\r\n\r\n\r\nsearchguard:\r\n  dynamic:\r\n    authc:\r\n      foo_ldap:\r\n        order: 2\r\n        authentication_backend:\r\n          type: ldap\r\n          config:\r\n            userbase: 'dc=foo,dc=com'\r\n            usersearch: '(userPrincipalName={0})'\r\n            skip_users:\r\n              - '*bar.com'\r\n      bar_ldap:\r\n        order: 2\r\n        authentication_backend:\r\n          type: ldap\r\n          config:\r\n            userbase: 'dc=bar,dc=com'\r\n            usersearch: '(userPrincipalName={0})'\r\n            skip_users:\r\n              - '*foo.com'\r\n    authz:\r\n      foo_ldap:\r\n        authorization_backend:\r\n          type: ldap\r\n          config:\r\n            userbase: 'dc=foo,dc=com'\r\n            skip_users:\r\n              - '*DC=bar,DC=com*'\r\n      bar_ldap:\r\n        authorization_backend:\r\n          type: ldap\r\n          config:\r\n            userbase: 'dc=bar,dc=com'\r\n            skip_users:\r\n              - '*DC=foo,DC=com*'"}}
{"actor":{"display_login":"packetrevolt"}}