[LDAP] user with one match in group filter becomes all mapping channels member and has all mapping roles (not assigned to him).

Description:

i do mapping roles and channels for users.
for testing purposes i do simple filter for check against one group "iw-office-wifi".
(&(samaccountname=#{username})(memberof=CN=iw-office-wifi,ou=groups,dc=company,dc=com))

i do mapping for roles and groups:
(i have no default RC groups in LDAP)

roles map:
{ "rocket-admin": "admin", "tech-support": "support" }
channel map:
{ "iw-office-wifi": "iwifi", "IW IT Team": "iwit", "employee": "general", "techsupport": [ "helpdesk", "support" ] }
turn on "sync ldap users with channels"

i do sync, and i have all users of "iw-office-wifi" in all channels from mapping and all users has role "admin" in their profiles.

log from RC:
`
сен 26 01:21:44 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in rocket-admin group.
сен 26 01:21:44 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in iw-office-wifi group.
сен 26 01:21:44 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in IW IT Team group.
сен 26 01:21:44 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in employee group.
сен 26 01:21:44 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in techsupport group.
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ debug tstuser is in techsupport group.
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user group admin from LDAP for tstuser
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user channel cXJ2ccxJdE2hhzynG from LDAP for tstuser
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user channel K8v8qvQQ85rsfbSzF from LDAP for tstuser
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user channel GENERAL from LDAP for tstuser
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user channel c5yfCY8b54HtrQmAB from LDAP for tstuser
сен 26 01:21:45 wbr rocketchat[28922]: LDAPSync ➔ info Synced user channel Lk3z5bQ8qnXKjBGAA from LDAP for tstuser

`

Steps to reproduce:

1. install rocket chat
2. do ldap sync
3. do group sync
4. do mapping
5. run synchronization.
6. see a result.

Expected behavior:

each user has assigned role.
each channel has assigned users.

Actual behavior:

all users with one match in group filter has all roles and joins in all channels.

Server Setup Information:

• Version of Rocket.Chat Server:
  all i used:
  3.3.3 3.4.3 3.5.0 3.5.1 3.5.2 3.5.3 3.5.4 3.6.0 3.6.1 3.6.2

• Operating System:
  debian linux 10

• Deployment Method:
  tar

• Number of Running Instances:
  2 (i have two servers: testing and production. confirmed on both).

• DB Replicaset Oplog:

• NodeJS Version:
  Node v12.14.0

• MongoDB Version:
  Mongo 4.0.19

• RocketChat
  Current used: 3.6.2

Client Setup Information

• Desktop App or Browser Version:
  all

• Operating System:
  all

Start by reproducing the LDAP group synchronization with the reported role and channel mappings, then trace the LDAP sync and group-mapping entry points. Done means users receive only the roles and channels assigned by their matching LDAP groups, rather than every mapped role and channel.