fix(ldap managed grp): allow ldap managed grps to be added as principals (#3361)

CHANGELOG.md

@@ -20,6 +20,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   the `ids` parameter. In 0.15.0 the ability to add new grants via the `id`
   parameter will be removed.
 
+### Bug Fixes
+
+* LDAP managed groups: adding a principal to a role now works properly when it's
+  an LDAP managed group. ([PR](https://github.com/hashicorp/boundary/pull/3361))
+
 ## 0.13 (2023/06/13)
 
 ### New and Improved

internal/daemon/controller/handlers/roles/role_service.go

@@ -979,7 +979,8 @@ func validateAddRolePrincipalsRequest(req *pbs.AddRolePrincipalsRequest) error {
 	for _, id := range req.GetPrincipalIds() {
 		if !handlers.ValidId(handlers.Id(id), globals.GroupPrefix) &&
 			!handlers.ValidId(handlers.Id(id), globals.UserPrefix) &&
-			!handlers.ValidId(handlers.Id(id), globals.OidcManagedGroupPrefix) {
+			!handlers.ValidId(handlers.Id(id), globals.OidcManagedGroupPrefix) &&
+			!handlers.ValidId(handlers.Id(id), globals.LdapManagedGroupPrefix) {
 			badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids."
 			break
 		}

internal/daemon/controller/handlers/roles/role_service_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/ldap"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -1037,6 +1038,9 @@ func TestAddPrincipal(t *testing.T) {
 		oidc.WithApiUrl(oidc.TestConvertToUrls(t, "https://www.alice.com/callback")[0]),
 	)
 
+	ldapAuthMethod := ldap.TestAuthMethod(t, conn, databaseWrapper, o.PublicId, []string{"ldaps://ldap1"})
+	ldapManagedGroup := ldap.TestManagedGroup(t, conn, ldapAuthMethod, []string{"admin"})
+
 	users := []*iam.User{
 		iam.TestUser(t, iamRepo, o.GetPublicId()),
 		iam.TestUser(t, iamRepo, o.GetPublicId()),
@@ -1130,6 +1134,14 @@ func TestAddPrincipal(t *testing.T) {
 			addManagedGroups:    []string{managedGroups[1].GetPublicId(), managedGroups[1].GetPublicId()},
 			resultManagedGroups: []string{managedGroups[0].GetPublicId(), managedGroups[1].GetPublicId()},
 		},
+		{
+			name: "Add ldap managed group on populated role",
+			setup: func(r *iam.Role) {
+				iam.TestManagedGroupRole(t, conn, r.GetPublicId(), managedGroups[0].GetPublicId())
+			},
+			addManagedGroups:    []string{ldapManagedGroup.GetPublicId()},
+			resultManagedGroups: []string{managedGroups[0].GetPublicId(), ldapManagedGroup.GetPublicId()},
+		},
 		{
 			name:     "Add invalid u_recovery on role",
 			setup:    func(r *iam.Role) {},

internal/iam/repository_principal_role.go

@@ -610,6 +610,11 @@ func splitPrincipals(ctx context.Context, principals []string) (users, groups, m
 				managedGroups = make([]string, 0, len(principals))
 			}
 			managedGroups = append(managedGroups, principal)
+		case strings.HasPrefix(principal, globals.LdapManagedGroupPrefix):
+			if managedGroups == nil {
+				managedGroups = make([]string, 0, len(principals))
+			}
+			managedGroups = append(managedGroups, principal)
 		default:
 			return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("invalid principal ID %q", principal))
 		}