Skip to content

Commit 890d10c

Browse files
authored
Fix accidental overwriting of LDAP team memberships (#24050)
In the `for` loop, the value of `membershipsToAdd[org]` and `membershipsToRemove[org]` is a slice that should be appended instead of overwritten. Due to the current overwrite, the LDAP group sync only matches the last group at the moment. ## Example reproduction - an LDAP user is both a member of `cn=admin_staff,ou=people,dc=planetexpress,dc=com` and `cn=ship_crew,ou=people,dc=planetexpress,dc=com`. - configuration of `Map LDAP groups to Organization teams ` in `Authentication Sources`: ```json { "cn=admin_staff,ou=people,dc=planetexpress,dc=com":{ "test_organization":[ "admin_staff", "test_add" ] }, "cn=ship_crew,ou=people,dc=planetexpress,dc=com":{ "test_organization":[ "ship_crew" ] } ``` - start `Synchronize external user data` task in the `Dashboard`. - the user was only added for the team `test_organization.ship_crew`
1 parent 6a4be2c commit 890d10c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Diff for: services/auth/source/source_group_sync.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,11 @@ func resolveMappedMemberships(sourceUserGroups container.Set[string], sourceGrou
5252
isUserInGroup := sourceUserGroups.Contains(group)
5353
if isUserInGroup {
5454
for org, teams := range memberships {
55-
membershipsToAdd[org] = teams
55+
membershipsToAdd[org] = append(membershipsToAdd[org], teams...)
5656
}
5757
} else {
5858
for org, teams := range memberships {
59-
membershipsToRemove[org] = teams
59+
membershipsToRemove[org] = append(membershipsToRemove[org], teams...)
6060
}
6161
}
6262
}

0 commit comments

Comments
 (0)