diff --git a/internal/outpost/ldap/instance_bind.go b/internal/outpost/ldap/instance_bind.go index 62d133b33..42f0fb93e 100644 --- a/internal/outpost/ldap/instance_bind.go +++ b/internal/outpost/ldap/instance_bind.go @@ -75,7 +75,7 @@ func (pi *ProviderInstance) Bind(username string, req BindRequest) (ldap.LDAPRes pi.boundUsersMutex.Lock() cs := pi.SearchAccessCheck(userInfo.User) pi.boundUsers[req.BindDN] = UserFlags{ - UserInfo: userInfo.User, + UserPk: userInfo.User.Pk, CanSearch: cs != nil, } if pi.boundUsers[req.BindDN].CanSearch { @@ -88,7 +88,7 @@ func (pi *ProviderInstance) Bind(username string, req BindRequest) (ldap.LDAPRes } // SearchAccessCheck Check if the current user is allowed to search -func (pi *ProviderInstance) SearchAccessCheck(user api.User) *string { +func (pi *ProviderInstance) SearchAccessCheck(user api.UserSelf) *string { for _, group := range user.Groups { for _, allowedGroup := range pi.searchAllowedGroups { pi.log.WithField("userGroup", group.Pk).WithField("allowedGroup", allowedGroup).Trace("Checking search access") diff --git a/internal/outpost/ldap/instance_search.go b/internal/outpost/ldap/instance_search.go index b0d52b61e..657ecce67 100644 --- a/internal/outpost/ldap/instance_search.go +++ b/internal/outpost/ldap/instance_search.go @@ -11,9 +11,17 @@ import ( "goauthentik.io/api" ) -func (pi *ProviderInstance) SearchMe(user api.User) (ldap.ServerSearchResult, error) { +func (pi *ProviderInstance) SearchMe(req SearchRequest, f UserFlags) (ldap.ServerSearchResult, error) { + if f.UserInfo == nil { + u, _, err := pi.s.ac.Client.CoreApi.CoreUsersRetrieve(req.ctx, f.UserInfo.Pk).Execute() + if err != nil { + req.log.WithError(err).Warning("Failed to get user info") + return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Failed to get userinfo") + } + f.UserInfo = &u + } entries := make([]*ldap.Entry, 1) - entries[0] = pi.UserEntry(user) + entries[0] = pi.UserEntry(*f.UserInfo) return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil } @@ -42,7 +50,7 @@ func (pi *ProviderInstance) Search(req SearchRequest) (ldap.ServerSearchResult, } if !flags.CanSearch { pi.log.Debug("User can't search, showing info about user") - return pi.SearchMe(flags.UserInfo) + return pi.SearchMe(req, flags) } accsp.Finish() diff --git a/internal/outpost/ldap/ldap.go b/internal/outpost/ldap/ldap.go index 74bbc71f3..6d7a72c7b 100644 --- a/internal/outpost/ldap/ldap.go +++ b/internal/outpost/ldap/ldap.go @@ -39,7 +39,8 @@ type ProviderInstance struct { } type UserFlags struct { - UserInfo api.User + UserInfo *api.User + UserPk int32 CanSearch bool }