The external_id template can be specified using external_id_tuples. Each
tuple list the attributes to concatenante to build the external id.
Attributes are urlencode then joined using a space character. If you add
the ':unquote' suffix to an attribute name it will not be urlencoded,
but you must be sure it's always an ASCII string without any space.
The new setting clean_external_id_on_update indicate to clean all other
existing external id for an user after linking the user to an external
id.
All use of UserExternalId is supported by the default configuration of:
external_id_tuples=(('dn:unquote',),),
to migrate to a new way of building the external id just define:
external_id_tuple=(('my', 'new', 'tuple), ('dn:unquote',)),
The first tuple is used to canonicalize the external id of a found or
newly created user. The other tuples are only used to lookup existing
users, so that you can safely migrate from an old way of building the
external_id to a new one.
On AD the following configuration gives a permanent external id:
external_id_tuple=(('objectGUID',),)
On OpenLDAP:
external_id_tuple=(('entryUUID',),)
Benjamin Dauvergne
6c20a1a064