fix: only search LDAP group by name

[sdwilsh]

Description

Searching an LDAP group by entryUUID does not make a lot of sense. This change drops that query.

Related Issue

• Fixes LDAP searches can return weird matches based on an ID match #1673

Motivation and Context

As described in the related Issue, my LDAP backend, LLDAP does not support a substring query on entryUUID, and actually returns an error that completely breaks my ability to add anyone to a Space.

This is a breaking change if anybody actually depended on this behavior, but as @rhafer pointed out in the related Issue, other LDAP servers like OpenLDAP doesn't support this query either (but fail with no results), so it is dependent upon the LDAP server that is being used.

How Has This Been Tested?

• cd services/graph/pkg/identity && go test

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation added

[micbar]

@rhafer FYI

[rhafer]

@sdwilsh Thanks a lot for your contribution!

This is a breaking change if anybody actually depended on this behavior, but as @rhafer pointed out in the related Issue, other LDAP servers like OpenLDAP doesn't support this query either (but fail with no results), so it is dependent upon the LDAP server that is being used.

Actually this is not a breaking change. According to the LDAP Standards the UUID Syntax (as used for any UUID valued attribute) does not have a substring matching rule defined. So any substring filter for an attribute of a UUID type evaluates to undefined. And for the concrete filter that means that it will be ignored because it is ORed with another filter. (at least on a standards conform LDAP server). I removed the Breaking Change marker.

Additionally adding the GroupId to the filter for the group search seems to have been a bug from the beginning. Did doesn't really makes senses.

[rhafer]

Thanks again for submitting this fix. It's highly appreciated!