dn missing in attributes ?

I've got a simple authproc that calls ldap:AttributeAddUsersGroups to get the user's group information. Our LDAP is OpenLDAP that has groups with both groupOfNames and posixGroup objectclasses. So we have both uniqueMember and memberuid attributes our groups.

If I call that authproc like this - it works, the uid is used and matches the memberUid attribute:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'uid',
            'attribute.memberOf' => 'memberuid',
            'timeout' => 30,
       ],

However if I call it like this:

 50 => [
            'class' => 'ldap:AttributeAddUsersGroups',
            'authsource' => 'ldap',
            'ldap.product' => 'OpenLDAP',
            'search.base' => [
              'ou=Groups,dc=mycompany,dc=com',
            ],
            'attribute.dn' => 'dn',
            'attribute.return' => 'cn',
            'attribute.groups' => 'groups',
            'attribute.username' => 'dn',
            'attribute.memberOf' => 'uniquemember',
            'timeout' => 30,
       ],

I get an error telling me 'dn' is not found in the attributes array. So, I added another authproc call to ldap:AttributeAddFromLDAP to go specifically grab 'dn' for the user. To my knowledge 'dn' is always returned by LDAP searches, but I figured let's try this:

40 => [
             'class' => 'ldap:AttributeAddFromLDAP',
             'authsource' => 'ldap',
             'attributes' => ['dn'],
             'attribute.policy' => 'add',
             'search.filter' => '(cn=%cn%)',
       ],

Which itself works without error, but I still get the following on the very next call to 'ldap:AttributeAddUsersGroups' :

SimpleSAML\Error\Exception: Warning - Undefined array key "dn" at /usr/local/install/simplesamlphp/modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php:229

I can't find where or if 'dn' is somehow being filtered out but the attribute is definitely being returned by a search.

We'd like to switch to using the DN where we can but this has been a roadblock I can't figure out.

Comienza con modules/ldap/src/Auth/Process/AttributeAddUsersGroups.php en la línea 229 y compara después la configuración ldap:AttributeAddFromLDAP anterior con los ajustes de AttributeAddUsersGroups del informe. Reproduce la advertencia usando las dos llamadas a authproc e inspecciona los atributos que se pasan entre ellas. Se considerará terminado cuando la búsqueda de grupos basada en DN ya no genere la advertencia de clave ausente y devuelva los grupos esperados.