ahaenggli/AzureAD-LDAP-wrapper v1.7.0

on GitHub

[1.7.0] - 2022-03-19

Changed

• to support #ext#-users the following changes were necessary:
  • added ldap attribute AzureADuserPrincipalName with the original AAD-User (for login/password check in the AAD)
  • allowed domain mismatch for AD-Domain and LDAP-Domain
  • try binding via AzureADuserPrincipalName if no entry for uid/dn is found
  • env var GRAPH_FILTER_USERS to filter user entries in graph using the $filter query parameter
    (default is set to userType eq 'Member', so external users (guests) will not be synced automatically by default)
  • env var GRAPH_FILTER_GROUPS to filter group entries in graph using the $filter query parameter
    (e.g. set it to securityEnabled eq true so only security groups will be sync and not every teams-group)
• SID calculation for users is now sambaSID: fixedBase + "-" + (uidNumber * 2 + 1000)
• SID calculation for groups is now sambaSID: fixedBase + "-" + (gidNumber * 2 + 1001)

Added

• support #ext#-users (guest users from other ExternalAzureAD)
• add ldap attribute sambaPrimaryGroupSID for users
• optional env var LDAP_SAMBADOMAINNAME to manually set the sambaDomainName attribute in the LDAP
• optional env var SAMBA_BASESID to overwrite the fixed base SID

Fixed

• documentation for join a device with a non AAD user
• handle for @odata.nextLink in graph responses (should fix parts of #14)
• converted schema csv files from utf-16 to utf-8
• handle cn=subschema like any other ldap entries instead of fixed search attributes
• register an error handler for the server (EventEmitter)
• escape LDAP special chars ,=+<>#;\ with an additional backslash