Merge commit from fork

internal/idp/providers/ldap/session.go

@@ -169,11 +169,6 @@ func trySearchAndUserBind(
 
 	user := sr.Entries[0]
 	// Bind as the user to verify their password
-	_, err = ldap.ParseDN(user.DN)
-	if err != nil {
-		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user parse DN failed")
-		return nil, err
-	}
 	if err = conn.Bind(user.DN, password); err != nil {
 		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user bind failed")
 		return nil, ErrFailedLogin
@@ -218,9 +213,10 @@ func objectClassesToSearchQuery(classes []string) string {
 }
 
 func userFiltersToSearchQuery(filters []string, username string) []string {
+	escapedUsername := ldap.EscapeFilter(username)
 	searchQueries := make([]string, len(filters))
 	for i, filter := range filters {
-		searchQueries[i] = "(" + filter + "=" + username + ")"
+		searchQueries[i] = "(" + filter + "=" + escapedUsername + ")"
 	}
 	return searchQueries
 }

internal/idp/providers/ldap/session_test.go

@@ -75,6 +75,12 @@ func TestProvider_userFiltersToSearchQuery(t *testing.T) {
 			username: "user",
 			want:     []string{"(test1=user)", "(test2=user)", "(test3=user)", "(test4=user)", "(test5=user)"},
 		},
+		{
+			name:     "escaped",
+			fields:   []string{"test"},
+			username: "user)(*",
+			want:     []string{`(test=user\29\28\2a)`},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {