Misc cleanup + fixes

[dhirschfeld]

This cleans up the code a bit and as such helps clarify the underlying logic. In the process I've hopefully resolved a couple of issues:

• Fixes Without bind_dn_template, any password is authenticated successfully! #44
  Empty DN templates are now ignored
• Fixes Config options allowed_groups and search_filter are mutually exclusive #93
  search_filter and allowed_groups are no longer mutually exclusive

[dhirschfeld]

@djrobstep, @ermakovpetr - it would be great if you could verify if this branch fixes the problem you observed in #44

[dhirschfeld]

@mfriedemann - it would be great if you could verify if this branch fixes the problem you had in #93 or clarify what else needs to be done to support your usecase.

[ermakovpetr]

@dhirschfeld

it would be great if you could verify if this branch fixes the problem you observed in #44

ok! I will definitely look in the coming days

[djrobstep]

@dhirschfeld cool, i'll give it a look when I can

[mfriedemann]

@dhirschfeld
I just took a look at the patch, and while it now handles search and the group check sequentially, I think it will still not work for our case, as it expects the userdn (which it formats against the (list of) string(s) configured via bind_dn_template) to be a DN and later uses it for the group filter as-is (member={userdn}).

As hinted at earlier, we bind to AD, but aren't keen on using a technical account to do it. Instead, we take the username that is entered (basically the sAMAccountName), and by using the bind_dn_template to append an '@' and the AD domain, we construct the userPrincipalName (which looks like an email address, and is not a DN). For AD, you can authenticate the user with this userPrincipalName and the password. Note that in this case, you haven't gotten a DN for the user, yet, you would need to do a search first.
But neither the current nor the prior version actually update the userdn variable from the search results.

FWIW, I added the group check to the search filter (luckily, AD represents group membership on both ends) and made it work that way.

HTH,
M.

[dhirschfeld]

In the interests of moving forward I'll merge then iterate...