[FIX] LDAP sync removing users from channels when multiple groups are…

… mapped to it (#25434)

apps/meteor/ee/server/lib/ldap/Manager.ts

@@ -279,6 +279,8 @@ export class LDAPEEManager extends LDAPManager {
 
 		logger.debug('syncing user channels');
 		const ldapFields = Object.keys(fieldMap);
+		const channelsToAdd = new Set<string>();
+		const channelsToRemove = new Set<string>();
 
 		for await (const ldapField of ldapFields) {
 			if (!fieldMap[ldapField]) {
@@ -299,21 +301,34 @@ export class LDAPEEManager extends LDAPManager {
 						if (room.teamMain) {
 							logger.error(`Can't add user to channel ${channel} because it is a team.`);
 						} else {
-							addUserToRoom(room._id, user);
-							logger.debug(`Synced user channel ${room._id} from LDAP for ${username}`);
+							channelsToAdd.add(room._id);
 						}
 					} else if (syncUserChannelsRemove && !room.teamMain) {
-						const subscription = await SubscriptionsRaw.findOneByRoomIdAndUserId(room._id, user._id);
-						if (subscription) {
-							await removeUserFromRoom(room._id, user);
-						}
+						channelsToRemove.add(room._id);
 					}
 				} catch (e) {
 					logger.debug(`Failed to sync user room, user = ${username}, channel = ${channel}`);
 					logger.error(e);
 				}
 			}
 		}
+
+		for (const rid of channelsToAdd) {
+			addUserToRoom(rid, user);
+			logger.debug(`Synced user channel ${rid} from LDAP for ${username}`);
+		}
+
+		for await (const rid of channelsToRemove) {
+			if (channelsToAdd.has(rid)) {
+				return;
+			}
+
+			const subscription = await SubscriptionsRaw.findOneByRoomIdAndUserId(rid, user._id);
+			if (subscription) {
+				await removeUserFromRoom(rid, user);
+				logger.debug(`Removed user ${username} from channel ${rid}`);
+			}
+		}
 	}
 
 	private static async syncUserTeams(ldap: LDAPConnection, user: IUser, dn: string, isNewRecord: boolean): Promise<void> {