feat(ldap): per-user exclude/denylist filter for sync

Add a per-username denylist so individual accounts (service accounts like administrator, krbtgt, guest, ldap$) can be excluded from LDAP sync, independent of the group/OU include-filter which only scopes the search. - schema: LdapConfig.userExcludeList String[] (+ migration) - sync: skip excluded usernames (case-insensitive) before recording the DN, so an already-imported user added to the list gets deactivated next sync - DTO / config service / controller / scheduler: thread userExcludeList through - web: exclude-list admin UI section (add/remove/save) + de/en translations - tests: 3 specs covering empty list, case-insensitive skip, deactivation Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-14 09:34:01 +02:00
parent ef3e41769e
commit 9d1323fe97
11 changed files with 283 additions and 1 deletions
@@ -325,6 +325,15 @@
        "selected": "Selected",
        "emptyMeansAll": "No selection - imports every user under the base DN.",
        "save": "Save filter"
+      },
+      "userExclude": {
+        "title": "Exclude users (denylist)",
+        "description": "Individual usernames that are never imported - e.g. service accounts like administrator, krbtgt, guest or ldap$. Applies on top of the group/OU filter.",
+        "username": "Username",
+        "add": "Add",
+        "excluded": "Excluded",
+        "empty": "None excluded - every discovered user is imported.",
+        "save": "Save exclude list"
      }
    }
  },