connector/ldap: enable groupSearch to be empty

dexidp · Dec 27, 2016 · 6a728f1 · 6a728f1
1 parent 3e2d857
commit 6a728f1
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
@@ -445,6 +445,11 @@ func (c *ldapConnector) Refresh(ctx context.Context, s connector.Scopes, ident c
 }
 
 func (c *ldapConnector) groups(ctx context.Context, user ldap.Entry) ([]string, error) {
+	if c.GroupSearch.BaseDN == "" {
+		c.logger.Debugf("No groups returned for %q because no groups baseDN has been configured.", getAttr(user, c.UserSearch.NameAttr))
+		return nil, nil
+	}
+
 	filter := fmt.Sprintf("(%s=%s)", c.GroupSearch.GroupAttr, ldap.EscapeFilter(getAttr(user, c.GroupSearch.UserAttr)))
 	if c.GroupSearch.Filter != "" {
 		filter = fmt.Sprintf("(&%s%s)", c.GroupSearch.Filter, filter)