MAP LDAP account attributes to labels such as groups

[mrueg]

Since the original PR went stale, I

• Cherry-picked the commits from Map LDAP account attributes to labels such as groups #63 #167 so they apply against master again.
• Added example ACL as requested

@rojer @alonbl Please have another look. Also @kcd83 fyi :)

---

This change is 

[alonbl]

Looks ok!

[mrueg]

@rojer Friendly ping :)

[jaen]

@mrueg is that perchance available somewhere in Dockerhub? Or would I have to build an image on my own?

[mrueg]

@jaen I've patched it downstream in gentoo, (sys-auth/docker_auth), that's where I'm currently using it.

[jaen]

I see, thanks for the info. I guess I'll just build my own image then.

[jaen]

@mrueg this is mostly working for me, except for the fact that FreeIPA seems to have types of DN elements lowercased, so I had to modify getCNfromDN to do strings.ToLower on rdnAttr.Type and compare to "cn".

Case-insensitive comparison would be a welcome change so I could use it out-of-the-box.

[rojer]

@mrueg can you address @jaen 's comment? seems ok and good to go to me otherwise

[aleofreddi]

For my use case It would be really great to use a regex as well to extract the label value (besides the CN extraction). I could implement that on top of this PR, but is there any hope this one gets merged?

Do you think it makes any sense, and would be the auth_ldap backend the right place for such a feature?

[abaddononion]

Just starting using the cesanta/docker_auth container, and getting this PR merged would be really helpful for my purposes, as well!

[pinepain]

@mrueg million thanks for taking care of this!

@jaen would you think that merging this one and then addressing lowercasing CN in a separate PR would be appropriate? Apparently, adding groups filtering has some touch on it and it seems to be this PR have a good change to stale as the original one too.

[jaen]

Ah, sure. I'm not directly involved with the project that initially required this now, so I don't have any strong feelings on having this included anymore.

[rojer]

ok, ok, people, i'm on it.
sorry for neglecting this for so long, docker_auth is far from my main LoB and LDAP is even further off.

[rojer]

ok, this is now in :latest and :1.4.0.