From 50895c7e372d81f550d28992fa44487f41cf2140 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Fri, 31 Jul 2015 16:38:41 +0200
Subject: [PATCH] fix(ldap): fixed issue with ldap group to grafana org role
 syncing, #1450

---
 pkg/login/ldap.go      |  2 ++
 pkg/login/ldap_test.go | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go
index abc3c6a587a..c476014ac0d 100644
--- a/pkg/login/ldap.go
+++ b/pkg/login/ldap.go
@@ -172,6 +172,7 @@ func (a *ldapAuther) syncOrgRoles(user *m.User, ldapUser *ldapUserInfo) error {
 		for _, org := range orgsQuery.Result {
 			if group.OrgId == org.OrgId {
 				match = true
+				break
 			}
 		}
 
@@ -181,6 +182,7 @@ func (a *ldapAuther) syncOrgRoles(user *m.User, ldapUser *ldapUserInfo) error {
 			if err := bus.Dispatch(&cmd); err != nil {
 				return err
 			}
+			break
 		}
 	}
 
diff --git a/pkg/login/ldap_test.go b/pkg/login/ldap_test.go
index 6713d0ca3fe..635e77d307c 100644
--- a/pkg/login/ldap_test.go
+++ b/pkg/login/ldap_test.go
@@ -178,6 +178,25 @@ func TestLdapAuther(t *testing.T) {
 			})
 		})
 
+		ldapAutherScenario("given multiple matching ldap groups and no existing groups", func(sc *scenarioContext) {
+			ldapAuther := NewLdapAuthenticator(&LdapServerConf{
+				LdapGroups: []*LdapGroupToOrgRole{
+					{GroupDN: "cn=admins", OrgId: 1, OrgRole: "Admin"},
+					{GroupDN: "*", OrgId: 1, OrgRole: "Viewer"},
+				},
+			})
+
+			sc.userOrgsQueryReturns([]*m.UserOrgDTO{})
+			err := ldapAuther.syncOrgRoles(&m.User{}, &ldapUserInfo{
+				MemberOf: []string{"cn=admins"},
+			})
+
+			Convey("Should take first match, and ignore subsequent matches", func() {
+				So(err, ShouldBeNil)
+				So(sc.addOrgUserCmd.Role, ShouldEqual, m.ROLE_ADMIN)
+			})
+		})
+
 	})
 }