add deprecation notice for LDAP username format (#12849)

docs/sts/ldap.md

@@ -73,7 +73,7 @@ The two supported modes of LDAP configuration differ in how the MinIO server der
 
 Once a unique DN for the user is derived, the server verifies the user's credentials with the LDAP server and on success, looks up the user's groups via a configured group search query and finally temporary object storage credentials are generated and returned.
 
-#### Lookup-Bind Mode ####
+#### Lookup-Bind Mode (Recommended) ####
 
 In this mode, the a low-privilege read-only LDAP service account is configured in the MinIO server by providing the account's Distinguished Name (DN) and password. It is the new and preferred mode for LDAP integration.
 
@@ -99,7 +99,7 @@ In case 1 above, any active STS credentials or MinIO service accounts belonging
 
 In case 2 above, access policies available to the credential are updated to reflect the change - i.e. they will lose any privileges associated with a group they are removed from, and gain any privileges associated with a group they are added to.
 
-#### Username-Format Mode ####
+#### Username-Format Mode (Deprecated) ####
 
 In this mode, the server does not use a separate LDAP service account. Instead, the username and password provided in the STS API call are used to login to the LDAP server and also to lookup the user's groups. This mode preserves older behavior for compatibility, but users are encouraged to use the Lookup-Bind mode. Some newer features may not be available in this mode of operation.
 

internal/config/identity/ldap/config.go

@@ -586,7 +586,7 @@ func Lookup(kvs config.KVS, rootCAs *x509.CertPool) (l Config, err error) {
 	l.ServerAddr = ldapServer
 	l.stsExpiryDuration = defaultLDAPExpiry
 	if v := env.Get(EnvSTSExpiry, kvs.Get(STSExpiry)); v != "" {
-		logger.Info("DEPRECATION WARNING: Support for configuring the default LDAP credentials expiry duration will be removed in a future release. Please use the `DurationSeconds` parameter in the LDAP STS API instead.")
+		logger.Info("DEPRECATION WARNING: Support for configuring the default LDAP credentials expiry duration will be removed by October 2021. Please use the `DurationSeconds` parameter in the LDAP STS API instead.")
 		expDur, err := time.ParseDuration(v)
 		if err != nil {
 			return l, errors.New("LDAP expiry time err:" + err.Error())
@@ -642,20 +642,23 @@ func Lookup(kvs config.KVS, rootCAs *x509.CertPool) (l Config, err error) {
 	// Username format configuration.
 	if v := env.Get(EnvUsernameFormat, kvs.Get(UsernameFormat)); v != "" {
 		if !strings.Contains(v, "%s") {
-			return l, errors.New("LDAP username format doesn't have '%s' substitution")
+			return l, errors.New("LDAP username format does not support '%s' substitution")
 		}
 		l.UsernameFormats = strings.Split(v, dnDelimiter)
 	}
 
-	// Either lookup bind mode or username format is supported, but not
+	if len(l.UsernameFormats) > 0 {
-	// both.
+		logger.Info("DEPRECATION WARNING: Support for %s will be removed by October 2021, please migrate your LDAP settings to lookup bind mode", UsernameFormat)
+	}
+
+	// Either lookup bind mode or username format is supported, but not both.
 	if l.isUsingLookupBind && len(l.UsernameFormats) > 0 {
 		return l, errors.New("Lookup Bind mode and Username Format mode are not supported at the same time")
 	}
 
 	// At least one of bind mode or username format must be used.
 	if !l.isUsingLookupBind && len(l.UsernameFormats) == 0 {
-		return l, errors.New("Either Lookup Bind mode or Username Format mode is required.")
+		return l, errors.New("Either Lookup Bind mode or Username Format mode is required")
 	}
 
 	// Test connection to LDAP server.

internal/config/identity/ldap/help.go

@@ -62,7 +62,7 @@ var (
 		},
 		config.HelpKV{
 			Key:         UsernameFormat,
-			Description: `";" separated list of username bind DNs e.g. "uid=%s,cn=accounts,dc=myldapserver,dc=com"`,
+			Description: `[DEPRECATED] ";" separated list of username bind DNs e.g. "uid=%s,cn=accounts,dc=myldapserver,dc=com"`,
 			Optional:    true,
 			Type:        "list",
 			Sensitive:   true,