Document LDAP group CN requirements for Negotiate roles

[Copilot]

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Document that LDAP group memberships become role claims based solely on each group’s common name (CN). Organizational-unit and other distinguished-name components are not preserved, so role authorization does not support duplicate CNs across organizational units.

Description

• API documentation: Add remarks to both EnableLdap overloads describing the CN-based role projection and its uniqueness requirement.
• Maintenance guidance: Add an inline comment at the claim collection point preserving the documented contract.
• Compatibility: Keep existing role values, cache contents, runtime behavior, and public API signatures unchanged.

options.EnableLdap("example.com");
// LDAP group "CN=Administrators,OU=Groups,DC=example,DC=com"
// becomes the "Administrators" role claim.

• Fixes Document LDAP group common-name requirements for Negotiate role claims #69023

[Copilot]

🟢 Approval recommended

The change is documentation/comment-only, preserves runtime behavior, and clearly communicates the existing CN-based role claim behavior.

Pull request overview

This PR documents an important behavioral detail of Negotiate’s LDAP claim resolution: group memberships are projected to role claims using only the group common name (CN), and distinguished-name scope (such as organizational units) is not retained—so duplicate CNs across OUs cannot be disambiguated for role authorization.

Changes:

• Adds <remarks> to both NegotiateOptions.EnableLdap overloads describing CN-based role claim projection and its uniqueness limitation.
• Adds an inline maintainer comment in LdapAdapter reinforcing the CN-only contract at the point claims are collected.

File summaries

File	Description
src/Security/Authentication/Negotiate/src/NegotiateOptions.cs	Adds XML doc remarks to both EnableLdap overloads documenting CN-only LDAP group-to-role mapping and its limitations.
src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs	Adds an inline comment clarifying that only CN is used for emitted role claim values.

Review details

Suppressed comments (1)

src/Security/Authentication/Negotiate/src/NegotiateOptions.cs:75

• Same as the other EnableLdap overload: use standard LDAP terms (OU/DN) and avoid contractions/hyphenation in the API remarks for clarity and consistency.

    /// <remarks>
    /// LDAP group memberships are represented as role claims using each group's common name (CN) as the role value.
    /// Organizational-unit and other distinguished-name components aren't preserved. Role-based authorization with
    /// duplicate group CNs across organizational units isn't supported.
    /// </remarks>

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.