I want to group users in project users in LDAP. Lets say there are user1, user2, user3, each with a password and ssh-key. I want to group them in project1, project2.
Given that user1 is member of group project1, he should be able to authenticate with username project1 and password/ssh-key from user1.
Is this possible with LDAP and if it is, can you please give some hints how to achieve this.
Not with standard LDAP methods, to my knowledge. It would be quite ineffective anyway, as LDAP would need to check the password against any member of the group1 to see if it is valid.
In theory, it could be done when you write your own authentication system (e.g. a new LDAP PAM plugin with this functionality), but it would open up a lot of problems, most prominent one the case of identical passwords between two users: As which one do you authenticate?
Any particular reason why you would want to do this?
Ok, so you can use a group strategy for each service. However, it's difficult to apply individual groups to projects within each service without customizations for each. For example, you can define separate groups for each service, SSH, Build Machine, SVN, etc.. For example, if you want users only in the source-control group to have access to SVN, you would specifiy the following URL in the cooresponding Apache virtual host:
<AuthnProviderAlias ldap ldap-users>
AuthLDAPUrl "ldaps://myldapserver:636/DC=mydomain,DC=local?sAMAccountName?sub?(&(objectCategory=person)(memberOf=CN=source-control,CN=Users,DC=mydomain,DC=local))" "SSL"
However, you will have to drill down to the service level using their known management. Take SVN for example:
[groups]
project1_team = dave, john, andy
[/]
* =
dave = rw
[/project1]
@project1_team = rw
[/project2]
andy = r
You want SASL Proxy Authorization (OpenLDAP docs). It's essentially su for OpenLDAP.
It will not, however, work with ssh-keys, as SASL doesn't understand them.
