ldap-rest 0.25.1 → 1.0.0

package/dist/src/plugins/ldap/bulkImport.d.ts

@@ -25,11 +25,11 @@ import type { DM } from '../../bin';
  *       example: 42
  *     created:
  *       type: integer
- *       description: Entries successfully created (or counted in dry-run).
+ *       description: Entries successfully created (or that would be, in a dry run).
  *       example: 38
  *     updated:
  *       type: integer
- *       description: Existing entries updated.
+ *       description: Existing entries updated (or that would be, in a dry run).
  *       example: 2
  *     skipped:
  *       type: integer
@@ -58,7 +58,8 @@ import type { DM } from '../../bin';
  *             type: string
  *             description: |
  *               `unique` or `mailDomain`, with `attribute`, `value` and
- *               `domains`, as in the `Error` answer of a single write.
+ *               `domains`, as in the `Error` answer of a single write;
+ *               `forbidden` when the caller may not write the row.
  *           attribute: { type: string }
  *           value: { type: string }
  *           domains:
@@ -97,9 +98,33 @@ export default class LdapBulkImport extends DmPlugin {
      */
     private bulkImport;
     /**
-     * Process a single CSV record
+     * Whether the caller may write a row: create its entry, or change the one
+     * it names. Which of the two the row turns into is known only once the
+     * directory has been read, so the caller is judged first on both.
+     *
+     * The creation alone is not enough: judged by attachment, an entry is
+     * judged on the organization the row links it to, or on its parent when
+     * the row links it to none, while a change is judged on the organization
+     * it is attached to. An administrator updating their own accounts from a
+     * file naming no organization would be refused.
+     *
+     * No oracle: the change is judged on the entry as stored, and an entry
+     * that is not there is judged on its parent, as a creation without a link
+     * is.
+     *
+     * @throws the refusal of the creation when neither is allowed
      */
-    private processRecord;
+    private authorizeRow;
+    /**
+     * Build the entry of a CSV record, reading nothing from the directory: the
+     * write it makes is judged on it before anything is looked for.
+     */
+    private buildRecord;
+    /**
+     * Complete a record once its write has been judged: the organization path,
+     * read from the organization, then the required attributes.
+     */
+    private completeRecord;
     /**
      * Get editable attributes from schema (exclude fixed and calculated)
      */

package/dist/src/plugins/ldap/enterpriseRules.d.ts

@@ -214,11 +214,19 @@ export default class LdapEnterpriseRules extends DmPlugin {
      * compared by content, and the entry being updated is excluded from the
      * search — so re-sending an unchanged name no longer conflicts with itself.
      *
+     * Nor with its copies: a value the entry already holds, as stored, is not
+     * looked for again, or the copies other plugins keep of the entry — the
+     * applicative accounts of `appAccountsConsistency` carry its mail — would
+     * hold it against it. Held under another attribute, it is skipped only
+     * when that attribute's own constraint looked for it wherever this one
+     * looks: a value accepted under a narrower one is checked here.
+     *
      * @param entity entity the entry belongs to
      * @param name attribute being checked
      * @param attr its schema definition
      * @param values values submitted for it
-     * @param selfDn DN to exclude, on a modification
+     * @param dn entry being written
+     * @param current entry as stored, on a modification; its DN is excluded
      * @throws ConflictError naming the entry that already holds the value
      */
     private checkUnique;
@@ -341,6 +349,8 @@ export default class LdapEnterpriseRules extends DmPlugin {
      * @param dn DN to look for
      * @returns the matching entries, carrying that attribute
      */
+    /** The bases found missing, said once each */
+    private readonly missingBases;
     private searchReferrers;
     /**
      * Every reference the directory holds to a DN.

package/dist/src/plugins/ldap/externalUsersInGroups.d.ts

@@ -9,6 +9,12 @@ import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
 import { Hooks } from '../../hooks';
 import ldapActions from '../../lib/ldapActions';
+/**
+ * The domain of an address, as the managed domains are compared: after its
+ * last `@` (the local part may hold one, quoted), lower-cased, without the
+ * trailing dot DNS allows. Empty for an address without one.
+ */
+export declare const mailDomainOf: (mail: string) => string;
 export default class ExternalUsersInGroups extends DmPlugin {
     name: string;
     roles: Role[];
@@ -23,10 +29,21 @@ export default class ExternalUsersInGroups extends DmPlugin {
      * right under the branch. Null for any other member.
      */
     externalAddress(member: string): string | null;
-    /** `--mail-domain`, lower-cased: the domains no external member may use */
-    managedDomains(): string[];
+    /**
+     * The domains no external member may use, lower-cased: those of
+     * `--mail-domain` and those the directory declares in its domain branches,
+     * the ones `core/twake/james` follows. A deployment declaring its domains
+     * in the directory only would otherwise take an address of its own for an
+     * external one, and so would a client reading the list from `/config`.
+     *
+     * A subdomain of a managed domain is not managed: it is external unless
+     * declared itself.
+     */
+    managedDomains(): Promise<string[]>;
+    /** `--mail-domain`, lower-cased */
+    private configuredDomains;
     /**
      * Where a client sends an external member: `mail=<escaped address>,<branch>`
      */
-    getConfigApiData(): Record<string, unknown>;
+    getConfigApiData(): Promise<Record<string, unknown>>;
 }

package/dist/src/plugins/ldap/groups.d.ts

@@ -164,6 +164,17 @@ export default class LdapGroups extends DmPlugin {
      * LDAP group methods
      */
     addGroup(cn: string, members?: string[], additional?: AttributesList, req?: Request): Promise<boolean>;
+    /**
+     * The entry `addGroup` writes, as the plugin's own hooks receive it. Built
+     * in one place, so that a creation judged before it is made — here, or by
+     * a plugin checking something first — is the creation made.
+     *
+     * @param cn the group's cn
+     * @param members member DNs
+     * @param additional attributes sent
+     * @returns the entry
+     */
+    candidateGroup(cn: string, members: string[], additional: AttributesList): AttributesList;
     modifyGroup(cn: string, changes: {
         add?: AttributesList;
         replace?: AttributesList;
@@ -239,7 +250,43 @@ export default class LdapGroups extends DmPlugin {
      * @returns LdapList (means Record<string, AttributesList> where key is the --ldap-user-main-attribute value [default: cn])
      */
     searchGroupsByName(cn: string, partial?: boolean, attributes?: string[], req?: Request): Promise<LdapList>;
-    protected fixDn(dn: string): string | false;
+    /**
+     * The DN of a group named by its `cn`, or given as a DN: one with a comma.
+     * A DN the directory would refuse is answered 400 rather than its error.
+     *
+     * @param cn the group's name, or its DN
+     * @returns its DN
+     */
+    protected toGroupDn(cn: string): string;
+    /**
+     * {@link toGroupDn} for a route serving the groups branch: what is not
+     * below it, nor named as these groups are (`cn=`), is no group of these
+     * routes, whatever entry it is (#395). The branch may be the whole
+     * directory, which is the default: the naming is what tells an account
+     * from a group there. A multi-valued RDN holding the main attribute
+     * passes here; the group class, checked next, is what settles it.
+     *
+     * @param cn the group's name, or its DN
+     * @returns its DN
+     */
+    protected routeGroupDn(cn: string): string;
+    /**
+     * A filter matching a group: one of the classes this plugin gives groups
+     * (`--group-class`), or a standard group class.
+     */
+    private groupFilter;
+    /**
+     * That the entry a route writes is a group, once the write is judged:
+     * another entry named alike is not one, and is not written as one (#395).
+     *
+     * Judged first, a caller who may not make the write gets the refusal
+     * whether the entry is there, a group or not; only one who may learns
+     * that it is none.
+     *
+     * @param dn the entry, from {@link routeGroupDn}
+     * @param judge the authorization of the write, as `ldap.authorize`
+     */
+    protected judgedGroup(dn: string, judge: () => Promise<void>): Promise<void>;
     /**
      * Verify that each member exists in LDAP
      *

package/dist/src/plugins/ldap/organizations.d.ts

@@ -219,7 +219,8 @@ export default class LdapOrganizations extends DmPlugin {
      * search just learned to survive: a directory that will not walk the whole
      * link filter is told about rather than turned into an empty list.
      *
-     * @param baseDn branch the attached entries live in
+     * @param baseDn branch the attached entries live in; the organization's
+     *        own, for a caller who may not search it
      * @param filter what links them to the organization
      * @param cap how many to return
      * @param dn organization they are attached to, for the indicator's DN
@@ -253,9 +254,8 @@ export default class LdapOrganizations extends DmPlugin {
      * The same two searches as `getOrganisationSubnodes`, narrowed by a query.
      *
      * Both go through the helpers that classify a failure rather than reading
-     * every one of them as emptiness (#179), and both now carry the request:
-     * they ran without one, and an authorization plugin skips its check when
-     * there is none — the same gap the flat routes had until 0.8.2. The
+     * every one of them as emptiness (#179), and both carry the request the
+     * authorization plugins judge them by. The
      * attached entries are capped like the other endpoint's, since an answer
      * the directory refuses to finish is what this is about.
      *

package/dist/src/plugins/twake/appAccountsApi.d.ts

@@ -1,71 +1,6 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
-/**
- * @openapi-component
- * AppAccount:
- *   type: object
- *   description: |
- *     An application-specific identity attached to a user.  App accounts
- *     allow a single principal user to authenticate as different named
- *     "devices" or "applications" each with its own credential, while
- *     sharing the same mail address.
- *   required: [uid]
- *   properties:
- *     uid:
- *       type: string
- *       description: |
- *         Unique identifier of the app account.  Format:
- *         `<prefix>_c<8-digits>`, where `<prefix>` is the `:user` path param
- *         (the resolution value — the mail by default) sanitized into a
- *         uid-safe token (e.g. `alice@example.com` -> `alice_example_com`).
- *       example: alice_example_com_c04729183
- *     name:
- *       type: string
- *       description: Human-readable label (stored as LDAP `description`).
- *       example: Work laptop
- *   example:
- *     uid: alice_c04729183
- *     name: Work laptop
- * AppAccountCreated:
- *   type: object
- *   description: |
- *     Response returned when a new app account is successfully created.
- *     The one-time cleartext password is included here and never returned
- *     again — callers must store it immediately.
- *   required: [uid, pwd, mail]
- *   properties:
- *     uid:
- *       type: string
- *       description: Identifier of the newly created app account.
- *       example: alice_c04729183
- *     pwd:
- *       type: string
- *       description: |
- *         One-time cleartext password generated for this account.
- *         Format: 6 blocks of 4 characters separated by `-`
- *         (e.g. `Ab3@-xYz!-9pQ#-Sv4$-mN8!-pQ5@`).
- *         OpenLDAP hashes it via ppolicy before storage.
- *       example: Ab3@-xYz!-9pQ#-Sv4$-mN8!-pQ5@
- *     mail:
- *       type: string
- *       description: Mail address of the principal account this app account belongs to.
- *       example: alice@example.com
- *   example:
- *     uid: alice_c04729183
- *     pwd: Ab3@-xYz!-9pQ#-Sv4$-mN8!-pQ5@
- *     mail: alice@example.com
- * AppAccountCreate:
- *   type: object
- *   description: Request body for creating a new app account.
- *   properties:
- *     name:
- *       type: string
- *       description: Optional human-readable label for the new account.
- *       example: Work laptop
- *   example:
- *     name: Work laptop
- */
 export default class AppAccountsApi extends DmPlugin {
     name: string;
     roles: Role[];
@@ -87,8 +22,9 @@ export default class AppAccountsApi extends DmPlugin {
      * `:user` is matched against the configured resolution attribute
      * (`app_accounts_user_attribute`, default the mail attribute). Mail is
      * globally unique; resolving by the LDAP `uid` instead is only safe when uid
-     * is unique directory-wide, as the same `uid` may repeat under different
-     * subtrees and resolve to an arbitrary same-named user (see #88).
+     * is unique directory-wide: a `uid` repeated under different subtrees is
+     * answered 409 when the caller reads several of its holders, and resolves
+     * to the one it reads otherwise (see #88).
      *
      * On failure (no match, or an ambiguous one) this writes the HTTP error
      * response and returns null, so callers can simply `return` when it does.

package/dist/src/plugins/twake/groups.d.ts

@@ -81,6 +81,40 @@ export default class TwakeGroups extends LdapGroups {
      * SCIM group mapping leaves the RDN attribute alone.
      */
     afterLoad(): void;
+    /**
+     * A group of `org` with its organization link, under an authorization
+     * model judging entries by that link (`authzLinid1`,
+     * `--authz-filter-attached-entries`): there, a group without one is every
+     * administrator's. Elsewhere the group is left as it is, and judged by its
+     * branch as before.
+     *
+     * The auxiliary class `twakeGroup` is added when the group holds neither
+     * it nor `twakeStaticGroup`. A link the writer gave is kept when it names
+     * the group's organization, refused otherwise: a group in one
+     * organization's branch belonging to another would mix their members.
+     *
+     * @param dn the group's DN
+     * @param org its organization
+     * @param entry the group as written
+     * @returns the group, linked
+     * @throws BadRequestError when the link given names another organization
+     */
+    linked(dn: string, org: string, entry: AttributesList): AttributesList;
+    /**
+     * Refuse a change taking a group's link away from its organization, under
+     * a model judging by attachment: as on a creation, a group in one
+     * organization's branch cannot belong to another, nor to none.
+     *
+     * @param dn the group's DN
+     * @param changes the modification
+     * @throws BadRequestError when the change links it elsewhere or unlinks it
+     */
+    private checkLinkChange;
+    /**
+     * Whether an authorization plugin judges entries by their organization
+     * link: then a group needs one.
+     */
+    private judgedByAttachment;
     /** The organization a group DN belongs to, if it is a group at all. */
     organizationOf(dn: string): string | undefined;
     groupBaseOf(org: string): string;
@@ -112,14 +146,24 @@ export default class TwakeGroups extends LdapGroups {
     groupDn(org: string, id: string): string;
     get userAttribute(): string;
     userDn(org: string, username: string): string;
-    /** Every route answers 404 for a missing organization, 410 for a deleted one. */
-    checkOrganization(org: string): Promise<void>;
+    /**
+     * Every route answers 404 for a missing organization, 410 for a deleted one.
+     *
+     * The status is read as the server, whoever asks; an organization the
+     * caller of `req` cannot read answers as one that is not there, deleted or
+     * not.
+     */
+    checkOrganization(org: string, req?: Request): Promise<void>;
     /** Page, search and sort of a list route, or a refusal of them. */
     page(req: Request, sortable: string[]): Page;
     sorted<T extends Record<string, unknown>>(items: T[], sortBy: string | undefined, desc: boolean): T[];
     /** A group as the routes answer it: members named by their RDN value. */
     groupOf(org: string, entry: AttributesList): Record<string, unknown>;
     groups(org: string, filter: string, attributes?: string[], req?: Request): Promise<AttributesList[]>;
+    /**
+     * A group, read as the caller of `req` when there is one: a group they
+     * cannot read answers as one that is not there.
+     */
     private readGroup;
     /** The group of that display name in the organization, if any. */
     private named;

package/dist/src/plugins/twake/james.d.ts

@@ -37,17 +37,6 @@ export default class James extends TwakePlugin {
      */
     private getUserQuota;
     hooks: Hooks;
-    /**
-     * Where the mail domain entries live, and the attribute naming their
-     * domain: each loaded flat schema declaring the `domainName` role, the
-     * lookup `core/ldap/enterpriseRules` makes. Without one, the branch of the
-     * shipped `twake/nomenclature/twakeDomain.json` and the attribute
-     * `--enterprise-domain-name-attribute` names.
-     *
-     * Rebuilt on each call, as the enterprise rules do theirs: a list taken in
-     * the constructor could predate the schemas.
-     */
-    private domainBranches;
     /**
      * The attribute naming the mail domain of the entry at a DN, when it lies
      * in a domain branch: at any depth, as a deployment may nest its domains

package/docs/README.md

@@ -32,6 +32,31 @@ Integrate LDAP-Rest into your web applications.
 - **[JSON Schemas](client-development/schemas/README.md)** - Schema structure and validation
 - **[Examples](client-development/examples/README.md)** - React, Vue.js, Vanilla JS integration
 
+## API stability
+
+From 1.0.0, ldap-rest follows semantic versioning. These are its public
+API, which a minor or a patch release does not break:
+
+- **Configuration**: the options and environment variables of
+  [Configuration](usage/configuration.md) and of each plugin's page.
+- **Routes**: the paths, bodies and answers of the
+  [REST API](client-development/api/rest-api.md) and the plugin pages,
+  their statuses and their error `code`s.
+- **Plugin API**: what `ldap-rest/plugin` exports — `DmPlugin` and its
+  roles (`auth`, `authz`, …), `asyncHandler`, the DN and filter escaping
+  helpers and the error classes —, the `DM` type of `ldap-rest` and the
+  `Hooks` of `ldap-rest/hooks`, whose arguments are those typed in
+  `src/hooks.ts` ([hooks](plugin-development/hooks.md)), and the directory
+  operations of [the development guide](plugin-development/README.md):
+  `ldap.search`, `add`, `modify`, `rename`, `delete`, `ldap.forRequest`,
+  `ldap.system`, `ldap.authorize`, `ldap.readableBy`,
+  `ldap.canonicalAttributes`, `ldap.canonicalChanges` and
+  `ldap.knowAttributeNames`.
+- **Schemas**: the JSON schema format and the shipped schemas' attributes.
+
+Everything else — other exports, internal helpers, log messages — may
+change in any release.
+
 ## Presentations
 
 Interactive presentations (using [presenterm](https://github.com/mfontanini/presenterm)):

package/docs/plugin-development/README.md

@@ -455,14 +455,13 @@ export default class MyPlugin extends DmPlugin {
 
 The `this.server.ldap` object provides access to all LDAP operations:
 
-> **Serving an HTTP request? Bind it first.**
+> **Say whose each operation is.**
 >
 > The authorization plugins (`core/auth/authzPerBranch`,
 > `core/auth/authzDynamic`, …) hook `ldapsearchrequest`, `ldapaddrequest`,
-> `ldapmodifyrequest`, `ldaprenamerequest` and `ldapdeleterequest`, and they
-> **skip every check when the request is missing**. The methods below take it as a trailing
-> optional argument, so forgetting it does not fail — it silently authorizes
-> the operation. Three such bugs shipped in the SCIM plugin.
+> `ldapmodifyrequest`, `ldaprenamerequest` and `ldapdeleterequest`, and judge
+> an operation by the request it carries. The methods below take it as a
+> trailing optional argument.
 >
 > In a request handler, bind once and use the result:
 >
@@ -472,21 +471,50 @@ The `this.server.ldap` object provides access to all LDAP operations:
 > await directory.modify(dn, changes);
 > ```
 >
-> `forRequest()` returns a `RequestBoundLdap`, whose methods have no request
-> parameter at all — the omission stops being expressible. Use the unbound
-> methods only for work that genuinely belongs to no request, such as startup
-> or scheduled tasks, where passing nothing is the deliberate answer — and
-> say so by reaching for them through `ldap.system`:
+> An operation that names no request while an authenticated request is being
+> served is made for that request all the same, and judged as its caller: a
+> forgotten argument fails closed. Work that is the server's — a uniqueness
+> check has to see a whole branch, and a reference to an entry the caller
+> cannot read is still a valid reference — goes through `ldap.system`, which
+> steps out of the request, with a comment saying why:
 >
 > ```typescript
+> // As the server: a name is taken whoever may read the entry holding it
 > await this.server.ldap.system.search({ scope: 'base' }, dn);
 > ```
 >
-> It is the same object, and that is the point: `ldap.system.search(…)` reads
-> as a decision where `ldap.search(…)` reads as a forgotten argument. Some
-> reads are the server's by nature — a uniqueness check has to see a whole
-> branch, and a reference to an entry the caller cannot read is still a valid
-> reference — and those are the ones it names.
+> A lint rule refuses an operation that names neither a request nor
+> `ldap.system`. Hooks run outside the request: what a hook reads or writes
+> to validate, complete or follow an operation is the server's, and a hook
+> acting as the caller passes the request it is handed. Startup and
+> scheduled tasks run outside any request.
+
+> **Read as the server? Judge the caller first.**
+>
+> A read the server makes for a request answers the caller with what it
+> found: a 404 for an entry that is not there, a 400 for a pointer leading
+> nowhere, a 409 for a name taken. Made before the write it prepares is
+> judged, it tells a caller who may not make that write what the directory
+> holds where they cannot read. Have the authorization plugins judge the
+> write first, without making it:
+>
+> ```typescript
+> await this.server.ldap.authorize('ldaprenamerequest', [dn, newDn, req]);
+> // only now: does dn exist, is newDn free, …
+> ```
+>
+> It runs the hooks of the plugins with the `authz` role only, and refuses
+> with their 403 whether the entry is there or not. The write, when made,
+> is judged again with every other hook.
+>
+> A route that finds an entry as the server, across branches, and then
+> answers about it, checks that the caller can read what it found, and
+> answers as for an entry that is not there otherwise:
+>
+> ```typescript
+> if (!(await this.server.ldap.readableBy(dn, req)))
+>   throw new NotFoundError(`User ${id} not found`);
+> ```
 
 #### Search
 
@@ -549,6 +577,24 @@ await this.server.ldap.modify('uid=john,ou=users,dc=example,dc=com', {
 });
 ```
 
+#### Attribute names
+
+An add or a modify names its attributes as the server does before the
+authorization plugins and the hooks see them: `MAIL`, `rfc822Mailbox` or
+the OID of `mail` reach a hook as `mail`, spelled as the configuration or a
+loaded schema spells it. A hook may therefore look an attribute up by that
+name. An option other than `;binary` is refused, as is one attribute named
+twice in one part of a write.
+
+A route that checks a body before handing it to `add` or `modify` names
+its attributes the same way first, and a plugin loading a schema of its
+own says how it spells them:
+
+```typescript
+await this.server.ldap.canonicalChanges(changes); // or canonicalAttributes(entry)
+this.server.ldap.knowAttributeNames(Object.keys(schema.attributes));
+```
+
 #### Delete
 
 ```typescript

package/docs/plugin-development/dependencies.md

@@ -581,7 +581,13 @@ guards.
 
 ## Hook Execution Order
 
-Hooks are executed in the order plugins are loaded. For chained hooks:
+Hooks are executed in the order plugins are loaded, with one exception: the
+request hooks of authorization plugins (`ldapsearchrequest`, `ldapaddrequest`,
+`ldapmodifyrequest`, `ldapdeleterequest`, `ldaprenamerequest`) run before any
+other plugin's, in the order the authorization plugins loaded. The first hook
+to throw answers the request, so a caller who may not make an operation is
+refused before a plugin judges its content, or replaces it.
+`ldapsearchfilter` keeps the load order. For chained hooks:
 
 1. First plugin in chain can modify/validate data
 2. Returns modified data to next plugin
@@ -595,7 +601,7 @@ For non-chained hooks:
 **Example**: `ldapdeleterequest` chain
 
 ```
-Request → trash (moves to trash) → groups (checks members) → organizations (checks empty) → LDAP
+Request → authorization → trash (moves to trash) → groups (checks members) → organizations (checks empty) → LDAP
 ```
 
 ## Creating Plugins with Dependencies

package/docs/plugin-development/hooks.md

@@ -1,14 +1,13 @@
 # Core hooks
 
-Set here the documentation of all hooks.
-
-Typescript definitions into [hooks.ts](./src/hooks.ts)
+The hooks a plugin can register. Their arguments and return values are
+those typed in [hooks.ts](../../src/hooks.ts), which is the reference.
 
 ## Demo hooks
 
-- **hello**: called by [helloworld demo plugin](./src/plugins/helloworld.ts)
+- **hello**: called by [helloworld demo plugin](../../src/plugins/demo/helloworld.ts)
 
-## [LDAP](./src/lib/ldapActions.ts) hooks
+## [LDAP](../../src/lib/ldapActions.ts) hooks
 
 - **ldapopts**: called before any ldapsearch to modify search options
 - **ldapsearchresult**: called after any ldapsearch to modify search result

package/docs/usage/configuration.md

@@ -186,8 +186,10 @@ deployment has run with it on, and a cache that silently serves stale entries
 is not something to switch on for everyone at once.
 
 Writes made through this service (add, modify, rename, move, delete) drop what
-they change, the moved subtree included. Writes made anywhere else do not:
-another replica of this service, an LSC synchronisation, a hand-run
+they change, the moved subtree included, and what the directory's overlays
+change with them: the `memberOf` of the members a group gains or loses, and
+the entries naming an entry renamed or deleted. Writes made anywhere else do
+not: another replica of this service, an LSC synchronisation, a hand-run
 `ldapmodify`. Each process caches on its own, and only its own writes drop what
 it cached. Turn the cache on when this service is the only writer, or when
 serving an entry up to `--ldap-cache-ttl` seconds old is acceptable; leave it
@@ -509,12 +511,13 @@ Formerly `core/twake/calendarResources`, still accepted as a deprecated alias.
 
 #### `core/twake/applicativeAccounts`
 
-| CLI                               | Plural                             | Env                                 | Default       | Description                           |
-| --------------------------------- | ---------------------------------- | ----------------------------------- | ------------- | ------------------------------------- |
-| `--applicative-account-base`      |                                    | `DM_APPLICATIVE_ACCOUNT_BASE`       |               | Applicative accounts base DN          |
-| `--max-app-accounts`              |                                    | `DM_MAX_APP_ACCOUNTS`               | `5`           | Max accounts per user                 |
-| `--applicative-account-attribute` | `--applicative-account-attributes` | `DM_APPLICATIVE_ACCOUNT_ATTRIBUTES` | _(see below)_ | Attributes copied from the user entry |
-| `--ldap-operational-attribute`    | `--ldap-operational-attributes`    | `DM_LDAP_OPERATIONAL_ATTRIBUTES`    | _(see below)_ | Operational attributes to exclude     |
+| CLI                               | Plural                             | Env                                 | Default            | Description                                            |
+| --------------------------------- | ---------------------------------- | ----------------------------------- | ------------------ | ------------------------------------------------------ |
+| `--applicative-account-base`      |                                    | `DM_APPLICATIVE_ACCOUNT_BASE`       |                    | Applicative accounts base DN                           |
+| `--max-app-accounts`              |                                    | `DM_MAX_APP_ACCOUNTS`               | `5`                | Max accounts per user                                  |
+| `--app-accounts-user-attribute`   |                                    | `DM_APP_ACCOUNTS_USER_ATTRIBUTE`    | the mail attribute | Attribute the `:user` of the routes is matched against |
+| `--applicative-account-attribute` | `--applicative-account-attributes` | `DM_APPLICATIVE_ACCOUNT_ATTRIBUTES` | _(see below)_      | Attributes copied from the user entry                  |
+| `--ldap-operational-attribute`    | `--ldap-operational-attributes`    | `DM_LDAP_OPERATIONAL_ATTRIBUTES`    | _(see below)_      | Operational attributes to exclude                      |
 
 Default copied attributes: `objectClass`, `cn`, `sn`, `givenName`, `displayName`, `description` — plus the configured mail attribute, always.