outposts/ldap: improve parsing of LDAP filters

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

internal/outpost/ldap/instance_search_user.go

@@ -6,17 +6,13 @@ import (
 	"goauthentik.io/api"
 )
 
-func parseFilterForUser(req api.ApiCoreUsersListRequest, filter string) api.ApiCoreUsersListRequest {
-	f, err := ldap.CompileFilter(filter)
-	if err != nil {
-		return req
-	}
+func parseFilterForUser(req api.ApiCoreUsersListRequest, f *ber.Packet) api.ApiCoreUsersListRequest {
 	switch f.Tag {
 	case ldap.FilterEqualityMatch:
 		return parseFilterForUserSingle(req, f)
 	case ldap.FilterAnd:
 		for _, child := range f.Children {
-			req = parseFilterForUserSingle(req, child)
+			req = parseFilterForUser(req, child)
 		}
 		return req
 	}
@@ -24,15 +20,35 @@ func parseFilterForUser(req api.ApiCoreUsersListRequest, filter string) api.ApiC
 }
 
 func parseFilterForUserSingle(req api.ApiCoreUsersListRequest, f *ber.Packet) api.ApiCoreUsersListRequest {
-	v := f.Children[1].Value.(string)
-	switch f.Children[0].Value.(string) {
-	case "cn":
-		return req.Username(v)
-	case "name":
-	case "displayName":
-		return req.Name(v)
-	case "mail":
-		return req.Email(v)
+	// We can only handle key = value pairs here
+	if len(f.Children) < 2 {
+		return req
+	}
+	k := f.Children[0].Value
+	// Ensure key is string
+	if _, ok := k.(string); !ok {
+		return req
+	}
+	v := f.Children[1].Value
+	// Null values are ignored
+	if v == nil {
+		return req
+	}
+	// Switch on type of the value, then check the key
+	switch vv := v.(type) {
+	case string:
+		switch k {
+		case "cn":
+			return req.Username(vv)
+		case "name":
+		case "displayName":
+			return req.Name(vv)
+		case "mail":
+			return req.Email(vv)
+		}
+	// TODO: Support int
+	default:
+		return req
 	}
 	return req
 }