LDAP: No longer shows incorrectly matching groups based on role in debug page

[xlson]

What this PR does / why we need it:

No longer show all groups that gives a specific Org Role for a user that gets that role from one of them.

Which issue(s) this PR fixes:

Fixes #20016

Special notes for your reviewer:

[torkelo]

I think we can simplify the code a bit by combining the to for loops:

So instead of looping over config groups then user groups (nested), and then user groups again. Should be the same as below:

	orgRoles := []LDAPRoleDTO{}

	for _, userGroup := range user.Groups {
		matches := false

		for _, configGroup := range serverConfig.Groups {
			if configGroup.GroupDN == userGroup {
				r := &LDAPRoleDTO{GroupDN: configGroup.GroupDN, OrgId: configGroup.OrgId, OrgRole: configGroup.OrgRole}
				orgRoles = append(orgRoles, *r)
				matches = true
				break
			}
		}

		if !matches {
			r := &LDAPRoleDTO{GroupDN: userGroup}
			orgRoles = append(orgRoles, *r)
		}
	}

[xlson]

@torkelo As we match groups based on the order of configs in the toml file I don't think we can do it quite this cleanly (thanks for pointing this out @gotjosh). It seems we need to match based on the toml config as only the first matching role for an org will be used. (We could consider choosing to show the others as matching as well if we have a way to signify that they are being shadowed by the first match). If we choose to iterate based on the user's groups we wouldn't know what the first match was.

I've rewritten the code in a way that seems to match what the real LDAP mapping code is doing. It doesn't look great though as it ends up with a for -> if -> for cycle. I'll see if it's possible to clean that up a bit tomorrow. I am wondering if it would be possible to expose more meta-data about the mappings from the LDAP code rather than re-creating the logic here.

[torkelo]

Regarding the fact that only the first match is used (per org). Not sure what is best here. Not showing "Match" and listing them as "No Match" feels wrong as well as it might give the impression that the group is specified wrongly in the ldap toml. As long as we list them in the same way as they mappings are specified in the toml file so that the used match & role is first then maybe that is best?

We should probably change so the order or mappings is not used and that the highest role/permission instead wins. (But not in this PR).

[xlson]

I agree, showing as No Match is very confusing. Yeah, that might be for the best. We could add an info icon with an explain that only the first match is used.

I agree. While the it is working now makes it possible to create more creative configuration, I think it's likely that we're paying too much for that power by making our code more complicated and the LDAP config harder to understand.

[torkelo]

Looks good