Can't filter groups in Windows Active Directory (LDAP BindDN Authentication)

[ZantsuRocks]

Description

I'm trying to automate the organization and teams grouping with my LDAP authentication (Authentication is working fine) but the configuration to add Users to groups do not work.

Log states that the filter failed: 2023/03/21 11:17:21 ...dap/source_search.go:228:listLdapGroupMemberships() [E] [6419bc71] Failed group search in LDAP with filter [(&()(member=CN=User Teste,CN=Users,DC=agst,DC=com,DC=br))]: LDAP Result Code 201 "Filter Compile Error": ldap: error parsing filter
For what i see that empty &() in the filter start is the problem, i can't see any way to remove it in the UI.

If i search only (member=CN=User Teste,CN=Users,DC=agst,DC=com,DC=br) manually the groups are displayed correctly.

Gitea Version

1.19.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Git Version

2.39.1.windows.1

Operating System

Windows Server 2022 (20348.803)

How are you running Gitea?

AMD64 Binary From Git Releases Page

Database

SQLite

[ZantsuRocks]

Analyzing the listLdapGroupMemberships function code it have a boolean value to apply a group filter, the docs explain about that group filter, but this filter isn't present in the UI to set.

[ZantsuRocks]

Found the problem...

The bool value is WRONG when there is no text in the UI field Verify group membership in LDAP (leave the filter empty to skip)
When this field is empty applyGroupFilter should be FALSE

[svenseeberg]

Workaround: set "Verify group membership in LDAP" to (&).

[ZantsuRocks]

Workaround: set "Verify group membership in LDAP" to (&).

I was using (objectClass=group) as workaround, but (&) works as well.

[zeripath]

listLdapGroupMemberships

Do you mean that:

gitea/services/auth/source/ldap/source_search.go

Lines 211 to 213 in 22fec16

	if applyGroupFilter {
	searchFilter = fmt.Sprintf("(&(%s)(%s=%s))", groupFilter, source.GroupMemberUID, ldap.EscapeFilter(uid))
	} else {

should actually be:

 if applyGroupFilter && groupFilter != "" { 
 	searchFilter = fmt.Sprintf("(&(%s)(%s=%s))", groupFilter, source.GroupMemberUID, ldap.EscapeFilter(uid)) 
 } else { 

If so does the below patch solve the problem?

PATCH

diff --git a/services/auth/source/ldap/source_search.go b/services/auth/source/ldap/source_search.go
index 5a2d25b0c..2a61386ae 100644
--- a/services/auth/source/ldap/source_search.go
+++ b/services/auth/source/ldap/source_search.go
@@ -208,7 +208,7 @@ func (source *Source) listLdapGroupMemberships(l *ldap.Conn, uid string, applyGr
 	}
 
 	var searchFilter string
-	if applyGroupFilter {
+	if applyGroupFilter && groupFilter != "" {
 		searchFilter = fmt.Sprintf("(&(%s)(%s=%s))", groupFilter, source.GroupMemberUID, ldap.EscapeFilter(uid))
 	} else {
 		searchFilter = fmt.Sprintf("(%s=%s)", source.GroupMemberUID, ldap.EscapeFilter(uid))