dn missing in attributes ?

まず modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php の229行目から始め、続いて、前にある ldap:AttributeAddFromLDAP 設定とレポート内の AttributeAddUsersGroups 設定を比較します。2つの authproc 呼び出しを使って警告を再現し、それらの間で渡される属性を調べます。DN ベースのグループ検索で missing-key warning が発生せず、期待されるグループが返されれば完了です。

I've got a simple authproc that calls ldap:AttributeAddUsersGroups to get the user's group information. Our LDAP is OpenLDAP that has groups with both groupOfNames and posixGroup objectclasses. So we have both uniqueMember and memberuid attributes our groups.

If I call that authproc like this - it works, the uid is used and matches the memberUid attribute:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'uid',
            'attribute.memberOf' => 'memberuid',
            'timeout' => 30,
       ],

However if I call it like this:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'dn',
            'attribute.memberOf' => 'uniquemember',
            'timeout' => 30,
       ],

I get an error telling me 'dn' is not found in the attributes array. So, I added another authproc call to ldap:AttributeAddFromLDAP to go specifically grab 'dn' for the user. To my knowledge 'dn' is always returned by LDAP searches, but I figured let's try this:

40 => [
             'class' => 'ldap:AttributeAddFromLDAP',
             'authsource' => 'ldap',
             'attributes' => ['dn'],
             'attribute.policy' => 'add',
             'search.filter' => '(cn=%cn%)',
       ],

Which itself works without error, but I still get the following on the very next call to 'ldap:AttributeAddUsersGroups' :

SimpleSAML\Error\Exception: Warning - Undefined array key "dn" at /usr/local/install/simplesamlphp/modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php:229

I can't find where or if 'dn' is somehow being filtered out but the attribute is definitely being returned by a search.

We'd like to switch to using the DN where we can but this has been a roadblock I can't figure out.