Ilker ManapandClaude Opus 5.5
f27d722111
auth.ldap checks a username and password against the domain controllers over LDAPS or StartTLS: found with a service account, checked by binding as the person. Groups, nested ones included, give staff roles and places in the tree. Accounts are tied to the objectGUID; the leader reads the directory every 15 minutes, suspends whom it disabled or removed and reinstates them after, and refuses a sync that would suspend most. Entra ID sends no groups for someone in more than 200, only where to fetch them; that was read as none and took an administrator's role away. It is now left as it was, and logged. An account made by SCIM or OIDC can be reinstated again. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
15 lines
715 B
SQL
15 lines
715 B
SQL
-- Ported from the SQLite migration of the same number.
|
|
-- Which directory keeps an account, and its id there: an Active Directory
|
|
-- objectGUID, so a person whose mail changes there is still the same account
|
|
-- here. suspended_by_sync is an account the directory sync suspended,
|
|
-- because it was disabled or gone there; one an administrator suspended
|
|
-- here is not, and is never reinstated by the sync.
|
|
CREATE TABLE user_directory (
|
|
user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
|
|
directory TEXT NOT NULL,
|
|
external_id TEXT NOT NULL,
|
|
suspended_by_sync INTEGER NOT NULL DEFAULT 0,
|
|
synced_at BIGINT NOT NULL DEFAULT 0,
|
|
UNIQUE (directory, external_id)
|
|
);
|