fix: authenticate LDAP via actual DN instead of normalized DN (#19805)

fix: authenticate LDAP via actual DN instead of normalized DN

Normalized DN is only for internal representation, not for
external communication, any communication to LDAP must be
based on actual user DN. LDAP servers do not understand
normalized DN.

fixes #19757

cmd/sftp-server.go

@@ -248,8 +248,9 @@ func startSFTPServer(args []string) {
 						return nil, errAuthentication
 					}
 					criticalOptions := map[string]string{
-						ldapUser:  targetUser,
-						ldapUserN: c.User(),
+						ldapUser:       targetUser,
+						ldapActualUser: lookupResult.ActualDN,
+						ldapUserN:      c.User(),
 					}
 					for attribKey, attribValue := range lookupResult.Attributes {
 						// we skip multi-value attributes here, as they cannot