LDAP - remove user from security group

[wmoore]

If a user is removed from the LDAP security group used to create their OMERO account, they can still log in:

​https://www.openmicroscopy.org/community/viewtopic.php?f=4&t=748

The user_filter property should (optionally?) be applied on every login.

Note: In discussions with Ola, there are at least two issues that this solution will not cover:

1. since the original DN is stored in OMERO, there is the possibility that it will become out of sync, e.g. if the user changes his/her OMERO username. The current plan will be to signal an InternalException to the user.
2. this will only work for LDAP configurations in which group membership is a property on the user so that it can be filtered via omero.ldap.user_filter. In cases where group membership is a property of the groups, then we will need to rework how group_filter and new_user_group interact.

[wmoore]

If there's anything we can suggest to the user just now (see forum), please go ahead on the forum.

[jmoore]

As mentioned on the forum, this should be just a matter of re-checking against the filter on every login. I'll add that logic and then pass to Ola for testing. We can decide from there if we want to add any configuration options to maintain the previous logic, or to make the "user in a group" logic easier to implement.

[jmoore]

Output when logging in with mismatched DNs:

~/git/dist $ bin/omero login foo@localhost
Password:
Internal error. Please contact your administrator:
DNs don't match: '' and 'cn=foo,o=example'
Password: