Reject user as 403 if not part of a oidc connector group

[rvirdiz]

Hi,

I am looking for users returned from dex userSearch parameter, should not be allowed to login/authenticate if groupSearch parameter returns empty ldap group list.

Following are my dex logs, when user tries to login user dex ldap connector:

time="2020-06-15T19:40:55Z" level=info msg="performing ldap search ou=users,dc=example,dc=com sub (&(objectClass=posixAccount)(uid=myldapuser))"
time="2020-06-15T19:40:55Z" level=info msg="username \"myldapuser\" mapped to entry uid=myldapuser,ou=users,dc=example,dc=com"
time="2020-06-15T19:40:55Z" level=info msg="performing ldap search 
cn=kubeflow,ou=groups,dc=example,dc=com sub (&(objectClass=posixGroup)(memberUid=myldapuser))"
time="2020-06-15T19:40:55Z" level=info msg="login successful: connector \"ldap\", username=\"LDAP_user\", preferred_username=\"\", email=\"myldapuser@example.com\", groups=[\"kubeflow\"]"

In above logs, is there any way LDAP user "myldapuser" should not be allowed to login if not part of any groupSearch filter, groups=[].
Just want to avoid LDAP userSearch users to authenticate which are not part of whitelisted LDAP groups in groupSearch filter.

Originally posted by @rvirdiz in #1612 (comment)

[rvirdiz]

#1612 (comment)