Second question - Is there an easy way to integrate Datahub with LDAP? I found only this issue so far and it didn't help

hey! you can certainly integrate using LDAP integrated with JAAS authentication. some docs around auth including how to set up JAAS authentication is here: https://datahubproject.io/docs/authentication and we even have a specific config example for LDAP talking about how to update your jaas.conf file for the protocol: https://datahubproject.io/docs/datahub-frontend/#authentication

well, can I ask for a more detailed example? e.g. I have the following config:

bindDN: CN=Datahub,CN=Users,DC=ad,DC=dev,DC=company,DC=io
      bindPW: securepassword
      groupSearch:
        baseDN: OU=Group,DC=ad,DC=dev,DC=company,DC=io
        groupAttr: member
        nameAttr: name
        userAttr: distinguishedName
      host: <http://ad.dev.company.io:389|ad.dev.company.io:389>
      insecureNoSSL: true
      userSearch:
        baseDN: CN=Users,DC=ad,DC=dev,DC=company,DC=io
        emailAttr: mail
        idAttr: cn
        nameAttr: name
        username: cn

what should I set in jaas.conf then?

so this isn't my area of expertise, but in the second link I believe our docs say you can use the following in jaas.conf for LDAP auth:

WHZ-Authentication {
  com.sun.security.auth.module.LdapLoginModule sufficient
  userProvider="ldaps://<host>:636/dc=<domain>"
  authIdentity="{USERNAME}"
  userFilter="(&(objectClass=person)(uid={USERNAME}))"
  java.naming.security.authentication="simple"
  debug="false"
  useSSL="true";
};

I think there's no password field

hmm honestly I'm not very positive here. is there a hard requirement on using LDAP for you and your org? is it possible to use OIDC instead?

we need either google authentication or LDA and LDAP is strongly preferred

The auth identity should not change unless you want usernames to be like email addresses. The example looks like its for openldap which has a different schema then say Microsoft AD. The references to uid and person indicate unix ldap of some sort. Based on your information it looks like you’re using a Microsoft AD and you have ssl disabled. There is no password because authentication works by using the provided username and password for the user to search for its own identity. I am not an expert with this however Microsoft AD might look something like this for your case. Notice the references to Microsofts’ samAccountName instead of uid which is not required for AD.

WHZ-Authentication {
  com.sun.security.auth.module.LdapLoginModule sufficient
  userProvider="ldap://<host>:389/dc=ad,dc=dev,dc=company,dc=io"
  authIdentity="{USERNAME}"
  userFilter="(&(|(samAccountName={USERNAME})(userPrincipalName={USERNAME})(cn={USERNAME}))(objectClass=user))"
  java.naming.security.authentication="simple"
  debug="false"
  useSSL="true";
};