Document how to do authenticator maps with ldap

[ikke-t]

Is your feature request related to a problem? Please describe.

Based on examples here, I don't know how to do authenticator map using LDAP.

Describe the solution you'd like
write an example how to do ldap is_superuser map, and example of ldap group type mapping.

Describe alternatives you've considered
hitting my head to wall

Additional context

[ikke-t]

As this remains undocumented, I paste here my setup as reference how to set Red Hat IDM (freeipa) as auth source for AAP:

Note that there is another issue that might get you stuck. The cn= and dc= parts are case sensitive. So if you bang your head to wall for the third day, try lowercasing them all.

gateway_authenticators:
  - name: Local Database Authenticator
    order: 1
    type: ansible_base.authentication.authenticator_plugins.local
    slug: local-database-authenticator
    configuration: {}
    enabled: true
    create_objects: true
    remove_users: false
  - name: Red Hat IdM
    order: 2
    type: ansible_base.authentication.authenticator_plugins.ldap
    slug: redhat-idm
    enabled: true
    configuration:
      SERVER_URI:
        - "ldap://{{ ipaserver_master_fqdn }}"
      START_TLS: false
      BIND_DN: uid={{ aap_ldap_bind_username }},cn=sysaccounts,cn=etc,dc=eu,dc=arrow,dc=lab
      BIND_PASSWORD: "{{ vault_aap_ldap_password }}"
      GROUP_TYPE: "MemberDNGroupType"
      GROUP_TYPE_PARAMS:
        name_attr: "cn"
        member_attr: "member"
      USER_SEARCH:
        - 'cn=users,cn=accounts,dc=eu,dc=arrow,dc=lab'
        - 'SCOPE_SUBTREE'
        - '(uid=%(user)s)'
      GROUP_SEARCH:
        - 'cn=groups,cn=accounts,dc=eu,dc=arrow,dc=lab'
        - 'SCOPE_SUBTREE'
        - '(objectClass=posixgroup)'
      USER_ATTR_MAP:
        first_name: "givenName"
        last_name: "sn"
        email: "mail"

gateway_authenticator_maps:
  - name: AAP admin
    authenticator: Red Hat IdM
    revoke: true
    map_type: is_superuser
    triggers:
      groups:
        has_or:
          - cn=admins,cn=groups,cn=accounts,dc=eu,dc=arrow,dc=lab

  - name: Red Hat associate
    authenticator: Red Hat IdM
    revoke: true
    map_type: organization
    organization: Red Hat
    role: Organization Admin
    triggers:
      always: {}
      never: {}
      groups:
        has_or:
         - cn=rhops,cn=groups,cn=accounts,dc=eu,dc=arrow,dc=lab

  - name: Arrow Ops
    authenticator: Red Hat IdM
    revoke: true
    map_type: organization
    organization: Arrow
    role: Organization Admin
    triggers:
      groups:
        has_or:
         - cn=arrowops,cn=groups,cn=accounts,dc=eu,dc=arrow,dc=lab

  - name: Arrow associate
    authenticator: Red Hat IdM
    revoke: true
    map_type: organization
    organization: Arrow
    role: Organization Member
    triggers:
      groups:
        has_or:
         - cn=arrow,cn=groups,cn=accounts,dc=eu,dc=arrow,dc=lab

[ivarmu]

Just to add more information, this PR is related in some way with this: redhat-cop/aap_configuration_extended#124 . It is providing a playbook and a role to upgrade the configs from AAP <= 2.4 formats to AAP >= 2.5 formats. There are examples of how to define Authenticators and role mapping for both LDAP and SAML.