Feature Request: Allow partial group name matches

[guo3561101]

The log tells me that I can log in to LDAP only when required_groups equals actual_groups

required_groups= {'cn=st2users,cn=people,ou=people,dc=example,dc=cn'} 
actual_groups=  {'cn=st2users,cn=people,ou=people,dc=example,dc=cn'}

The following configuration does not allow login

backend_kwargs = {
"bind_dn": "cn=admin,dc=example,dc=cn",
 "bind_password": "123", 
"base_ou": "ou=People,dc=example,dc=cn",
"id_attr":"cn" ,
"group_dns": ["ou=People,dc=example,dc=cn"],
"group_pattern": "(&(objectClass=person)(&(cn={username})))",
"group_dns_check":"or", 
"host": "ldap.example.cn", 
"port": 389}

2022-05-13 07:34:54,293 ERROR [-] Unable to verify membership for user "st2users (
required_groups={'ou=people,dc=example,dc=cn'},
actual_groups={'cn=st2users,ou=people,dc=example,dc=cn'},
check_behavior=or)".

I have to change group_dns to "cn=st2users,ou=people,dc=example,dc=cn",so that I can log in successfully

Currently I can only add my LDAP authentication by adding group_dns

example: [
"cn=user1,ou=ops,ou=people,dc=example,dc=cn",
"cn=user2,ou=ops,ou=people,dc=example,dc=cn"
]

I can't find my user information without changing group-pattern

my ldap user dn = cn=user1,ou=ops,ou=People,dc=example,dc=cn

I can log in successfully only when group_dns equals my user DN

[cognifloyd]

Right now, we do a full match of group names, include CN,OU,DC:

st2-auth-ldap/st2auth_ldap/ldap_backend.py

Lines 178 to 185 in 9d8b42d

	# Assume group entries are not case sensitive.
	user_groups = set([entry.lower() for entry in user_groups])
	required_groups = set([entry.lower() for entry in self._group_dns])
	result = self._verify_user_group_membership(username=username,
	required_groups=required_groups,
	user_groups=user_groups,
	check_behavior=self._group_dns_check)

st2-auth-ldap/st2auth_ldap/ldap_backend.py

Lines 392 to 397 in 9d8b42d

	if check_behavior == 'and':
	if required_groups.issubset(user_groups):
	return True
	elif check_behavior == 'or':
	if required_groups.intersection(user_groups):
	return True

This logic needs to be modified to allow for:

• groups within an OU (as described in this issue with example: ou=people,dc=example,dc=cn),
• or CN only matches (eg for AD where CN is globally unique).