From 61e2056ef4d718cca07ab980fcf16542b62cd282 Mon Sep 17 00:00:00 2001
From: Hugo <10965479+hugoghx@users.noreply.github.com>
Date: Thu, 9 May 2024 14:46:57 +0100
Subject: [PATCH] fix(auth/ldap): Take user attrs into account when
 authenticating

---
 internal/auth/ldap/repository_authenticate.go | 20 +++++++++-
 .../auth/ldap/repository_authenticate_test.go | 38 +++++++++++++++++++
 2 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/internal/auth/ldap/repository_authenticate.go b/internal/auth/ldap/repository_authenticate.go
index 4ce6c510b..b289006ec 100644
--- a/internal/auth/ldap/repository_authenticate.go
+++ b/internal/auth/ldap/repository_authenticate.go
@@ -108,11 +108,27 @@ func (r *Repository) Authenticate(ctx context.Context, authMethodId, loginName,
 	acct.Dn = authResult.UserDN
 
 	if authResult.UserAttributes != nil {
-		found, email := caseInsensitiveAttributeSearch(DefaultEmailAttribute, authResult.UserAttributes)
+		emailAttr := DefaultEmailAttribute
+		fullNameAttr := DefaultFullNameAttribute
+
+		attrMaps, err := am.convertAccountAttributeMaps(ctx)
+		if err == nil {
+			for _, attrMap := range attrMaps {
+				aam := attrMap.(*AccountAttributeMap)
+				if aam.ToAttribute == DefaultEmailAttribute {
+					emailAttr = aam.FromAttribute
+				}
+				if aam.ToAttribute == DefaultFullNameAttribute {
+					fullNameAttr = aam.FromAttribute
+				}
+			}
+		}
+
+		found, email := caseInsensitiveAttributeSearch(emailAttr, authResult.UserAttributes)
 		if found {
 			acct.Email = email[0]
 		}
-		found, fullName := caseInsensitiveAttributeSearch(DefaultFullNameAttribute, authResult.UserAttributes)
+		found, fullName := caseInsensitiveAttributeSearch(fullNameAttr, authResult.UserAttributes)
 		if found {
 			acct.FullName = fullName[0]
 		}
diff --git a/internal/auth/ldap/repository_authenticate_test.go b/internal/auth/ldap/repository_authenticate_test.go
index 4d5ca67d2..f28728e5f 100644
--- a/internal/auth/ldap/repository_authenticate_test.go
+++ b/internal/auth/ldap/repository_authenticate_test.go
@@ -63,12 +63,26 @@ func TestRepository_authenticate(t *testing.T) {
 		WithGroupDn(testCtx, testdirectory.DefaultGroupDN),
 	)
 
+	testAmAccAttrs := TestAuthMethod(t, testConn, orgDbWrapper, org.PublicId,
+		[]string{fmt.Sprintf("ldaps://%s:%d", td.Host(), td.Port())},
+		WithCertificates(testCtx, tdCerts...),
+		WithDiscoverDn(testCtx),
+		WithEnableGroups(testCtx),
+		WithUserDn(testCtx, testdirectory.DefaultUserDN),
+		WithGroupDn(testCtx, testdirectory.DefaultGroupDN),
+		WithAccountAttributeMap(testCtx, map[string]AccountToAttribute{
+			"fn": "fullName",
+			"at": "email",
+		}),
+	)
+
 	const (
 		testLoginName = "alice"
 		testPassword  = "password"
 	)
 
 	testAccount := TestAccount(t, testConn, testAm, testLoginName)
+	testAccountAccAttrs := TestAccount(t, testConn, testAmAccAttrs, testLoginName)
 
 	groups := []*gldap.Entry{
 		testdirectory.NewGroup(t, "admin", []string{"alice"}),
@@ -98,6 +112,8 @@ func TestRepository_authenticate(t *testing.T) {
 			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),
+			gldap.NewEntryAttribute("fn", []string{"test-fn"}),
+			gldap.NewEntryAttribute("at", []string{"testat@email.com"}),
 		)
 	}
 	td.SetUsers(users...)
@@ -137,6 +153,28 @@ func TestRepository_authenticate(t *testing.T) {
 				return a
 			},
 		},
+		{
+			name:         "success-with-account-acc-attrs",
+			ctx:          testCtx,
+			repo:         testRepo,
+			authMethodId: testAmAccAttrs.PublicId,
+			loginName:    testAccountAccAttrs.LoginName,
+			password:     testPassword,
+			want: func(got *Account) *Account {
+				a := &Account{Account: &store.Account{
+					AuthMethodId:   testAmAccAttrs.PublicId,
+					ScopeId:        testAccountAccAttrs.ScopeId,
+					PublicId:       testAccountAccAttrs.PublicId,
+					Version:        testAccountAccAttrs.Version,
+					Dn:             "cn=alice,ou=people,dc=example,dc=org",
+					Email:          "testat@email.com",
+					FullName:       "test-fn",
+					LoginName:      "alice",
+					MemberOfGroups: "[\"cn=admin,ou=groups,dc=example,dc=org\"]",
+				}}
+				return a
+			},
+		},
 		{
 			name:         "success-new-account-with-no-groups",
 			ctx:          testCtx,