dn missing in attributes ?

I've got a simple authproc that calls ldap:AttributeAddUsersGroups to get the user's group information. Our LDAP is OpenLDAP that has groups with both groupOfNames and posixGroup objectclasses. So we have both uniqueMember and memberuid attributes our groups.

If I call that authproc like this - it works, the uid is used and matches the memberUid attribute:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'uid',
            'attribute.memberOf' => 'memberuid',
            'timeout' => 30,
       ],

However if I call it like this:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'dn',
            'attribute.memberOf' => 'uniquemember',
            'timeout' => 30,
       ],

I get an error telling me 'dn' is not found in the attributes array. So, I added another authproc call to ldap:AttributeAddFromLDAP to go specifically grab 'dn' for the user. To my knowledge 'dn' is always returned by LDAP searches, but I figured let's try this:

40 => [
             'class' => 'ldap:AttributeAddFromLDAP',
             'authsource' => 'ldap',
             'attributes' => ['dn'],
             'attribute.policy' => 'add',
             'search.filter' => '(cn=%cn%)',
       ],

Which itself works without error, but I still get the following on the very next call to 'ldap:AttributeAddUsersGroups' :

SimpleSAML\Error\Exception: Warning - Undefined array key "dn" at /usr/local/install/simplesamlphp/modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php:229

I can't find where or if 'dn' is somehow being filtered out but the attribute is definitely being returned by a search.

We'd like to switch to using the DN where we can but this has been a roadblock I can't figure out.

Beginne mit modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php in Zeile 229 und vergleiche anschließend die vorangehende ldap:AttributeAddFromLDAP-Konfiguration mit den AttributeAddUsersGroups-Einstellungen im Report. Reproduziere die Warnung mithilfe der beiden authproc-Aufrufe und untersuche die zwischen ihnen übergebenen Attribute. Als erledigt gilt es, wenn die gruppenbasierte Suche anhand des DN keine Warnung über einen fehlenden Schlüssel mehr auslöst und die erwarteten Gruppen zurückgibt.