Support multiple authentication realms

[horner]

https://chatgpt.com/share/69261ad3-6a8c-8004-9164-b30a01ccbde6

[runleveldev]

@horner this is the wrong repository. Your linked conversation requires changes to the ldap-gateway at https://github.com/mieweb/LDAPServer. I'm moving this issue to that repo.

[runleveldev]

Also ChatGPT's suggestions for what you want to accomplish are half-baked and won't solve the problem as is. You're trying to solve 2 separate but related problems: authenticating using different backends depending on realm, and authorizing access to servers depending on realm.

When decomposed into the smaller problems the solution becomes much clearer. For authorization we can use the LDAP standard: group access controls. Each realm gets a group, each server is configured which groups to allow access from. See sssd-ldap's ldap_access_filter argument.

For authentication, the directory backend (such as the SQL server) can store the correct authentication mechanism for each user (this is similar to how OpenLDAP configures password vs. SASL auth). The gateway then forwards to the correct auth backend(s) depending on the user entry.

With this solution, the directory appears as a single unified tree to clients, utilizes standard LDAP attributes, and is highly scallable since it could delegate to any number of Auth backends.

[runleveldev]

I've updated the issue name to be more descriptive of the issue you described in the ChatGPT conversation originally.