From 7b95750dcf1d18930035586a66567939b91b969f Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Sun, 23 Jun 2019 12:38:11 +0200
Subject: [PATCH] added LDAP config to set filter for finding user attributes
 (#877)

---
 src/DependencyInjection/Configuration.php       | 1 +
 src/Ldap/LdapManager.php                        | 3 +--
 tests/DependencyInjection/AppExtensionTest.php  | 1 +
 tests/DependencyInjection/ConfigurationTest.php | 1 +
 tests/Ldap/LdapManagerTest.php                  | 1 +
 5 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index 19c970a7..f42c8272 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -570,6 +570,7 @@ class Configuration implements ConfigurationInterface
                                 ->thenInvalid('The ldap.user.filter must be enclosed by a matching number of parentheses "()" and must NOT contain a "%%s" replacer')
                             ->end()
                         ->end()
+                        ->scalarNode('attributesFilter')->defaultValue('(objectClass=*)')->end()
                         ->scalarNode('usernameAttribute')->defaultValue('uid')->end()
                         ->arrayNode('attributes')
                             ->defaultValue([])
diff --git a/src/Ldap/LdapManager.php b/src/Ldap/LdapManager.php
index 1a8ebbe4..b3ed97f4 100644
--- a/src/Ldap/LdapManager.php
+++ b/src/Ldap/LdapManager.php
@@ -106,7 +106,6 @@ class LdapManager
     public function updateUser(User $user)
     {
         $baseDn = $user->getPreferenceValue('ldap.dn');
-        $filter = '(objectClass=*)';
 
         if (null === $baseDn) {
             throw new LdapDriverException('This account is not a registered LDAP user');
@@ -119,7 +118,7 @@ class LdapManager
         }
         $user->setPreferenceValue('ldap.dn', $baseDn);
 
-        $entries = $this->driver->search($baseDn, $filter);
+        $entries = $this->driver->search($baseDn, $this->params['attributesFilter']);
 
         if ($entries['count'] > 1) {
             throw new LdapDriverException('This search must only return a single user');
diff --git a/tests/DependencyInjection/AppExtensionTest.php b/tests/DependencyInjection/AppExtensionTest.php
index 85e2dcb3..e2660b94 100644
--- a/tests/DependencyInjection/AppExtensionTest.php
+++ b/tests/DependencyInjection/AppExtensionTest.php
@@ -138,6 +138,7 @@ class AppExtensionTest extends TestCase
                     'baseDn' => null,
                     'filter' => '',
                     'usernameAttribute' => 'uid',
+                    'attributesFilter' => '(objectClass=*)',
                     'attributes' => [],
                 ],
                 'role' => [
diff --git a/tests/DependencyInjection/ConfigurationTest.php b/tests/DependencyInjection/ConfigurationTest.php
index 2b3cf1c6..b28ff9f2 100644
--- a/tests/DependencyInjection/ConfigurationTest.php
+++ b/tests/DependencyInjection/ConfigurationTest.php
@@ -198,6 +198,7 @@ class ConfigurationTest extends TestCase
                 'baseDn' => '',
                 'filter' => '',
                 'usernameAttribute' => 'uid',
+                'attributesFilter' => '(objectClass=*)',
                 'attributes' => [],
             ],
             'role' => [
diff --git a/tests/Ldap/LdapManagerTest.php b/tests/Ldap/LdapManagerTest.php
index 7864b8ae..8fbba51f 100644
--- a/tests/Ldap/LdapManagerTest.php
+++ b/tests/Ldap/LdapManagerTest.php
@@ -43,6 +43,7 @@ class LdapManagerTest extends TestCase
                 'attributes' => [],
                 'filter' => '(&(objectClass=inetOrgPerson))',
                 'usernameAttribute' => 'uid',
+                'attributesFilter' => '(objectClass=*)',
                 'baseDn' => 'ou=users, dc=kimai, dc=org',
             ],
             'role' => $roleConfig,