outposts/ldap: move virtual groups to other OU for lookups, conditionally skip requests based on search filter

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

internal/outpost/ldap/instance_search_group.go

@@ -7,52 +7,62 @@ import (
 	"goauthentik.io/api"
 )
 
-func parseFilterForGroup(req api.ApiCoreGroupsListRequest, f *ber.Packet) api.ApiCoreGroupsListRequest {
+func parseFilterForGroup(req api.ApiCoreGroupsListRequest, f *ber.Packet, skip bool) (api.ApiCoreGroupsListRequest, bool) {
 	switch f.Tag {
 	case ldap.FilterEqualityMatch:
 		return parseFilterForGroupSingle(req, f)
 	case ldap.FilterAnd:
 		for _, child := range f.Children {
-			req = parseFilterForGroup(req, child)
+			r, s := parseFilterForGroup(req, child, skip)
+			skip = skip || s
+			req = r
 		}
-		return req
+		return req, skip
 	}
-	return req
+	return req, skip
 }
 
-func parseFilterForGroupSingle(req api.ApiCoreGroupsListRequest, f *ber.Packet) api.ApiCoreGroupsListRequest {
+func parseFilterForGroupSingle(req api.ApiCoreGroupsListRequest, f *ber.Packet) (api.ApiCoreGroupsListRequest, bool) {
 	// We can only handle key = value pairs here
 	if len(f.Children) < 2 {
-		return req
+		return req, false
 	}
 	k := f.Children[0].Value
 	// Ensure key is string
 	if _, ok := k.(string); !ok {
-		return req
+		return req, false
 	}
 	v := f.Children[1].Value
 	// Null values are ignored
 	if v == nil {
-		return req
+		return req, false
 	}
 	// Switch on type of the value, then check the key
 	switch vv := v.(type) {
 	case string:
 		switch k {
 		case "cn":
-			return req.Name(vv)
+			return req.Name(vv), false
 		case "member":
+			fallthrough
 		case "memberOf":
 			userDN, err := goldap.ParseDN(vv)
 			if err != nil {
-				return req
+				return req.MembersByUsername([]string{vv}), false
 			}
 			username := userDN.RDNs[0].Attributes[0].Value
-			return req.MembersByUsername([]string{username})
+			// If the DN's first ou is virtual-groups, ignore this filter
+			if len(userDN.RDNs) > 1 {
+				if userDN.RDNs[1].Attributes[0].Value == VirtualGroupsOU || userDN.RDNs[1].Attributes[0].Value == GroupsOU {
+					// Since we know we're not filtering anything, skip this request
+					return req, true
+				}
+			}
+			return req.MembersByUsername([]string{username}), false
 		}
 	// TODO: Support int
 	default:
-		return req
+		return req, false
 	}
-	return req
+	return req, false
 }