From a54d156bf094851ed3ca54822815ab387a319a6c Mon Sep 17 00:00:00 2001
From: Tuan Dang <dangtony98@gmail.com>
Date: Tue, 23 Apr 2024 21:16:55 -0700
Subject: [PATCH] Patch LDAP issue

---
 backend/src/ee/routes/v1/ldap-router.ts       | 59 ++++++++-----------
 .../src/ee/services/ldap-config/ldap-fns.ts   | 13 ++--
 .../src/services/auth/auth-login-service.ts   |  2 +-
 3 files changed, 36 insertions(+), 38 deletions(-)

diff --git a/backend/src/ee/routes/v1/ldap-router.ts b/backend/src/ee/routes/v1/ldap-router.ts
index 45ce332a2..48674abf3 100644
--- a/backend/src/ee/routes/v1/ldap-router.ts
+++ b/backend/src/ee/routes/v1/ldap-router.ts
@@ -103,41 +103,34 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
               : {})
           });
 
-          ldapClient.bind(ldapConfig.bindDN, ldapConfig.bindPass, (err) => {
-            if (err) {
+          const groupFilter = "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))";
+          const searchFilter =
+            ldapConfig.groupSearchFilter ||
+            groupFilter.replace("{{.Username}}", user.uid).replace("{{.UserDN}}", user.dn);
+
+          searchGroups(ldapClient, searchFilter, ldapConfig.groupSearchBase)
+            .then((groups) => {
               ldapClient.unbind();
-              return cb(err);
-            }
-
-            const groupFilter =
-              ldapConfig.groupSearchFilter ||
-              "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))";
-            const searchFilter = groupFilter.replace("{{.Username}}", user.uid).replace("{{.UserDN}}", user.dn);
-
-            searchGroups(ldapClient, searchFilter, ldapConfig.groupSearchBase)
-              .then((groups) => {
-                ldapClient.unbind();
-                return server.services.ldap.ldapLogin({
-                  ldapConfigId: ldapConfig.id,
-                  externalId: user.uidNumber,
-                  username: user.uid,
-                  firstName: user.givenName,
-                  lastName: user.sn,
-                  emails: user.mail ? [user.mail] : [],
-                  groups,
-                  relayState: ((req as unknown as FastifyRequest).body as { RelayState?: string }).RelayState,
-                  orgId: (req as unknown as FastifyRequest).ldapConfig.organization
-                });
-              })
-              .then(({ isUserCompleted, providerAuthToken }) => {
-                cb(null, { isUserCompleted, providerAuthToken });
-              })
-              .catch((err2) => {
-                ldapClient.unbind();
-                logger.error(err);
-                cb(err2, false);
+              return server.services.ldap.ldapLogin({
+                ldapConfigId: ldapConfig.id,
+                externalId: user.uidNumber,
+                username: user.uid,
+                firstName: user.givenName,
+                lastName: user.sn,
+                emails: user.mail ? [user.mail] : [],
+                groups,
+                relayState: ((req as unknown as FastifyRequest).body as { RelayState?: string }).RelayState,
+                orgId: (req as unknown as FastifyRequest).ldapConfig.organization
               });
-          });
+            })
+            .then(({ isUserCompleted, providerAuthToken }) => {
+              cb(null, { isUserCompleted, providerAuthToken });
+            })
+            .catch((err2) => {
+              ldapClient.unbind();
+              logger.error(err2);
+              cb(err2, false);
+            });
         } catch (error) {
           logger.error(error);
           return cb(error, false);
diff --git a/backend/src/ee/services/ldap-config/ldap-fns.ts b/backend/src/ee/services/ldap-config/ldap-fns.ts
index 748addea2..5fabb144b 100644
--- a/backend/src/ee/services/ldap-config/ldap-fns.ts
+++ b/backend/src/ee/services/ldap-config/ldap-fns.ts
@@ -14,19 +14,24 @@ export const searchGroups = async (
       },
       (err, res) => {
         if (err) {
-          reject(err);
+          return reject(err);
         }
 
         const groups: { dn: string; cn: string }[] = [];
 
         res.on("searchEntry", (entry) => {
-          groups.push({ dn: entry.object.dn, cn: entry.object.cn as string });
-        });
+          const dn = entry.dn.toString();
+          const regex = /cn=([^,]+)/;
+          const match = dn.match(regex);
+          // parse the cn from the dn
+          const cn = (match && match[1]) as string;
 
+          groups.push({ dn, cn });
+        });
         res.on("error", (error) => {
+          console.error(`error: ${error.message}`);
           reject(error);
         });
-
         res.on("end", () => {
           resolve(groups);
         });
diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts
index fa7439af8..5d81eaae1 100644
--- a/backend/src/services/auth/auth-login-service.ts
+++ b/backend/src/services/auth/auth-login-service.ts
@@ -191,7 +191,7 @@ export const authLoginServiceFactory = ({
       const decodedProviderToken = validateProviderAuthToken(providerAuthToken, email);
 
       authMethod = decodedProviderToken.authMethod;
-      if (isAuthMethodSaml(authMethod) && decodedProviderToken.orgId) {
+      if ((isAuthMethodSaml(authMethod) || authMethod === AuthMethod.LDAP) && decodedProviderToken.orgId) {
         organizationId = decodedProviderToken.orgId;
       }
     }