[IMPROVEMENT] Add support from OAuth LDAP for Group membership

[dave2wave]

It would be helpful if the client session and the underlying https://github.com/apache/infrastructure-oauth/blob/main/app/lib/ldap.py were enhanced to add a services array which returns the names of any cn groups where the user is a member and ou=groups,ou=services,dc=apache,dc=org.

The new service groups:
2. Chair (and Vice Chair)
4. Treasurer (and Assistants)
5. Ramp card holders (possible).

[gstein]

This came up in conversation, and I'll note that LDAP doesn't really have a way to ask "which groups for $user?". The LDAP question is "who is in $group?"

To return a list of groups for $user, then the subsystem will need to prefetch/cache the potential groups of interest (per the idea for a config file, in OP). Then on a query for each $user, it can look in those cached groups.

(and listen to pubsub to refresh)

[gstein]

Note: it appears that asfquart does a scan over "all" groups looking for group-inclusion. That is in quotes because "group" can occur in various parts of the overall LDAP schema. asfquart looks at specific areas of the schema, and I don't know if it scans "all" areas of interest.

[dave2wave]

I think that we should simply add a services array that has any cn that includes the user as a member of ou=groups,ou=services,dc=apache,dc=org

[dave2wave]

For example this includes secretary group: ou=groups,ou=services,dc=apache,dc=org

[dave2wave]

If we want to be limited then we should add specific groups to https://github.com/apache/infrastructure-oauth/blob/main/app/lib/ldap.py#L27-L35

1. Directors (removing special in BAT)
2. Secretary (removing special in BAT)
3. Chair (and Vice Chair) (also for BAT)
4. Treasurer (future use)
5. Ramp (future use)

[sebbASF]

An alternative might be to provide a list of groups for which membership info is needed.

This would avoid a full scan, but obviously would not be suitable for checking PMC membership.

[dave2wave]

I think that when we start putting MFA into production we should figure out how to get the groups we want those claims.