Add support for LDAP

[KAllan357]

Need to support configuring and getting information about the LDAP end points.

[josephholsten]

Will require adding NexusLdapAuthenticationRealm to NexusCli::GlobalSettingsActions.get_global_settings['data']['securityRealms']. Investigating the other changes required.

Probably will require other things for Nexus Pro.

[josephholsten]

It'll also need to PUT against /service/local/ldap/conn_info:

{
    "data": {
        "protocol": "ldap",
        "host": "dc-001.fabricam.net",
        "port": 389,
        "searchBase": "DC=intsm,DC=net",
        "authScheme": "DIGEST-MD5",
        "systemUsername": "--FAKE-USERNAME--",
        "systemPassword": "--FAKE-PASSWORD--"
    }
}

and against /service/local/ldap/user_group_info:

{
    "data": {
        "userBaseDn": "cn=Users",
        "userSubtree": false,
        "userObjectClass": "user",
        "userIdAttribute": "sAMAccountName",
        "userRealNameAttribute": "cn",
        "emailAddressAttribute": "mail",

        "ldapGroupsAsRoles": true,

        "groupBaseDn": "cn=Groups",
        "groupSubtree": false,
        "groupObjectClass": "groupOfUniqueNames",
        "groupIdAttribute": "cn",
        "groupMemberAttribute": "uniqueMember",
        "groupMemberFormat": "${username}",

        "userMemberOfAttribute": "memberOf"
    }
}

This is really just for Active Directory setups, but I assume it would be easy enough to modify to a normal LDAP service.

After that, it'll require some calls to set up External Role Mappings. Investigating that now.

[josephholsten]

hmm, I'm not having much luck with the api calls for roles. I've noticed that it does effect $NEXUSPATH/nexus/sonatype-work/nexus/conf/security.xml, adding something like:

  <roles>
    <role>
      <id>Domain Admins</id>
      <name>Domain Admins</name>
      <description>External mapping for Domain Admins (LDAP)</description>
      <roles>
        <role>nx-admin</role>
      </roles>
    </role>
  </roles>

This doesn't really help the cli much, but can help config management.

[KAllan357]

conn_info and user_group_info both make sense. I'm not very familiar with how roles work. Maybe editing that security.xml is something that should be left to the nexus cookbook?

[josephholsten]

Ah, I think I've got it. Seems like it just takes a POST to /service/local/roles with:

{
    "data": {
        "id": "Domain Admins",
        "name": "Domain Admins",
        "description": "External mapping for Domain Admins (LDAP)",
        "sessionTimeout": 60,
        "roles": [
            "nx-admin"
        ],
        "privileges": []
    }
}