Support for OpenLDAP

Another customer, BTC (Schweiz) AG, has requested the same official support for OpenLDAP in CP4BA.
See Support Case TS017772000.

I sent them the statement from Derek Li above, to which they replied:

"I am aware of the workaround, as I was already made aware of this option via this:

https://github.com/apollo-business-automation/fncm-manual-deployment

and now

https://github.com/apollo-business-automation/cp4ba-manual-deployment?tab=readme-ov-file#openldap

However, as you are supporting opensource postgreSQL it would more than consistent to also support an opensource LDAP option. Using this "old" config, one can't be 100% sure that there weren't details that might have changed.

Please have it be added as an official option."

OpenLDAP is already support starting from CP4BA 22.0.2, here is a sample ldap_configuration in CR section

ldap_configuration:

## The possible values are: "IBM Security Directory Server" or "Microsoft Active Directory" or "Custom"

lc_selected_ldap_type: "Custom"

## The name of the LDAP server to connect

lc_ldap_server: "smite1.fyre.ibm.com"

## The port of the LDAP server to connect. Some possible values are: 389, 636, etc.

lc_ldap_port: "636"

## The LDAP bind secret for LDAP authentication. The secret is expected to have ldapUsername and ldapPassword keys. Refer to Knowledge Center for more info.

lc_bind_secret: ldap-bind-secret

## The LDAP base DN. For example, "dc=example,dc=com", "dc=abc,dc=com", etc

lc_ldap_base_dn: "DC=example,DC=org"

## Enable SSL/TLS for LDAP communication. Refer to Knowledge Center for more info.

lc_ldap_ssl_enabled: true

## The name of the secret that contains the LDAP SSL/TLS certificate.

lc_ldap_ssl_secret_name: "ldap-ssl-cert"

## The LDAP user name attribute. One possible value is "*:cn" for TDS and "user:sAMAccountName" for AD. Refer to Knowledge Center for more info.

lc_ldap_user_name_attribute: "*:cn"

## The LDAP user display name attribute. One possible value is "cn" for TDS and "sAMAccountName" for AD. Refer to Knowledge Center for more info.

lc_ldap_user_display_name_attr: "cn"

## The LDAP group base DN. For example, "dc=example,dc=com", "dc=abc,dc=com", etc

lc_ldap_group_base_dn: "DC=example,DC=org"

## The LDAP group name attribute. One possible value is "*:cn" for TDS and "*:cn" for AD. Refer to Knowledge Center for more info.

lc_ldap_group_name_attribute: "*:cn"

## The LDAP group display name attribute. One possible value for both TDS and AD is "cn". Refer to Knowledge Center for more info.

lc_ldap_group_display_name_attr: "cn"

## The LDAP group membership search filter string. One possible value is "(&(cn=%v)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=groupOfURLs)))" for TDS

## and "(&(cn=%v)(objectcategory=group))" for AD.

lc_ldap_group_membership_search_filter: "(|(&(objectclass=groupofnames)(member={0}))(&(objectclass=groupofuniquenames)(uniquemember={0})))"

## The LDAP group membership ID map. One possible value is "groupofnames:member" for TDS and "memberOf:member" for AD.

lc_ldap_group_member_id_map: "groupofnames:member"

## The User script will uncomment the section needed based on user's input from User script. If you are deploying without the User script,

## uncomment the necessary section (depending if you are using Active Directory (ad) or Tivoli Directory Service (tds)) accordingly.

custom:

lc_user_filter: "(&(objectClass=person)(cn=%v))"

lc_group_filter: "(&(objectClass=groupofnames)(cn=%v))"