add validation to prevent filters on dn lookups

[deads2k]

Bug https://bugzilla.redhat.com/show_bug.cgi?id=1339325

Tightens validation for ldap sync config. Filters on dn lookups don't work.

@stevekuznetsov can you tag this for the right extended test?

[stevekuznetsov]

[testonlyextended][extended:ldap_groups]

[deads2k]

[test]

[stevekuznetsov]

error: validation of LDAP sync config failed: usersQuery.filter: Invalid value: "(objectclass=inetOrgPerson)": cannot specify a filter when using "dn" as the UID attribute
See 'oadm groups sync -h' for help and examples.
!!! Error in test/extended/ldap_groups.sh:231
    'oadm groups sync --sync-config=sync-config-paging.yaml --confirm' exited with status 1

hoisted by your own petard?

[deads2k]

hoisted by your own petard?

I blame the guy who wrote a set of tests that were wrong :).

[deads2k]

@stevekuznetsov other than the test, anything?

[stevekuznetsov]

This implicitly disallows not specifying a filter, so how is the validation not failing for those missing filters?

[stevekuznetsov]

This allows queries without filters, which complicates the config substantially... let's see the Docs PR to determine how onerous it is to explain this.

[deads2k]

This allows queries without filters, which complicates the config substantially... let's see the Docs PR to determine how onerous it is to explain this.

It only allows them when the caller explicitly says, "this exact one (not category) will only be used to lookup dns". I don't think it affects docs at all. Even if it does, do you see us not doing this?

[stevekuznetsov]

I understand it's correct, but clearly there is a documentation gap -- we should definitely doc that a filter is not expected and will not be used if the UID attribute for a query is the DN.

[openshift-bot]

Evaluated for origin testonlyextended up to 9351adc

[openshift-bot]

Evaluated for origin test up to 9351adc

[openshift-bot]

continuous-integration/openshift-jenkins/testonlyextended SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin_extended/206/) (Extended Tests: ldap_groups)

[deads2k]

[merge]

[openshift-bot]

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/4422/) (Image: devenv-rhel7_4311)

[openshift-bot]

Evaluated for origin merge up to 9351adc

[openshift-bot]

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/4422/)