Joseph Doherty
4e01cbc2c3
Diagnostic for pinning down the LDAP settings the four ZB.MOM.WW apps need against the Zimmer NAM domain, and for answering which AD groups can be mapped to app roles. Found the referral defect fixed in 0.2.1. Two independent halves in one run: Part A drives the REAL ZB.MOM.WW.Auth.LdapAuthService -- same bind-then-search- then-bind, same options validator, same failure enum -- so its verdict IS what the apps produce rather than an approximation of it. Part B asks the directory what the library cannot, which is where the group answer comes from: full group DNs, nested groups via LDAP_MATCHING_RULE_IN_CHAIN, the primary group (AD omits it from memberOf, so it can never be a role group), security vs distribution type, decoded userAccountControl, referral counts, and the TLS chain with key sizes. --list-groups '<pat>' enumerates every matching group in the directory, which a membership dump structurally cannot do -- it only ever shows one account's memberships. Passwords are prompted for and never echoed; they cannot be passed as arguments, which would put them in shell history. --self-bind lets the user under test stand in for the service account, so group discovery does not require the svc_igntnapp secret. Not packable, outside the Auth solution and its central package management, referencing the Auth projects directly so it tracks current source.
34 lines
1.5 KiB
XML
34 lines
1.5 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<OutputType>Exe</OutputType>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<Nullable>enable</Nullable>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<LangVersion>latest</LangVersion>
|
|
<RootNamespace>ZB.MOM.WW.Tools.LdapProbe</RootNamespace>
|
|
<AssemblyName>ldapprobe</AssemblyName>
|
|
<!-- Deliberately outside the ZB.MOM.WW.Auth CPM tree: this is a throwaway
|
|
diagnostic, not a shipped package. Versions are pinned inline. -->
|
|
<ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
|
|
<IsPackable>false</IsPackable>
|
|
<InvariantGlobalization>true</InvariantGlobalization>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- Part A runs the REAL shared library, so what the probe proves is what the
|
|
four apps will actually do. Project references (not the 0.2.0 feed package)
|
|
so the probe tracks current source. -->
|
|
<ProjectReference Include="..\..\ZB.MOM.WW.Auth\src\ZB.MOM.WW.Auth.Ldap\ZB.MOM.WW.Auth.Ldap.csproj" />
|
|
<ProjectReference Include="..\..\ZB.MOM.WW.Auth\src\ZB.MOM.WW.Auth.Abstractions\ZB.MOM.WW.Auth.Abstractions.csproj" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- Part B talks to the directory directly, so it can ask questions the library
|
|
does not (transitive groups, primary group, referral behaviour). Must match
|
|
the version the library resolves. -->
|
|
<PackageReference Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|