Repository navigation
Vault.open over a caller's extended-operation connection - #94
Merged
Merged
Conversation
Vault.open(DirContext, LDAPConnection) takes an engine connection the caller has already connected and bound; whatever the caller set on it, such as RFC 4370 proxied authorization as default controls, applies to every engine request. Directory Console needs it for Identity Manager under single sign-on, where it now reaches Vault's private field instead. The vault closes that connection; the directory connection stays the caller's. Co-Authored-By: Claude Opus 5.5 <[email protected]>
# Conflicts: # CHANGELOG.md
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Vault.open(DirContext ldap, LDAPConnection ops): a vault over an engine (extended-operation) connection the caller has already connected and bound.opsapplies to every engine request, for example RFC 4370 proxied authorization as the connection's default controls, so a service account's connection acts for one person.ops;ldapstays the caller's, as with the existingopen.Why: Directory Console 0.3.18 gives single sign-on sessions Identity Manager this way. Today it sets the control through Vault's private
opsfield; with this it can pass its own connection instead.Found on a lab tree (eDirectory 9.2.8, IDM 4.8.7): the engine honours the proxied-authorization control on its extended operations, and keeps the last identity it was given on a connection, so such a connection must belong to one person. The Javadoc says so.
Tests:
VaultOpenTest(closes the engine connection, not the caller's; refuses an unconnected one). The full suite passes.🤖 Generated with Claude Code