#LDAP 管理

apiVersion: dex.coreos.com/v1
kind: Connector
id: ldap        # Connector ID
name: ldap      # Connector display name
type: ldap      # Connector type is LDAP
metadata:
  name: ldap
  namespace: cpaas-system
spec:
  config:
    # LDAP server address and port
    host: ldap.example.com:636                         
    # DN and password for the service account used by the connector.
    # This DN is used to search for users and groups.
    bindDN: uid=serviceaccount,cn=users,dc=example,dc=com 
    # Service account password, required when creating a connector.
    bindPW: password                         

    # Login account prompt. For example, username
    usernamePrompt: SSO Username
    
    # User search configuration
    userSearch:
      # Start searching from the base DN
      baseDN: cn=users,dc=example,dc=com
      # LDAP query statement, used to search for users.
      # For example: "(&(objectClass=person)(uid=<username>))"
      filter: (&(objectClass=organizationalPerson))

      # The following fields are direct mappings of user entry attributes.
      # User ID attribute
      idAttr: uid
      # Required. Attribute to map to email                     
      emailAttr: mail
      # Required. Attribute to map to username
      nameAttr: cn
      # Login username attribute
      # Filter condition will be converted to "(<attr>=<username>)", such as (uid=example).
      username: uid

      # Extended attributes
      # phoneAttr: phone

    # Group search configuration  
    groupSearch:
      # Start searching from the base DN
      baseDN: cn=groups,dc=freeipa,dc=example,dc=com
      # Group filter condition
      # "(&(objectClass=group)(member=<user uid>))".
      filter: "(objectClass=group)"
      # User group matching field
      # Group attribute
      groupAttr: member
      # User group member attribute
      userAttr: uid
      # 组显示名称
      nameAttr: cn

# 1. 基本过滤：查找所有用户
(&(objectClass=person))

# 2. 多条件组合：查找特定部门用户
(&(objectClass=person)(departmentNumber=1000))

# 3. 查找启用用户（Active Directory）
(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

# 4. 查找特定邮箱域用户
(&(objectClass=person)(mail=*@example.com))

# 5. 查找特定组成员
(&(objectClass=person)(memberOf=cn=developers,ou=groups,dc=example,dc=com))

# 6. 查找最近登录用户（Active Directory）
(&(objectClass=user)(lastLogon>=20240101000000.0Z))

# 7. 排除系统账号
(&(objectClass=person)(!(uid=admin))(!(uid=system)))

# 8. 查找具有特定属性的用户
(&(objectClass=person)(mobile=*))

# 9. 查找多个部门用户
(&(objectClass=person)(|(ou=IT)(ou=HR)(ou=Finance)))

# 10. 复杂条件组合示例
(&
  (objectClass=person)
  (|(department=IT)(department=Engineering))
  (!(title=Intern))
  (manager=cn=John Doe,ou=People,dc=example,dc=com)
)

# 1. 基本过滤：查找所有组
(objectClass=groupOfNames)

# 2. 查找特定前缀组
(&(objectClass=groupOfNames)(cn=dev-*))

# 3. 查找非空组
(&(objectClass=groupOfNames)(member=*))

# 4. 查找具有特定成员的组
(&(objectClass=groupOfNames)(member=uid=john,ou=People,dc=example,dc=com))

# 5. 查找嵌套组（Active Directory）
(&(objectClass=group)(|(groupType=-2147483646)(groupType=-2147483644)))

# 6. 查找具有特定描述的组
(&(objectClass=groupOfNames)(description=*admin*))

# 7. 排除系统组
(&(objectClass=groupOfNames)(!(cn=system*)))

# 8. 查找具有特定成员的组
(&(objectClass=groupOfNames)(|(cn=admins)(cn=developers)(cn=operators)))

# 9. 查找特定 OU 下的组
(&(objectClass=groupOfNames)(ou=IT))

# 10. 复杂条件组合示例
(&
  (objectClass=groupOfNames)
  (|(cn=prod-*)(cn=dev-*))
  (!(cn=deprecated-*))
  (owner=cn=admin,dc=example,dc=com)
)

# AND 操作符 (&) - 所有条件必须满足
# 语法： (&(condition1)(condition2)(condition3)...)

# 多属性 AND 示例
(&
  (objectClass=person)
  (mail=*@example.com)
  (title=Engineer)
  (manager=*)
)

# OR 操作符 (|) - 至少满足一个条件
# 语法： (|(condition1)(condition2)(condition3)...)

# 多属性 OR 示例
(|
  (department=IT)
  (department=HR)
  (department=Finance)
)

# AND 与 OR 结合
(&
  (objectClass=person)
  (|
    (department=IT)
    (department=R&D)
  )
  (employeeType=FullTime)
)

# 复杂条件组合
(&
  (objectClass=person)
  (|
    (&
      (department=IT)
      (title=*Engineer*)
    )
    (&
      (department=R&D)
      (title=*Developer*)
    )
  )
  (!(status=Inactive))
  (|(manager=*)(isManager=TRUE))
)