Merge pull request #10970 from mmolnar/master

ldap: allow use of DN in group_search_filter_user_attribute and member_of

pkg/login/ldap.go

@@ -308,6 +308,10 @@ func (a *ldapAuther) searchForUser(username string) (*LdapUserInfo, error) {
 			} else {
 				filter_replace = getLdapAttr(a.server.GroupSearchFilterUserAttribute, searchResult)
 			}
+			if a.server.GroupSearchFilterUserAttribute == "dn" {
+				filter_replace = searchResult.Entries[0].DN
+			}
+
 			filter := strings.Replace(a.server.GroupSearchFilter, "%s", ldap.EscapeFilter(filter_replace), -1)
 
 			a.log.Info("Searching for user's groups", "filter", filter)
@@ -330,7 +334,11 @@ func (a *ldapAuther) searchForUser(username string) (*LdapUserInfo, error) {
 
 			if len(groupSearchResult.Entries) > 0 {
 				for i := range groupSearchResult.Entries {
-					memberOf = append(memberOf, getLdapAttrN(a.server.Attr.MemberOf, groupSearchResult, i))
+					if a.server.Attr.MemberOf == "dn" {
+						memberOf = append(memberOf, groupSearchResult.Entries[i].DN)
+					} else {
+						memberOf = append(memberOf, getLdapAttrN(a.server.Attr.MemberOf, groupSearchResult, i))
+					}
 				}
 				break
 			}