LDAP group filter (authentication source) it not recursive

[Saaha]

• Gitea version (or commit ref): 1.14.2
• Git version: 2.25.1
• Operating system: Ubuntu 20.04.2 LTS, installed from deb package, running with systemctl
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
• Log gist:
  No log.

Description

Hi,

It seems LDAP group filter (verify Group membership) in authentication sources, precisely the field Valid Groups Filter is not recursive. I have a group configured, but it does not valid the user if he is in a sub group below.

I suggest to add an option below to allow recursive search in all valid patterns if checked.

Screenshots

[markkrj]

If you're using Active Directory, you could disable the Verify group membership in LDAP option and setup a user filter, like:
(&(objectclass=user)(memberof:1.2.840.113556.1.4.1941:=cn=group,ou=groups,dc=example,dc=com))
If not using AD, group traversal must be done by the client (Gitea server in this case), as most LDAP providers do not implement LDAP_MATCHING_RULE_IN_CHAIN (I think only MS AD does).

IMHO, this option of verifying groups is useless in current state of Gitea, as there is no group implementation in Gitea, and therefore no LDAP group synchronization.

[bdleedy]

Thanks for this explanation. The documentation does not differentiate why you might use user filter vs ldap group membership. Sticking with the working user filter.