162 by alvagante · Pull Request #69 · example42/pabawi

alvagante · 2026-11-04T09:09:54Z

No description provided.

- OpenLDAP directories without UUID-valued attributes could not be used, because identities were forced through UUID validation. Attribute mode accepts a stable value such as uid, or the entry dn, as the subject. - dn subjects are stored in canonical RFC 4514 form and resolved with a base-scope read confined to the configured user or group base. - The default uuid mode and Active Directory (always objectGUID) are unchanged; AD rejects attribute mode at config validation. - Administrator-supplied group subjects are normalized by the directory service instead of being assumed to be UUIDs. - Upgrading resets LDAP session freshness once, since the setting is part of the configuration revision.

- Bump version to 1.6.2 across packages, lockfile, OpenAPI, Helm chart appVersion, Dockerfile labels, health endpoint and UI header. - Describe LDAP group subjects with a shared LdapGroupSubject schema in OpenAPI instead of format: uuid, matching LDAP_IDENTITY_MODE=attribute. - CHANGELOG: 1.6.2 entry with the one-time LDAP revalidation upgrade note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🟡 Changes recommended

Attribute-mode identity collisions can grant mapped roles to users belonging only to another group because uniqueness is not checked across the configured group base.

2 open issues

What changed in this PR

Adds optional attribute-based LDAP identities for OpenLDAP, allowing stable attribute values or distinguished names instead of UUIDs. The PR also prepares Pabawi version 1.6.2.

Changes:

Adds identity-mode configuration, DN canonicalization, and scoped identity lookups.
Updates LDAP administration validation, documentation, and tests for non-UUID subjects.
Aligns package, container, API, and UI version metadata.

File	Description
package.json	Bumps root version to 1.6.2.
package-lock.json	Synchronizes root and workspace versions.
frontend/src/components/Navigation.svelte	Displays version 1.6.2.
frontend/package.json	Bumps frontend version.
docs/openapi.yaml	Documents flexible LDAP group subjects and updates API version.
docs/configuration.md	Explains identity modes and their security trade-offs.
Dockerfile.ubuntu	Updates image version label.
Dockerfile.alpine	Updates image version label.
Dockerfile	Updates core image version label.
charts/pabawi/Chart.yaml	Updates Helm application version.
CHANGELOG.md	Records LDAP support changes and upgrade behavior.
backend/test/unit/services/LdapDirectoryService.test.ts	Tests attribute identities and scoped DN lookups.
backend/test/integration/ldap-authentication.test.ts	Tests non-UUID provisioning, mapping, and revalidation.
backend/test/database/ldap-mappings.test.ts	Checks directory-owned subject normalization.
backend/test/config/LdapDn.test.ts	Tests canonical DN rendering.
backend/test/config/LdapConfig.test.ts	Tests identity-mode defaults and restrictions.
backend/src/services/LdapMappingService.ts	Delegates subject resolution to the directory.
backend/src/services/LdapDirectoryService.ts	Adds attribute and DN identity resolution.
backend/src/services/ldap/identity.ts	Adds mode-aware subject normalization.
backend/src/server.ts	Updates health-response version.
backend/src/routes/ldapAdministration.ts	Accepts and normalizes non-UUID group subjects.
backend/src/config/ldapDn.ts	Adds deterministic DN serialization.
backend/src/config/ldap.ts	Parses and validates identity mode.
backend/package.json	Bumps backend version.
backend/.env.example	Adds the identity-mode configuration example.

_{Review effort: Balanced}

ubuntu-latest now resolves to Ubuntu 26.04, where Playwright 1.59.1 refuses to install Chromium ("Playwright does not support chromium on ubuntu26.04-x64"), failing the e2e and ldap-acceptance jobs before any test ran. 1.64.1 ships ubuntu26.04-x64 support. Dev dependency only; release images are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- update-version.js also bumps package-lock.json project entries and docs/openapi.yaml info.version, which 1.6.2 had to fix by hand. - publish_version.sh refuses to tag unless every reference written by update-version.js matches the root version and CHANGELOG.md has a section for it; all mismatches are reported at once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The sanitizer alters exact-match LDAP subjects, while DN canonicalization bypasses the 1024-byte limit, causing mapping failures or incorrect group resolution and producing subjects that diagnostics reject.

2 open issues

1 previously missed issue

In code that hasn't changed since last review

Sanitizer alters LDAP group subjects before route validation

backend/src/routes/ldapAdministration.ts:18

The global sanitizer (securityMiddleware.ts:145–146,248–251), installed before this router, trims strings and removes NULs from LDAP administration subjects. An attribute-mode subject such as Operators therefore becomes Operators, causing mapping creation to fail or resolve a different exact-match group, and diagnostics to reject the unchanged selection at line 128. Preserve groupSubject and groupSubjects values through the sanitizer while retaining route validation, and add HTTP regression coverage with that middleware installed.

_{Review effort: Balanced}

Addresses review on #69: - In attribute mode a non-DN group value (e.g. cn) need not be unique, so a second group sharing a mapped value granted its roles to its own members. Each matched mapped group is now resolved across the group base and must be the only owner of that value at the visited DN. - Canonical DN subjects now pass the common 1024-byte check; escaping can grow a DN past the limit the administration API enforces. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

This assumes workspace entries in package-lock.json live under packages[\"backend\"] /… · New
In attribute mode (non-DN group identity), this introduces an N+1 LDAP lookup pattern: one… · New
maxLength: 1024 constrains characters (per OpenAPI), but the description and server-side… · New
This always reports validation failures at path ['groupSubject'], but the same helper is used to… · New

2 resolved since last review

_{Review effort: Lite}

+      for (const group of matched) {
+        const owner = await this.resolveGroupInTransaction(tx, this.groupLocator(group.subject));


+    LdapGroupSubject:
+      type: string
+      minLength: 1
+      maxLength: 1024
+      description: >-
+        Directory group identity. A lowercase UUID when LDAP_IDENTITY_MODE=uuid (default, always
+        for AD); in attribute mode the configured attribute value verbatim, or a canonical
+        RFC 4514 DN when LDAP_GROUP_ID_ATTR=dn. Maximum 1024 UTF-8 bytes.


alvagante and others added 2 commits November 4, 2026 10:05

Copilot AI balanced review requested due to automatic review settings November 4, 2026 09:09

Copilot started reviewing on behalf of alvagante November 4, 2026 09:10

View session

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Comment thread backend/src/services/LdapDirectoryService.ts Resolved

Comment thread backend/src/services/ldap/identity.ts Resolved

alvagante and others added 2 commits November 4, 2026 10:21

Copilot AI balanced review requested due to automatic review settings November 4, 2026 09:24

Copilot started reviewing on behalf of alvagante November 4, 2026 09:24

View session

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 4, 2026 09:40

Copilot AI reviewed Nov 4, 2026

View reviewed changes

alvagante merged commit ac16351 into main Nov 4, 2026
17 checks passed

alvagante deleted the 162 branch November 4, 2026 10:20

Navigation Menu

Repository navigation

162 - #69

162#69
alvagante merged 5 commits into
mainfrom
162

alvagante commented Nov 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		for (const group of matched) {
		const owner = await this.resolveGroupInTransaction(tx, this.groupLocator(group.subject));

Conversation

alvagante commented Nov 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants