[DOCS-13642] Investigate changes in SERVER-44786: Abort LDAP user to DN mapping on network error Created: 11/May/20  Updated: 13/Nov/23  Resolved: 22/Jun/20

Status: Closed
Project: Documentation
Component/s: manual
Affects Version/s: None
Fix Version/s: 4.4.0-rc4, 4.7.0, Server_Docs_20231030, Server_Docs_20231106, Server_Docs_20231105, Server_Docs_20231113

Type: Task Priority: Major - P3
Reporter: Backlog - Core Eng Program Management Team Assignee: John Williams
Resolution: Fixed Votes: 0
Labels: docs-ldap, docs-security
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Documented
documents SERVER-44786 Abort LDAP user to DN mapping on netw... Closed
Participants:
Days since reply: 3 years, 33 weeks, 2 days ago
Epic Link: DOCS: 4.4 Server Release Work
Story Points: 2

 Description   

Description

Downstream Change Summary

CLOUD and Support should be aware of this change at it promotes otherwise "soft" error during LDAP name mapping into "hard" errors.

This change is important as a transient network error could lead to an erroneous name mapping if an early, higher priority rule fails for non-schema related reasons, but a later fallback rule does not.

If this causes customer issues, TSEs should be prepared to use setParameter `ldapAbortOnNameMappingFailure=false` to disable the new abort on error behavior. This setting should NOT be advertised in DOCS as using it has the potential to weaken authorization security as noted above.

Description of Linked Ticket

MongoDB evaluates a sequence if rules to resolve an authentication name into an LDAP DN. It may use regex rules or LDAP queries. If rules fail to match or evaluate the next rule is tried. However, failure to evaluate an LDAP rule doesn't indicate success or failure, and should terminate evaluation of the whole chain.

Scope of changes

Impact to Other Docs

MVP (Work and Date)

Resources (Scope or Design Docs, Invision, etc.)



 Comments   
Comment by Githook User [ 22/Jun/20 ]

Author:

{'name': 'John Williams', 'email': 'john.williams@10gen.com', 'username': 'jwilliams-mongo'}

Message: DOCS-13642: quit LDAP user to DN mapping on network error
Branch: master
https://github.com/mongodb/docs/commit/3650a2070ea54b9624f27ca42d66eb552d1619a7

Comment by John Williams [ 08/Jun/20 ]

cr: https://mongodbcr.appspot.com/623950001/

Generated at Thu Feb 08 08:08:21 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.