From 380aa26ea37000adc1bf5a92bf49d4496f0a8320 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20BERNARD?= Date: Wed, 7 Mar 2018 18:14:18 +0100 Subject: [PATCH 1/2] Fix the code to match the documentation. Permit for LDAP groups to be groupofuniquenames composed of uniquename (DN). For this, propose DN as group_search_filter_user_attribute and DN also for the member_of in the server.attributes section. DN is processed as a special attribute name which returns the LdapSearchResult.DN field instead of a member of attr array. --- pkg/login/ldap.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go index be3babac02e..3bb63a2c28e 100644 --- a/pkg/login/ldap.go +++ b/pkg/login/ldap.go @@ -404,9 +404,11 @@ func (a *ldapAuther) searchForUser(username string) (*LdapUserInfo, error) { var groupSearchResult *ldap.SearchResult for _, groupSearchBase := range a.server.GroupSearchBaseDNs { var filter_replace string - filter_replace = getLdapAttr(a.server.GroupSearchFilterUserAttribute, searchResult) + if a.server.GroupSearchFilterUserAttribute == "" { filter_replace = getLdapAttr(a.server.Attr.Username, searchResult) + } else { + filter_replace = getLdapAttr(a.server.GroupSearchFilterUserAttribute, searchResult) } filter := strings.Replace(a.server.GroupSearchFilter, "%s", ldap.EscapeFilter(filter_replace), -1) @@ -448,6 +450,9 @@ func (a *ldapAuther) searchForUser(username string) (*LdapUserInfo, error) { } func getLdapAttrN(name string, result *ldap.SearchResult, n int) string { + if name == "DN" { + return result.Entries[0].DN + } for _, attr := range result.Entries[n].Attributes { if attr.Name == name { if len(attr.Values) > 0 { From abef722265b0199133d64ccb683a0be00ab87a0a Mon Sep 17 00:00:00 2001 From: Dan Cech Date: Wed, 7 Mar 2018 14:41:05 -0500 Subject: [PATCH 2/2] Fix indent --- pkg/login/ldap.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go index 3bb63a2c28e..bc5fe13dba3 100644 --- a/pkg/login/ldap.go +++ b/pkg/login/ldap.go @@ -450,7 +450,7 @@ func (a *ldapAuther) searchForUser(username string) (*LdapUserInfo, error) { } func getLdapAttrN(name string, result *ldap.SearchResult, n int) string { - if name == "DN" { + if name == "DN" { return result.Entries[0].DN } for _, attr := range result.Entries[n].Attributes {