Switch to new repository golib/auth/userinfo.

[rgooch]

No description provided.

[cviecco]

While this would work, the interface you need for ldap groups in general needs also a group filter see: https://github.com/Cloud-Foundations/keymaster/blob/d003619c9bde950e5935ce8f74bcdc2b4b327a45/lib/authutil/authutil.go#L294. To prevent future changes to the api for the ldap userinfo can you also add those to the library so that when we fix the library we dont need to backport much?

[rgooch]

Which API are you suggesting to change? I think the generic interface should not change.
Are you suggesting adding parameters to userinfo/ldap.New? That's OK in principle.
I note that the Keymaster code seems more complicated. Why is the Cloud-Gate group lookup code simpler?

If we're considering changing the API, how about removing the pointer for the groupPrefix parameter to the GetUserGroups method? Also, I'd prefer to remove that parameter entirely and just have a tiny support function that performs this operation. It feels like the wrong layer the way it is now.

Another suggested API change is to return a map[string]struct{} rather than []string, and again have a utility function that converts to []string if the caller needs it.

[cviecco]

We need a way to filter groups at the server side.. a group filter (generic) would be OK for the ldap backend. But I agree that the removal of the groupprefix would be the right thing to do. The correct implementation actually the one one from keymaster.

[rgooch]

I have restored the LDAP group search and filtering capability.
Since this PR removes the memberOf:mail attribute filtering and instead relies on group search base DNs and filter, this is not a backwards-compatible change, so I've bump the release to 1.0.0 (about time).

PTAL.

[cviecco]

in the case of having a GroupPrefix.. wont this make a new filter wrapping the filtered data already?

[rgooch]

rawUserInfo does not have a group prefix filter already. I've abstracted that functionality into a common package so that the low-level implementations don't have to duplicate that.