From 795bc70546310f1079bf8f0c27d34d0f239df803 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <rhaferkamp@owncloud.com>
Date: Wed, 14 Dec 2022 12:07:21 +0100
Subject: [PATCH] Add a more explict filter to DN based lookups

To make sure to read the right type of object
---
 services/graph/pkg/identity/ldap.go      | 24 ++++++++++++++++++++----
 services/graph/pkg/identity/ldap_test.go |  8 ++++----
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/services/graph/pkg/identity/ldap.go b/services/graph/pkg/identity/ldap.go
index ea879e6be6..99bbbbec8d 100644
--- a/services/graph/pkg/identity/ldap.go
+++ b/services/graph/pkg/identity/ldap.go
@@ -303,7 +303,14 @@ func (i *LDAP) getUserByDN(dn string) (*ldap.Entry, error) {
 		i.userAttributeMap.mail,
 		i.userAttributeMap.userName,
 	}
-	return i.getEntryByDN(dn, attrs)
+
+	filter := fmt.Sprintf("(objectClass=%s)", i.userObjectClass)
+
+	if i.userFilter != "" {
+		filter = fmt.Sprintf("(&%s(%s))", filter, i.userFilter)
+	}
+
+	return i.getEntryByDN(dn, attrs, filter)
 }
 
 func (i *LDAP) getGroupByDN(dn string) (*ldap.Entry, error) {
@@ -311,13 +318,22 @@ func (i *LDAP) getGroupByDN(dn string) (*ldap.Entry, error) {
 		i.groupAttributeMap.id,
 		i.groupAttributeMap.name,
 	}
-	return i.getEntryByDN(dn, attrs)
+	filter := fmt.Sprintf("(objectClass=%s)", i.groupObjectClass)
+
+	if i.groupFilter != "" {
+		filter = fmt.Sprintf("(&%s(%s))", filter, i.groupFilter)
+	}
+	return i.getEntryByDN(dn, attrs, filter)
 }
 
-func (i *LDAP) getEntryByDN(dn string, attrs []string) (*ldap.Entry, error) {
+func (i *LDAP) getEntryByDN(dn string, attrs []string, filter string) (*ldap.Entry, error) {
+	if filter == "" {
+		filter = "(objectclass=*)"
+	}
+
 	searchRequest := ldap.NewSearchRequest(
 		dn, ldap.ScopeBaseObject, ldap.NeverDerefAliases, 1, 0, false,
-		"(objectclass=*)",
+		filter,
 		attrs,
 		nil,
 	)
diff --git a/services/graph/pkg/identity/ldap_test.go b/services/graph/pkg/identity/ldap_test.go
index b442a90654..5c206431a3 100644
--- a/services/graph/pkg/identity/ldap_test.go
+++ b/services/graph/pkg/identity/ldap_test.go
@@ -318,14 +318,14 @@ func TestGetGroup(t *testing.T) {
 	sr2 := &ldap.SearchRequest{
 		BaseDN:     "uid=user,ou=people,dc=test",
 		SizeLimit:  1,
-		Filter:     "(objectclass=*)",
+		Filter:     "(objectClass=inetOrgPerson)",
 		Attributes: []string{"displayname", "entryUUID", "mail", "uid"},
 		Controls:   []ldap.Control(nil),
 	}
 	sr3 := &ldap.SearchRequest{
 		BaseDN:     "uid=invalid,ou=people,dc=test",
 		SizeLimit:  1,
-		Filter:     "(objectclass=*)",
+		Filter:     "(objectClass=inetOrgPerson)",
 		Attributes: []string{"displayname", "entryUUID", "mail", "uid"},
 		Controls:   []ldap.Control(nil),
 	}
@@ -413,14 +413,14 @@ func TestGetGroups(t *testing.T) {
 	sr2 := &ldap.SearchRequest{
 		BaseDN:     "uid=user,ou=people,dc=test",
 		SizeLimit:  1,
-		Filter:     "(objectclass=*)",
+		Filter:     "(objectClass=inetOrgPerson)",
 		Attributes: []string{"displayname", "entryUUID", "mail", "uid"},
 		Controls:   []ldap.Control(nil),
 	}
 	sr3 := &ldap.SearchRequest{
 		BaseDN:     "uid=invalid,ou=people,dc=test",
 		SizeLimit:  1,
-		Filter:     "(objectclass=*)",
+		Filter:     "(objectClass=inetOrgPerson)",
 		Attributes: []string{"displayname", "entryUUID", "mail", "uid"},
 		Controls:   []ldap.Control(nil),
 	}