check query strings have correct bracketing

a broken loginfilter might otherwise cause the ldap query to hang.

while (&(objectclass=person))(|(mail=%uid)(samaccountname=%uid))) looks ok at first glance actually only (&(objectclass=person)) will be used. using ldapsearch on the cli the queryparsing will end with a bad request error. if you use occ ldap:search it will hang. might be caused by ad.

the correct string in this case is missing a (& at the beginning: (&(&(objectclass=person))(|(mail=%uid)(samaccountname=%uid))).

The ugly part is that there is no errer message whatsoever anywhere ... if you manually add ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7); to the LDAP::preFunctionCall() you can get the query parsing on the cli.

@dercorn can you add a config that was broken? or send it to me and I'll clean it up to only show the problematic entries.

see https://tools.ietf.org/search/rfc2254#section-4 for a ABNF for parsing the filter

Start at LDAP::preFunctionCall() and trace how the login filter is assembled and passed to LDAP. Reproduce the malformed filter with ldapsearch and occ ldap:search, using LDAP debug output and the RFC 2254 grammar as references. Done means malformed bracketing is detected with an actionable error instead of a parser failure or hang.