Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Implement "canonical" form for LDAP DNs

Open
  • Is something wrong?
#3,736 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
authentication, backend, security

Research direction

Start by reading the proposed enterprise/ldap/dn.rs abstraction and the existing dn_match_key usage, including comparisons in sync.rs; review the related work in #3709 and #3703. Done means Dn equality and hashing follow the stated RFC 4514 rules, multi-valued RDNs are preserved or explicitly rejected with a migration path, and all comparisons use canonical Dn equality.

Written by the indexing model from the issue text.

Description

optional for release

This builds on recent work in #3709 and #3703.
To avoid further similar issues we should consider introducing our own internal abstraction for DNs that would follow RFC 4514 semantics as close as possible and be used for all comparisons in LDAP-related operations.

Known gaps:

  • Escape spelling outside the first component. A parent OU spelled , in one place and \2c in another doesn't match (for example ou=Sales, West vs ou=Sales\2c West).
  • dn_match_key drops the RDN attribute type. With uid as the RDN attribute, the member cn=jdoe,ou=people,... matches the user uid=jdoe,ou=people,..., so a non-user entry with the same value in the same OU passes its group memberships to that user.
  • Multi-valued RDNs. cn=Alice+uid=42 and cn=Alice+uid=42 both parse to the stored value Alice+uid=42 and rebuild to the same DN, so two distinct entries collide on identity and membership.

Proposed approach:

  • Move Dn into enterprise/ldap/dn.rs and give its PartialEq/Hash RFC 4514 semantics. It should split the DN into RDNs and their attribute-value pairs, unescape values, fold the case of attribute types and values, and treat a multi-valued RDN as a set of pairs.
  • Store the RDN in a form that keeps the structure of a multi-valued RDN, or reject such RDNs explicitly with a migration path for existing users.
  • Delete dn_match_key once every comparison, including those in sync.rs, goes through canonical Dn equality.
Dominant language
Rust
Stars
2.9k
Forks
119
Avg merge
1d 2h
Merged PRs (30d)
57

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DefGuard/defguard

All issues in DefGuard/defguard

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.