LDAP group check is restricted to only one group

[viharm]

The group checking functionality checks for user's membership in only one group. This assumes that the application will probably have a separate group in the directory. However it does not account for a situation where the application may want to provide access to users from more than one group (e.g., Finance and Accounts).

[viharm]

Propose supplying an array of groups to check against, then, looping through each group when checking membership.

Needs different approaches for OpenLDAP and AD.

If an array is supplied, it will break backward compatibility with previous versions. To preserve this backward compatibility, the logic may have to check if the variable is a string or an array, then proceed to check either a single group (string) or multiple (from array).

[viharm]

Influences XatafaceLDAPauth issue #12

[viharm]

What about relation between each group name in the array supplied?

Should the user be a member of...

• any of the groups (OR logic), or
• all of the groups (AND logic)

... specified?

Perhaps the input should be a delimited string. The delimiter can be used to specify the logic. For example

Semantic delimiter:

• ; for OR logic
• , for AND logic

or, Mathematical delimiter

• + for OR logic
• * for AND logic