fix: IAM LDAP access key import bug (#19608)

When importing access keys (i.e. service accounts) for LDAP accounts,
we are requiring groups to exist under one of the configured group base
DNs. This is not correct. This change fixes this by only checking for
existence and storing the normalized form of the group DN - we do not
return an error if the group is not under a base DN.

Test is updated to illustrate an import failure that would happen
without this change.

internal/config/identity/ldap/ldap.go

@@ -86,7 +86,7 @@ func (l *Config) GetValidatedDNForUsername(username string) (string, error) {
 		// the directory.
 		bindDN, err := l.LDAP.LookupUserDN(conn, username)
 		if err != nil {
-			if strings.Contains(err.Error(), "not found") {
+			if strings.Contains(err.Error(), "User DN not found for") {
 				return "", nil
 			}
 			return "", fmt.Errorf("Unable to find user DN: %w", err)
@@ -94,30 +94,36 @@ func (l *Config) GetValidatedDNForUsername(username string) (string, error) {
 		return bindDN, nil
 	}
 
-	// Since the username is a valid DN, check that it is under a configured
-	// base DN in the LDAP directory.
-	return l.GetValidatedUserDN(conn, username)
+	// Since the username parses as a valid DN, check that it exists and is
+	// under a configured base DN in the LDAP directory.
+	validDN, isUnderBaseDN, err := l.GetValidatedUserDN(conn, username)
+	if err == nil && !isUnderBaseDN {
+		return "", fmt.Errorf("Unable to find user DN: %w", err)
+	}
+	return validDN, err
 }
 
-// GetValidatedUserDN validates the given user DN. Will error out if conn is nil.
-func (l *Config) GetValidatedUserDN(conn *ldap.Conn, userDN string) (string, error) {
+// GetValidatedUserDN validates the given user DN. Will error out if conn is nil. The returned
+// boolean is true iff the user DN is found under one of the LDAP user base DNs.
+func (l *Config) GetValidatedUserDN(conn *ldap.Conn, userDN string) (string, bool, error) {
 	return l.GetValidatedDNUnderBaseDN(conn, userDN, l.LDAP.UserDNSearchBaseDistNames)
 }
 
 // GetValidatedGroupDN validates the given group DN. If conn is nil, creates a
-// connection.
-func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (string, error) {
+// connection. The returned boolean is true iff the group DN is found under one
+// of the configured LDAP base DNs.
+func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (string, bool, error) {
 	if conn == nil {
 		var err error
 		conn, err = l.LDAP.Connect()
 		if err != nil {
-			return "", err
+			return "", false, err
 		}
 		defer conn.Close()
 
 		// Bind to the lookup user account
 		if err = l.LDAP.LookupBind(conn); err != nil {
-			return "", err
+			return "", false, err
 		}
 	}
 
@@ -128,22 +134,30 @@ func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (string, e
 // and returns the DN value sent by the LDAP server. The value returned by the
 // server may not be equal to the input DN, as LDAP equality is not a simple
 // Golang string equality. However, we assume the value returned by the LDAP
-// server is canonical.
+// server is canonical. Additionally, the attribute type names in the DN are
+// lower-cased.
 //
-// If the DN is not found in the LDAP directory, the returned string is empty
-// and err = nil.
-func (l *Config) GetValidatedDNUnderBaseDN(conn *ldap.Conn, dn string, baseDNList []xldap.BaseDNInfo) (string, error) {
+// Return values:
+//
+// If the DN is found, the normalized (string) value is returned and error is
+// nil.
+//
+// If the DN is not found, the string returned is empty and the error is nil.
+//
+// The returned boolean is true iff the DN is found under one of the LDAP
+// subtrees listed in `baseDNList`.
+func (l *Config) GetValidatedDNUnderBaseDN(conn *ldap.Conn, dn string, baseDNList []xldap.BaseDNInfo) (string, bool, error) {
 	if len(baseDNList) == 0 {
-		return "", errors.New("no Base DNs given")
+		return "", false, errors.New("no Base DNs given")
 	}
 
 	// Check that DN exists in the LDAP directory.
 	validatedDN, err := xldap.LookupDN(conn, dn)
 	if err != nil {
-		return "", fmt.Errorf("Error looking up DN %s: %w", dn, err)
+		return "", false, fmt.Errorf("Error looking up DN %s: %w", dn, err)
 	}
 	if validatedDN == "" {
-		return "", nil
+		return "", false, nil
 	}
 
 	// This will not return an error as the argument is validated to be a DN.
@@ -153,10 +167,12 @@ func (l *Config) GetValidatedDNUnderBaseDN(conn *ldap.Conn, dn string, baseDNLis
 	// directory.
 	for _, baseDN := range baseDNList {
 		if baseDN.Parsed.AncestorOf(pdn) {
-			return validatedDN, nil
+			return validatedDN, true, nil
 		}
 	}
-	return "", fmt.Errorf("DN %s is not under any configured base DN", validatedDN)
+
+	// Not under any configured base DN so return false.
+	return validatedDN, false, nil
 }
 
 // Bind - binds to ldap, searches LDAP and returns the distinguished name of the