support ldap userfilter attribute (#1378)

hashicorp · May 5, 2022 · d8c735d · d8c735d
1 parent 53dcdbe
commit d8c735d
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 1 deletion.
diff --git a/vault/resource_ldap_auth_backend.go b/vault/resource_ldap_auth_backend.go
@@ -72,6 +72,11 @@ func ldapAuthBackendResource() *schema.Resource {
 				return strings.ToLower(v.(string))
 			},
 		},
+		"userfilter": {
+			Type:     schema.TypeString,
+			Optional: true,
+			Computed: true,
+		},
 		"discoverdn": {
 			Type:     schema.TypeBool,
 			Optional: true,
@@ -240,6 +245,10 @@ func ldapAuthBackendUpdate(d *schema.ResourceData, meta interface{}) error {
 		data["userattr"] = v.(string)
 	}
 
+	if v, ok := d.GetOk("userfilter"); ok {
+		data["userfilter"] = v.(string)
+	}
+
 	if v, ok := d.GetOkExists("discoverdn"); ok {
 		data["discoverdn"] = v.(bool)
 	}
@@ -339,6 +348,7 @@ func ldapAuthBackendRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("case_sensitive_names", resp.Data["case_sensitive_names"])
 	d.Set("userdn", resp.Data["userdn"])
 	d.Set("userattr", resp.Data["userattr"])
+	d.Set("userfilter", resp.Data["userfilter"])
 	d.Set("discoverdn", resp.Data["discoverdn"])
 	d.Set("deny_null_bind", resp.Data["deny_null_bind"])
 	d.Set("upndomain", resp.Data["upndomain"])

diff --git a/vault/resource_ldap_auth_backend_test.go b/vault/resource_ldap_auth_backend_test.go
@@ -193,6 +193,7 @@ func testLDAPAuthBackendCheck_attrs(path string) resource.TestCheckFunc {
 			"binddn":               "binddn",
 			"userdn":               "userdn",
 			"userattr":             "userattr",
+			"userfilter":           "userfilter",
 			"discoverdn":           "discoverdn",
 			"deny_null_bind":       "deny_null_bind",
 			"upndomain":            "upndomain",
@@ -283,7 +284,7 @@ resource "vault_ldap_auth_backend" "test" {
     discoverdn             = false
     deny_null_bind         = true
     description            = "example"
-
+	userfilter             = "({{.UserAttr}}={{.Username}})"
     use_token_groups = %s
 }
 `, path, local, use_token_groups)

diff --git a/website/docs/r/ldap_auth_backend.html.md b/website/docs/r/ldap_auth_backend.html.md
@@ -51,6 +51,8 @@ The following arguments are supported:
 
 * `userattr` - (Optional) Attribute on user object matching username passed in
 
+* `userfilter` - (Optional) LDAP user search filter
+
 * `upndomain` - (Optional) The userPrincipalDomain used to construct UPN string
 
 * `discoverdn`: (Optional) Use anonymous bind to discover the bind DN of a user.