There are some problems in obtaining user groups through ldap authorization.

[zzzhouuu]

Hello, I'm running zot via docker, identity management platform use kanidm

authentication config:

{
  "auth": {
      "ldap": {
          "credentialsFile": "config-ldap-credentials.json",
          "address": "kanidm",
          "port": 3636,
          "insecure": false,
          "startTLS": false,
          "baseDN": "dc=id,dc=example,dc=com",
          "userAttribute": "uid",
          "userFilter": "(&(memberof=spn=zot_users@id.example.info,dc=id,dc=example,dc=com,dc=id,dc=example,dc=com)(objectclass=person))",
          "userGroupAttribute": "memberOf",
          "skipVerify": true,
          "subtreeSearch": true
      }
  }
}

There is no problem with all the authorization work, but through the permission judgment of the user group, it was found that it did not meet the overdue requirements. After obtaining the code, I changed the output as follows.

zot/pkg/api/ldap.go

Lines 225 to 228 in 30467e6

	if lc.UserGroupAttribute != "" && len(search.Entries[0].Attributes) > 0 {
	userAttributes := search.Entries[0].Attributes[0]
	userGroups = userAttributes.Values
	}

if lc.UserGroupAttribute != "" && len(search.Entries[0].Attributes) > 0 {
    userAttributes := search.Entries[0].Attributes[0]
    for _, attr := range search.Entries[0].Attributes {
	    lc.Log.Debug().Msg("attr: " + strings.Join(attr.Values, ", "))
    }
    userGroups = userAttributes.Values
    lc.Log.Debug().Msg("userGroups: " + strings.Join(userGroups, ", "))
}

output

{"level":"debug","goroutine":51,"caller":"zotregistry.dev/zot/pkg/api/ldap.go:231","time":"2025-03-22T06:30:28.767115+08:00","message":"attr: spn=username@id.example.info,dc=id,dc=example,dc=com"}

{"level":"debug","goroutine":51,"caller":"zotregistry.dev/zot/pkg/api/ldap.go:231","time":"2025-03-22T06:30:28.767221+08:00","message":"attr: spn=idm_people_self_mail_write@id.example.info,dc=id,dc=example,dc=com, spn=idm_all_persons@id.example.info,dc=id,dc=example,dc=com, spn=idm_all_accounts@id.example.info,dc=id,dc=example,dc=com, spn=idm_ui_enable_experimental_features@id.example.info,dc=id,dc=example,dc=com, spn=idm_people_self_name_write@id.example.info,dc=id,dc=example,dc=com, spn=nexus_users@id.example.info,dc=id,dc=example,dc=com, spn=zot_users@id.example.info,dc=id,dc=example,dc=com, spn=openwebui_users@id.example.info,dc=id,dc=example,dc=com, spn=immich_users@id.example.info,dc=id,dc=example,dc=com, spn=openwebui_admins@id.example.info,dc=id,dc=example,dc=com, spn=immich_admins@id.example.info,dc=id,dc=example,dc=com, spn=onedev_admins@id.example.info,dc=id,dc=example,dc=com, spn=zot_admins@id.example.info,dc=id,dc=example,dc=com, spn=nexus_admins@id.example.info,dc=id,dc=example,dc=com, spn=onedev_users@id.example.info,dc=id,dc=example,dc=com"}

{"level":"debug","goroutine":51,"caller":"zotregistry.dev/zot/pkg/api/ldap.go:234","time":"2025-03-22T06:30:28.767369+08:00","message":"userGroups: spn=username@id.example.info,dc=id,dc=example,dc=com"}

Maybe we should not only get the user group marked with 0 here, and all the data needs to be merged.

zot/pkg/api/ldap.go

Line 226 in 30467e6

userAttributes := search.Entries[0].Attributes[0]

[rchincha]

@zzzhouuu give us a PR and if possible also include a test to demonstrate this.