From 84cc3a59881bdbc4735be27a59ebdc16cb3210d2 Mon Sep 17 00:00:00 2001
From: Jim <jlambert@hashicorp.com>
Date: Mon, 26 Jun 2023 17:05:54 -0400
Subject: [PATCH] fix(ldap managed grp): allow ldap managed grps to be added as
 principals (#3361)

---
 CHANGELOG.md                                         |  5 +++++
 .../daemon/controller/handlers/roles/role_service.go |  3 ++-
 .../controller/handlers/roles/role_service_test.go   | 12 ++++++++++++
 internal/iam/repository_principal_role.go            |  5 +++++
 4 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb1ff6e1d..76fbed8b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   the `ids` parameter. In 0.15.0 the ability to add new grants via the `id`
   parameter will be removed.
 
+### Bug Fixes
+
+* LDAP managed groups: adding a principal to a role now works properly when it's
+  an LDAP managed group. ([PR](https://github.com/hashicorp/boundary/pull/3361))
+
 ## 0.13 (2023/06/13)
 
 ### New and Improved
diff --git a/internal/daemon/controller/handlers/roles/role_service.go b/internal/daemon/controller/handlers/roles/role_service.go
index a223de4f9..28b4b1887 100644
--- a/internal/daemon/controller/handlers/roles/role_service.go
+++ b/internal/daemon/controller/handlers/roles/role_service.go
@@ -979,7 +979,8 @@ func validateAddRolePrincipalsRequest(req *pbs.AddRolePrincipalsRequest) error {
 	for _, id := range req.GetPrincipalIds() {
 		if !handlers.ValidId(handlers.Id(id), globals.GroupPrefix) &&
 			!handlers.ValidId(handlers.Id(id), globals.UserPrefix) &&
-			!handlers.ValidId(handlers.Id(id), globals.OidcManagedGroupPrefix) {
+			!handlers.ValidId(handlers.Id(id), globals.OidcManagedGroupPrefix) &&
+			!handlers.ValidId(handlers.Id(id), globals.LdapManagedGroupPrefix) {
 			badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids."
 			break
 		}
diff --git a/internal/daemon/controller/handlers/roles/role_service_test.go b/internal/daemon/controller/handlers/roles/role_service_test.go
index cfe6f0954..0c4303cdc 100644
--- a/internal/daemon/controller/handlers/roles/role_service_test.go
+++ b/internal/daemon/controller/handlers/roles/role_service_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/ldap"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -1037,6 +1038,9 @@ func TestAddPrincipal(t *testing.T) {
 		oidc.WithApiUrl(oidc.TestConvertToUrls(t, "https://www.alice.com/callback")[0]),
 	)
 
+	ldapAuthMethod := ldap.TestAuthMethod(t, conn, databaseWrapper, o.PublicId, []string{"ldaps://ldap1"})
+	ldapManagedGroup := ldap.TestManagedGroup(t, conn, ldapAuthMethod, []string{"admin"})
+
 	users := []*iam.User{
 		iam.TestUser(t, iamRepo, o.GetPublicId()),
 		iam.TestUser(t, iamRepo, o.GetPublicId()),
@@ -1130,6 +1134,14 @@ func TestAddPrincipal(t *testing.T) {
 			addManagedGroups:    []string{managedGroups[1].GetPublicId(), managedGroups[1].GetPublicId()},
 			resultManagedGroups: []string{managedGroups[0].GetPublicId(), managedGroups[1].GetPublicId()},
 		},
+		{
+			name: "Add ldap managed group on populated role",
+			setup: func(r *iam.Role) {
+				iam.TestManagedGroupRole(t, conn, r.GetPublicId(), managedGroups[0].GetPublicId())
+			},
+			addManagedGroups:    []string{ldapManagedGroup.GetPublicId()},
+			resultManagedGroups: []string{managedGroups[0].GetPublicId(), ldapManagedGroup.GetPublicId()},
+		},
 		{
 			name:     "Add invalid u_recovery on role",
 			setup:    func(r *iam.Role) {},
diff --git a/internal/iam/repository_principal_role.go b/internal/iam/repository_principal_role.go
index 743e2e048..8e5de88a8 100644
--- a/internal/iam/repository_principal_role.go
+++ b/internal/iam/repository_principal_role.go
@@ -610,6 +610,11 @@ func splitPrincipals(ctx context.Context, principals []string) (users, groups, m
 				managedGroups = make([]string, 0, len(principals))
 			}
 			managedGroups = append(managedGroups, principal)
+		case strings.HasPrefix(principal, globals.LdapManagedGroupPrefix):
+			if managedGroups == nil {
+				managedGroups = make([]string, 0, len(principals))
+			}
+			managedGroups = append(managedGroups, principal)
 		default:
 			return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("invalid principal ID %q", principal))
 		}