ldap-rest 0.23.0 → 0.25.0

package/docs/usage/plugins/ldap/enterprise-rules.md

@@ -3,7 +3,7 @@
 The business rules an enterprise directory needs on top of per-attribute
 validation: uniqueness across a shared namespace, mail addresses confined to
 the domains an organization owns, computed organization paths, normalised
-quotas, and referential-integrity guards on deletion.
+quotas, and referential integrity on deletion.
 
 Every rule is driven by the loaded entity schemas. The plugin contains no
 attribute name, no domain and no nomenclature value, so the same code serves a
@@ -134,24 +134,47 @@ An `accountExpiry` attribute must not carry a date already past. The comparison
 is against the start of the current day, so scheduling something for today is
 allowed.
 
-### Deletion guards
+### Deletion and references
 
 ```json
 {
   "title": { "type": "pointer", "referentialIntegrity": "restrict" },
+  "twakeLocalAdminLink": {
+    "type": "array",
+    "items": { "type": "pointer", "branch": ["ou=users,dc=example,dc=com"] },
+    "referentialIntegrity": "remove"
+  },
   "member": { "type": "array", "role": "members", "deleteGuard": "nonEmpty" }
 }
 ```
 
-- `referentialIntegrity: "restrict"` refuses to delete an entry while another
-  entry still points at it — a position somebody still holds, a nomenclature
-  value still in use. Declared on the **referencing** attribute, and the
-  pointer's `branch` tells the plugin which deletions to check.
-- `deleteGuard: "nonEmpty"` refuses to delete a group that still has members.
-  The placeholder member some directories keep to satisfy `groupOfNames`
-  (`--group-dummy-user`) does not count.
-
-Both default to off: a deployment turns them on where it wants them.
+`referentialIntegrity` is declared on the **referencing** attribute, and the
+pointer's `branch` tells the plugin which deletions concern it:
+
+- `restrict` refuses to delete an entry while another entry still points at
+  it — a position somebody still holds, a nomenclature value still in use.
+- `remove` takes the deleted entry's DN out of the attribute once the
+  deletion has landed: an account leaves the organizations it administered,
+  the mailboxes delegated to it, the groups it owned. It also applies to an
+  attribute carrying the `owners` role, which is not a pointer. A move into
+  the trash (`--trash-base`, see [trash](trash.md)) counts as a deletion,
+  [what a restore brings back](trash.md#limitations).
+  This runs with the server's rights, whoever deleted the entry, since a
+  link left behind would hand its rights to the next entry created with the
+  same DN; the writes are attributed to the deletion's author. Use it on
+  optional attributes only. Each deletion searches every attribute marked
+  `remove`: give them an equality index.
+- `ignore`, the default, leaves the reference dangling.
+
+`deleteGuard: "nonEmpty"` refuses to delete a group that still has members.
+The placeholder member some directories keep to satisfy `groupOfNames`
+(`--group-dummy-user`) does not count.
+
+Both default to off: a deployment turns them on where it wants them. The
+shipped Twake schemas mark `remove` on the links to accounts: the managers
+and local administrators of an organization, the delegates of a mailbox,
+the owners of a group or a shared mailbox, the owner and manager of a
+device. Members leave their groups through the groups plugin.
 
 ## Errors
 
@@ -160,6 +183,13 @@ Both default to off: a deployment turns them on where it wants them.
 | `400`  | A size that is not a size, a date already past                                |
 | `409`  | A duplicate value, a mail domain outside the authorised set, a guarded delete |
 
+A duplicate value answers `code: "unique"` with the `attribute` and the
+`value` refused, and a mail domain outside the authorised set answers
+`code: "mailDomain"` with them and the authorised `domains`, each listed once:
+a client explains them in its own words, under the field at fault. The
+holder of a duplicate value is never named.
+See [the error format](../../../client-development/api/rest-api.md#error-response-format).
+
 ## See also
 
 - [flat-generic](flat-generic.md) — the schema format these markers extend

package/docs/usage/plugins/ldap/password-policy.md

@@ -342,7 +342,12 @@ curl -X PATCH "http://localhost:8081/api/v1/password-policies/default" \
   `pwdUseCheckModule`, gives the entry the `pwdPolicyChecker` class. Both
   need OpenLDAP 2.6; an older directory refuses them with a `400`.
 - An attribute the directory's schema does not know is refused with a `400`
-  naming it.
+  naming it. The list answers, next to `policies`, the `attributes` a policy
+  can be given: those of the above that the directory's schema defines.
+  OpenLDAP 2.4 lacks `pwdMaxLength`, `pwdMaxIdle`, `pwdMinDelay` and
+  `pwdMaxDelay`. The schema is read once per `--ldap-raw-schema-cache-ttl`:
+  after an upgrade of the directory, the list follows within that delay, or
+  at the next restart.
 
 **Creating a policy:** `POST` takes `cn` and the attributes to set. The entry
 is created under `--ppolicy-base` as a `person` holding `pwdPolicy`, as in
@@ -357,6 +362,13 @@ every administrator reads there: name `--ppolicy-base` in
 directory read and change the policies
 ([global branches](../auth/authz-linid1.md#global-branches)).
 
+`GET /authz/scope` answers `passwordPolicies: true` to a caller who may list
+the policies, and `false` to the others, so that a client offers them
+without asking for them and being refused. It is the judgement the
+authorization plugin describing the scope makes of a search of
+`--ppolicy-base`, which is the search the listing makes; the field is
+absent when this plugin is not loaded.
+
 **Deleting a policy** is refused (`409`) while it is the default one or an
 entry's `pwdPolicySubentry` names it. The default one is only known through
 `--ppolicy-default-dn` when there are several: without it, nothing stops

package/docs/usage/plugins/ldap/trash.md

@@ -200,6 +200,15 @@ This plugin uses the `ldapdeleterequest` hook to intercept delete operations bef
 - Entries with the same RDN will overwrite previous trash entries
 - Tree structures (entries with children) must be deleted leaf-first
 - Does not track history (only keeps the latest deleted version)
+- An entry moved to the trash leaves the links declared
+  `referentialIntegrity: "remove"`
+  ([details](enterprise-rules.md#deletion-and-references)) and, with
+  `core/ldap/groups`, its groups. A restore does not bring those links back:
+  a restored account has to be made a manager, an administrator or a
+  delegate again. Attributes the directory's `refint` overlay follows
+  (`member`, `owner`, `manager` in its stock configuration) are the
+  exception: `refint` may move the value to the trashed DN before it is
+  removed, and a restore then brings it back.
 
 ## Troubleshooting
 

package/docs/usage/upgrading.md

@@ -4,6 +4,43 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.24.0
+
+### Links to deleted accounts
+
+**Who is affected:** a deployment using the Twake schemas, or any schema
+whose links to accounts now carry `referentialIntegrity: "remove"`
+([details](plugins/ldap/enterprise-rules.md#deletion-and-references)).
+
+Accounts deleted from now on leave the links naming them. Those deleted
+before still appear as managers, local administrators, delegates or owners,
+and an account created again at the same address gets their rights. List
+the dangling ones and remove them:
+
+```sh
+# Connection to the directory, as for any ldapsearch
+OPTS="-H ldap://localhost -D cn=admin,dc=example,dc=com -w secret"
+BASE="dc=example,dc=com"
+for attr in twakeLocalAdminLink twakeManagerLink twakeDelegatedUsers \
+  owner manager; do
+  ldapsearch $OPTS -LLL -o ldif-wrap=no -b "$BASE" "($attr=*)" "$attr" |
+    sed -n -e 's/^dn: //p' -e "s/^$attr: />/p" |
+    while IFS= read -r line; do
+      case "$line" in
+        ">"*) target="${line#>}"
+          ldapsearch $OPTS -LLL -s base -b "$target" dn >/dev/null 2>&1 ||
+            echo "$dn: $attr $target" ;;
+        *) dn="$line" ;;
+      esac
+    done
+done
+```
+
+Then, for each line, delete that value
+(`ldapmodify`, `delete: <attribute>` with the DN shown). `owner` and
+`manager` may also be listed for entries no schema marks `remove`, an
+account's `manager` say: check before deleting those.
+
 ## To 0.22.0
 
 ### James follows the mail domains

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"

package/static/schemas/example/groups.json

@@ -74,7 +74,8 @@
         "hint": "Expected the DN of an entry of this directory"
       },
       "required": false,
-      "role": "owners"
+      "role": "owners",
+      "referentialIntegrity": "remove"
     },
     "twakeDepartmentLink": {
       "type": "pointer",

package/static/schemas/example/organizations.json

@@ -79,6 +79,7 @@
         "branch": ["ou=users,__LDAP_BASE__"]
       },
       "required": false,
+      "referentialIntegrity": "remove",
       "role": "managers",
       "label": "Managers"
     },
@@ -99,6 +100,7 @@
         "branch": ["ou=users,__LDAP_BASE__"]
       },
       "required": false,
+      "referentialIntegrity": "remove",
       "role": "localAdmins",
       "label": "Local administrators"
     }

package/static/schemas/standard/devices.json

@@ -57,7 +57,8 @@
     "owner": {
       "type": "pointer",
       "branch": ["ou=users,__LDAP_BASE__"],
-      "required": false
+      "required": false,
+      "referentialIntegrity": "remove"
     },
     "ou": {
       "type": "string",
@@ -66,7 +67,8 @@
     "manager": {
       "type": "pointer",
       "branch": ["ou=users,__LDAP_BASE__"],
-      "required": false
+      "required": false,
+      "referentialIntegrity": "remove"
     }
   }
 }

package/static/schemas/twake/groups.json

@@ -147,7 +147,8 @@
         "en": "Owners",
         "fr": "Propriétaires",
         "mn": "Эзэмшигчид"
-      }
+      },
+      "referentialIntegrity": "remove"
     },
     "twakeDepartmentLink": {
       "type": "pointer",

package/static/schemas/twake/organizations.json

@@ -109,6 +109,7 @@
         "branch": ["ou=users,__LDAP_BASE__"]
       },
       "required": false,
+      "referentialIntegrity": "remove",
       "role": "managers",
       "label": {
         "en": "Managers",
@@ -137,6 +138,7 @@
         "branch": ["ou=users,__LDAP_BASE__"]
       },
       "required": false,
+      "referentialIntegrity": "remove",
       "role": "localAdmins",
       "label": {
         "en": "Local administrators",

package/static/schemas/twake/teamMailboxes.json

@@ -127,7 +127,8 @@
         "en": "Owners",
         "fr": "Propriétaires",
         "mn": "Эзэмшигчид"
-      }
+      },
+      "referentialIntegrity": "remove"
     },
     "twakeDepartmentLink": {
       "type": "pointer",

package/static/schemas/twake/users.json

@@ -384,6 +384,7 @@
         "branch": ["ou=users,__LDAP_BASE__"]
       },
       "required": false,
+      "referentialIntegrity": "remove",
       "group": {
         "en": "Mailbox Settings",
         "fr": "Paramètres de messagerie",