Add integration test for upstreamldap.Provider

- The unit tests for upstreamldap.Provider need to mock the LDAP server,
  so add an integration test which allows us to get fast feedback for
  this code against a real LDAP server.
- Automatically wrap the user search filter in parenthesis if it is not
  already wrapped in parens.
- More special handling for using "dn" as the username or UID attribute
  name.
- Also added some more comments to types_ldapidentityprovider.go.tmpl

generated/1.17/README.adoc

@@ -808,8 +808,8 @@ Status of an LDAP identity provider.
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
-| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default value of "dn={}" would not work.
+| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 |===
 
 
@@ -827,7 +827,7 @@ Status of an LDAP identity provider.
 |===
 | Field | Description
 | *`base`* __string__ | Base is the DN that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com".
-| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}".
+| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work.
 | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributesspec[$$LDAPIdentityProviderUserSearchAttributesSpec$$]__ | Attributes specifies how the user's information should be read from the LDAP entry which was found as the result of the user search.
 |===
 

generated/1.17/apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go

@@ -54,12 +54,18 @@ type LDAPIdentityProviderBindSpec struct {
 type LDAPIdentityProviderUserSearchAttributesSpec struct {
 	// Username specifies the name of attribute in the LDAP entry which whose value shall become the username
 	// of the user after a successful authentication. This would typically be the same attribute name used in
-	// the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
+	// the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
+	// is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default
+	// value of "dn={}" would not work.
 	// +kubebuilder:validation:MinLength=1
 	Username string `json:"username,omitempty"`
 
 	// UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
 	// identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 	// +kubebuilder:validation:MinLength=1
 	UniqueID string `json:"uniqueID,omitempty"`
 }
@@ -72,8 +78,10 @@ type LDAPIdentityProviderUserSearchSpec struct {
 	// Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
 	// in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}"
 	// or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters.
+	// Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
 	// Optional. When not specified, the default will act as if the Filter were specified as the value from
-	// Attributes.Username appended by "={}".
+	// Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
+	// explicitly specified, since the default value of "dn={}" would not work.
 	// +optional
 	Filter string `json:"filter,omitempty"`
 

generated/1.17/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -97,15 +97,26 @@ spec:
                         description: UniqueID specifies the name of the attribute
                           in the LDAP entry which whose value shall be used to uniquely
                           identify the user within this LDAP provider after a successful
-                          authentication. E.g. "uidNumber" or "objectGUID".
+                          authentication. E.g. "uidNumber" or "objectGUID". The value
+                          of this field is case-sensitive and must match the case
+                          of the attribute name returned by the LDAP server in the
+                          user's entry. Distinguished names can be used by specifying
+                          lower-case "dn".
                         minLength: 1
                         type: string
                       username:
                         description: Username specifies the name of attribute in the
                           LDAP entry which whose value shall become the username of
                           the user after a successful authentication. This would typically
-                          be the same attribute name used in the user search filter.
-                          E.g. "mail" or "uid" or "userPrincipalName".
+                          be the same attribute name used in the user search filter,
+                          although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+                          The value of this field is case-sensitive and must match
+                          the case of the attribute name returned by the LDAP server
+                          in the user's entry. Distinguished names can be used by
+                          specifying lower-case "dn". When this field is set to "dn"
+                          then the LDAPIdentityProviderUserSearchSpec's Filter field
+                          cannot be blank, since the default value of "dn={}" would
+                          not work.
                         minLength: 1
                         type: string
                     type: object
@@ -120,9 +131,12 @@ spec:
                       in the filter and will be dynamically replaced by the username
                       for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})".
                       For more information about LDAP filters, see https://ldap.com/ldap-filters.
-                      Optional. When not specified, the default will act as if the
-                      Filter were specified as the value from Attributes.Username
-                      appended by "={}".
+                      Note that the dn (distinguished name) is not an attribute of
+                      an entry, so "dn={}" cannot be used. Optional. When not specified,
+                      the default will act as if the Filter were specified as the
+                      value from Attributes.Username appended by "={}". When the Attributes.Username
+                      is set to "dn" then the Filter must be explicitly specified,
+                      since the default value of "dn={}" would not work.
                     type: string
                 type: object
             required:

generated/1.18/README.adoc

@@ -808,8 +808,8 @@ Status of an LDAP identity provider.
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
-| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default value of "dn={}" would not work.
+| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 |===
 
 
@@ -827,7 +827,7 @@ Status of an LDAP identity provider.
 |===
 | Field | Description
 | *`base`* __string__ | Base is the DN that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com".
-| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}".
+| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work.
 | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributesspec[$$LDAPIdentityProviderUserSearchAttributesSpec$$]__ | Attributes specifies how the user's information should be read from the LDAP entry which was found as the result of the user search.
 |===
 

generated/1.18/apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go

@@ -54,12 +54,18 @@ type LDAPIdentityProviderBindSpec struct {
 type LDAPIdentityProviderUserSearchAttributesSpec struct {
 	// Username specifies the name of attribute in the LDAP entry which whose value shall become the username
 	// of the user after a successful authentication. This would typically be the same attribute name used in
-	// the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
+	// the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
+	// is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default
+	// value of "dn={}" would not work.
 	// +kubebuilder:validation:MinLength=1
 	Username string `json:"username,omitempty"`
 
 	// UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
 	// identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 	// +kubebuilder:validation:MinLength=1
 	UniqueID string `json:"uniqueID,omitempty"`
 }
@@ -72,8 +78,10 @@ type LDAPIdentityProviderUserSearchSpec struct {
 	// Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
 	// in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}"
 	// or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters.
+	// Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
 	// Optional. When not specified, the default will act as if the Filter were specified as the value from
-	// Attributes.Username appended by "={}".
+	// Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
+	// explicitly specified, since the default value of "dn={}" would not work.
 	// +optional
 	Filter string `json:"filter,omitempty"`
 

generated/1.18/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -97,15 +97,26 @@ spec:
                         description: UniqueID specifies the name of the attribute
                           in the LDAP entry which whose value shall be used to uniquely
                           identify the user within this LDAP provider after a successful
-                          authentication. E.g. "uidNumber" or "objectGUID".
+                          authentication. E.g. "uidNumber" or "objectGUID". The value
+                          of this field is case-sensitive and must match the case
+                          of the attribute name returned by the LDAP server in the
+                          user's entry. Distinguished names can be used by specifying
+                          lower-case "dn".
                         minLength: 1
                         type: string
                       username:
                         description: Username specifies the name of attribute in the
                           LDAP entry which whose value shall become the username of
                           the user after a successful authentication. This would typically
-                          be the same attribute name used in the user search filter.
-                          E.g. "mail" or "uid" or "userPrincipalName".
+                          be the same attribute name used in the user search filter,
+                          although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+                          The value of this field is case-sensitive and must match
+                          the case of the attribute name returned by the LDAP server
+                          in the user's entry. Distinguished names can be used by
+                          specifying lower-case "dn". When this field is set to "dn"
+                          then the LDAPIdentityProviderUserSearchSpec's Filter field
+                          cannot be blank, since the default value of "dn={}" would
+                          not work.
                         minLength: 1
                         type: string
                     type: object
@@ -120,9 +131,12 @@ spec:
                       in the filter and will be dynamically replaced by the username
                       for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})".
                       For more information about LDAP filters, see https://ldap.com/ldap-filters.
-                      Optional. When not specified, the default will act as if the
-                      Filter were specified as the value from Attributes.Username
-                      appended by "={}".
+                      Note that the dn (distinguished name) is not an attribute of
+                      an entry, so "dn={}" cannot be used. Optional. When not specified,
+                      the default will act as if the Filter were specified as the
+                      value from Attributes.Username appended by "={}". When the Attributes.Username
+                      is set to "dn" then the Filter must be explicitly specified,
+                      since the default value of "dn={}" would not work.
                     type: string
                 type: object
             required:

generated/1.19/README.adoc

@@ -808,8 +808,8 @@ Status of an LDAP identity provider.
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
-| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default value of "dn={}" would not work.
+| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 |===
 
 
@@ -827,7 +827,7 @@ Status of an LDAP identity provider.
 |===
 | Field | Description
 | *`base`* __string__ | Base is the DN that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com".
-| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}".
+| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work.
 | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributesspec[$$LDAPIdentityProviderUserSearchAttributesSpec$$]__ | Attributes specifies how the user's information should be read from the LDAP entry which was found as the result of the user search.
 |===
 

generated/1.19/apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go

@@ -54,12 +54,18 @@ type LDAPIdentityProviderBindSpec struct {
 type LDAPIdentityProviderUserSearchAttributesSpec struct {
 	// Username specifies the name of attribute in the LDAP entry which whose value shall become the username
 	// of the user after a successful authentication. This would typically be the same attribute name used in
-	// the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
+	// the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
+	// is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default
+	// value of "dn={}" would not work.
 	// +kubebuilder:validation:MinLength=1
 	Username string `json:"username,omitempty"`
 
 	// UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
 	// identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 	// +kubebuilder:validation:MinLength=1
 	UniqueID string `json:"uniqueID,omitempty"`
 }
@@ -72,8 +78,10 @@ type LDAPIdentityProviderUserSearchSpec struct {
 	// Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
 	// in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}"
 	// or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters.
+	// Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
 	// Optional. When not specified, the default will act as if the Filter were specified as the value from
-	// Attributes.Username appended by "={}".
+	// Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
+	// explicitly specified, since the default value of "dn={}" would not work.
 	// +optional
 	Filter string `json:"filter,omitempty"`
 

generated/1.19/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -97,15 +97,26 @@ spec:
                         description: UniqueID specifies the name of the attribute
                           in the LDAP entry which whose value shall be used to uniquely
                           identify the user within this LDAP provider after a successful
-                          authentication. E.g. "uidNumber" or "objectGUID".
+                          authentication. E.g. "uidNumber" or "objectGUID". The value
+                          of this field is case-sensitive and must match the case
+                          of the attribute name returned by the LDAP server in the
+                          user's entry. Distinguished names can be used by specifying
+                          lower-case "dn".
                         minLength: 1
                         type: string
                       username:
                         description: Username specifies the name of attribute in the
                           LDAP entry which whose value shall become the username of
                           the user after a successful authentication. This would typically
-                          be the same attribute name used in the user search filter.
-                          E.g. "mail" or "uid" or "userPrincipalName".
+                          be the same attribute name used in the user search filter,
+                          although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+                          The value of this field is case-sensitive and must match
+                          the case of the attribute name returned by the LDAP server
+                          in the user's entry. Distinguished names can be used by
+                          specifying lower-case "dn". When this field is set to "dn"
+                          then the LDAPIdentityProviderUserSearchSpec's Filter field
+                          cannot be blank, since the default value of "dn={}" would
+                          not work.
                         minLength: 1
                         type: string
                     type: object
@@ -120,9 +131,12 @@ spec:
                       in the filter and will be dynamically replaced by the username
                       for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})".
                       For more information about LDAP filters, see https://ldap.com/ldap-filters.
-                      Optional. When not specified, the default will act as if the
-                      Filter were specified as the value from Attributes.Username
-                      appended by "={}".
+                      Note that the dn (distinguished name) is not an attribute of
+                      an entry, so "dn={}" cannot be used. Optional. When not specified,
+                      the default will act as if the Filter were specified as the
+                      value from Attributes.Username appended by "={}". When the Attributes.Username
+                      is set to "dn" then the Filter must be explicitly specified,
+                      since the default value of "dn={}" would not work.
                     type: string
                 type: object
             required:

generated/1.20/README.adoc

@@ -808,8 +808,8 @@ Status of an LDAP identity provider.
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
-| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+| *`username`* __string__ | Username specifies the name of attribute in the LDAP entry which whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default value of "dn={}" would not work.
+| *`uniqueID`* __string__ | UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID". The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 |===
 
 
@@ -827,7 +827,7 @@ Status of an LDAP identity provider.
 |===
 | Field | Description
 | *`base`* __string__ | Base is the DN that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com".
-| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}".
+| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work.
 | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributesspec[$$LDAPIdentityProviderUserSearchAttributesSpec$$]__ | Attributes specifies how the user's information should be read from the LDAP entry which was found as the result of the user search.
 |===
 

generated/1.20/apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go

@@ -54,12 +54,18 @@ type LDAPIdentityProviderBindSpec struct {
 type LDAPIdentityProviderUserSearchAttributesSpec struct {
 	// Username specifies the name of attribute in the LDAP entry which whose value shall become the username
 	// of the user after a successful authentication. This would typically be the same attribute name used in
-	// the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
+	// the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
+	// is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default
+	// value of "dn={}" would not work.
 	// +kubebuilder:validation:MinLength=1
 	Username string `json:"username,omitempty"`
 
 	// UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
 	// identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 	// +kubebuilder:validation:MinLength=1
 	UniqueID string `json:"uniqueID,omitempty"`
 }
@@ -72,8 +78,10 @@ type LDAPIdentityProviderUserSearchSpec struct {
 	// Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
 	// in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}"
 	// or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters.
+	// Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
 	// Optional. When not specified, the default will act as if the Filter were specified as the value from
-	// Attributes.Username appended by "={}".
+	// Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
+	// explicitly specified, since the default value of "dn={}" would not work.
 	// +optional
 	Filter string `json:"filter,omitempty"`
 

generated/1.20/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -97,15 +97,26 @@ spec:
                         description: UniqueID specifies the name of the attribute
                           in the LDAP entry which whose value shall be used to uniquely
                           identify the user within this LDAP provider after a successful
-                          authentication. E.g. "uidNumber" or "objectGUID".
+                          authentication. E.g. "uidNumber" or "objectGUID". The value
+                          of this field is case-sensitive and must match the case
+                          of the attribute name returned by the LDAP server in the
+                          user's entry. Distinguished names can be used by specifying
+                          lower-case "dn".
                         minLength: 1
                         type: string
                       username:
                         description: Username specifies the name of attribute in the
                           LDAP entry which whose value shall become the username of
                           the user after a successful authentication. This would typically
-                          be the same attribute name used in the user search filter.
-                          E.g. "mail" or "uid" or "userPrincipalName".
+                          be the same attribute name used in the user search filter,
+                          although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+                          The value of this field is case-sensitive and must match
+                          the case of the attribute name returned by the LDAP server
+                          in the user's entry. Distinguished names can be used by
+                          specifying lower-case "dn". When this field is set to "dn"
+                          then the LDAPIdentityProviderUserSearchSpec's Filter field
+                          cannot be blank, since the default value of "dn={}" would
+                          not work.
                         minLength: 1
                         type: string
                     type: object
@@ -120,9 +131,12 @@ spec:
                       in the filter and will be dynamically replaced by the username
                       for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})".
                       For more information about LDAP filters, see https://ldap.com/ldap-filters.
-                      Optional. When not specified, the default will act as if the
-                      Filter were specified as the value from Attributes.Username
-                      appended by "={}".
+                      Note that the dn (distinguished name) is not an attribute of
+                      an entry, so "dn={}" cannot be used. Optional. When not specified,
+                      the default will act as if the Filter were specified as the
+                      value from Attributes.Username appended by "={}". When the Attributes.Username
+                      is set to "dn" then the Filter must be explicitly specified,
+                      since the default value of "dn={}" would not work.
                     type: string
                 type: object
             required:

generated/latest/apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go

@@ -54,12 +54,18 @@ type LDAPIdentityProviderBindSpec struct {
 type LDAPIdentityProviderUserSearchAttributesSpec struct {
 	// Username specifies the name of attribute in the LDAP entry which whose value shall become the username
 	// of the user after a successful authentication. This would typically be the same attribute name used in
-	// the user search filter. E.g. "mail" or "uid" or "userPrincipalName".
+	// the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
+	// is set to "dn" then the LDAPIdentityProviderUserSearchSpec's Filter field cannot be blank, since the default
+	// value of "dn={}" would not work.
 	// +kubebuilder:validation:MinLength=1
 	Username string `json:"username,omitempty"`
 
 	// UniqueID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
 	// identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
+	// The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
+	// server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
 	// +kubebuilder:validation:MinLength=1
 	UniqueID string `json:"uniqueID,omitempty"`
 }
@@ -72,8 +78,10 @@ type LDAPIdentityProviderUserSearchSpec struct {
 	// Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
 	// in the filter and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}"
 	// or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters.
+	// Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
 	// Optional. When not specified, the default will act as if the Filter were specified as the value from
-	// Attributes.Username appended by "={}".
+	// Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
+	// explicitly specified, since the default value of "dn={}" would not work.
 	// +optional
 	Filter string `json:"filter,omitempty"`