Documentation
¶
Overview ¶
Package ldapgroups resolves and validates Jamf Pro directory-service (LDAP / cloud-IdP) groups by name. It wraps the `/v1/ldap/groups?q=` search so resources can accept a human-friendly group name and resolve the directory's canonical group identifier — mirroring the admin UI's "Resolve" action.
Two resource families consume it: the User-Initiated Enrollment Access Groups (resolving directory_service_group_id from name) and the scope-bearing resources' directory-service user-group preflight. The search is a CONTAINS match, so callers must filter for an exact name; this package does that and also disambiguates same-named groups across servers via the LDAP server id.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrGroupNotFound = errors.New("directory group not found") ErrAmbiguousGroup = errors.New("directory group name is ambiguous") )
ErrGroupNotFound is returned when no directory group matches the name on the given server. ErrAmbiguousGroup is returned when more than one does (callers should surface it as a configuration error telling the user to disambiguate).
Functions ¶
func Validate ¶
Validate confirms a (name, ldapServerID, groupID) triple refers to a real directory group. It resolves by name+server and checks the resolved id equals the supplied groupID. Returns nil when consistent, ErrGroupNotFound / ErrAmbiguousGroup as Resolve does, or a mismatch error when the group exists but its canonical id differs from groupID.
Types ¶
type Group ¶
type Group struct {
// ID is the directory's canonical group identifier (the value Jamf Pro
// stores as groupId). For an on-prem AD server this is a numeric id; the
// distinguished name is carried separately.
ID string
Name string
LdapServerID int
DistinguishedName string
UUID string
}
Group is a resolved directory-service group identity.
func Resolve ¶
Resolve looks up a directory group by EXACT name on a specific LDAP server.
The underlying search is a contains-match, so Resolve filters the results to an exact, case-sensitive Name equality scoped to ldapServerID. It returns:
- the single matching Group, or
- ErrGroupNotFound (wrapped) when nothing matches, or
- ErrAmbiguousGroup (wrapped) when several do.
func ResolveByName ¶
ResolveByName looks up every directory group whose name EXACTLY matches the given name, across all LDAP servers. Unlike Resolve it is server-agnostic: it serves the classic scope surface, where directory_service_user_group_names carry a name only (no server id), so a name that exists on any configured server is valid.
Returns the (possibly empty) slice of exact-name matches, or an error only when the underlying search fails. An empty result is not an error — callers decide whether "no match" is a problem.
Source Files