add isPerson check to query for AD #11843

DaanHoogland · 2025-10-15T15:16:26Z

Description

This PR fixes a situation where child OUs are returned as users on queries to AD ...

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Copilot

Pull Request Overview

Adds an explicit person-category filter to the AD search query to prevent Organizational Units (OUs) from being returned as users.

Include (objectCategory=person) in the AD group search filter to restrict results to person objects.
Update unit tests (nested groups enabled/disabled) to assert the new filter format.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/ADLdapUserManagerImpl.java	Add (objectCategory=person) to the composite LDAP filter in generateADGroupSearchFilter.
plugins/user-authenticators/ldap/src/test/java/org/apache/cloudstack/ldap/ADLdapUserManagerImplTest.java	Update expected filter strings in tests to include the person category filter.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

...-authenticators/ldap/src/test/java/org/apache/cloudstack/ldap/ADLdapUserManagerImplTest.java

DaanHoogland · 2025-10-15T15:19:36Z

@blueorangutan package

blueorangutan · 2025-10-15T15:20:03Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-10-15T15:24:59Z

Codecov Report

❌ Patch coverage is 29.62963% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.56%. Comparing base (b1851ba) to head (ac14522).

Files with missing lines	Patch %	Lines
...pache/cloudstack/ldap/OpenLdapUserManagerImpl.java	15.90%	37 Missing ⚠️
.../apache/cloudstack/ldap/ADLdapUserManagerImpl.java	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #11843   +/-   ##
=========================================
  Coverage     17.56%   17.56%           
- Complexity    15533    15534    +1     
=========================================
  Files          5909     5909           
  Lines        529013   528994   -19     
  Branches      64605    64601    -4     
=========================================
+ Hits          92912    92925   +13     
+ Misses       425652   425622   -30     
+ Partials      10449    10447    -2

Flag	Coverage Δ
uitests	`3.58% <ø> (ø)`
unittests	`18.63% <29.62%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-10-15T16:41:32Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15467

DaanHoogland · 2025-10-16T08:38:37Z

@blueorangutan test keepEnv

blueorangutan · 2025-10-16T08:40:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-10-17T01:07:49Z

[SF] Trillian test result (tid-14694)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56088 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr11843-t14694-kvm-ol8.zip
Smoke tests completed. 149 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

blueorangutan · 2025-10-17T19:05:17Z

[LL] Trillian Build Failed (tid-7153)

blueorangutan · 2025-10-20T12:14:14Z

[LL] Trillian Build Failed (tid-7154)

DaanHoogland · 2025-10-20T13:52:00Z

@blueorangutan package

blueorangutan · 2025-10-20T13:54:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-20T15:08:01Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15506

Copilot

Pull Request Overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-23T13:26:59Z

...er-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java


    protected String getMemberOfAttribute(final Long domainId) {
-        return _ldapConfiguration.getUserMemberOfAttribute(domainId);
+        return LdapConfiguration.getUserMemberOfAttribute(domainId);


Calling getUserMemberOfAttribute() statically on LdapConfiguration suggests this method was changed from instance to static. If this is an instance method being called statically, this will cause a compilation error. Verify that the method signature has been properly updated to be static, or revert to calling it on the _ldapConfiguration instance.

Suggested change

return LdapConfiguration.getUserMemberOfAttribute(domainId);

return _ldapConfiguration.getUserMemberOfAttribute(domainId);

Copilot · 2025-10-23T13:26:59Z

...er-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java

    }

-    public LdapUser searchUser(final String basedn, final String searchString, final LdapContext context, Long domainId) throws NamingException, IOException {
+    public LdapUser searchUser(final String basedn, final String searchString, final LdapContext context, Long domainId) throws NamingException {


Removing IOException from the throws clause is a breaking change to the method signature. If any calling code explicitly catches IOException from this method, it will cause compilation errors. Verify that all callers have been updated accordingly, or consider whether this exception should remain for backward compatibility.

Copilot · 2025-10-23T13:27:00Z

...user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/ADLdapUserManagerImpl.java

+        logger.debug("group search filter = {}", result);
        return result.toString();
    }



This method should be marked with @Override annotation since it overrides the parent class method in OpenLdapUserManagerImpl. Adding the annotation makes the inheritance relationship explicit and allows the compiler to verify the override.

Suggested change

@Override

Pearl1594

code LGTM.

boring-cyborg bot added the component:LDAP label Oct 15, 2025

DaanHoogland requested a review from Copilot October 15, 2025 15:16

Copilot AI reviewed Oct 15, 2025

View reviewed changes

...-authenticators/ldap/src/test/java/org/apache/cloudstack/ldap/ADLdapUserManagerImplTest.java Outdated Show resolved Hide resolved

...-authenticators/ldap/src/test/java/org/apache/cloudstack/ldap/ADLdapUserManagerImplTest.java Outdated Show resolved Hide resolved

DaanHoogland added this to the 4.22.0 milestone Oct 16, 2025

DaanHoogland force-pushed the nestedADaccounts branch from 1548046 to d12af75 Compare October 20, 2025 11:51

DaanHoogland force-pushed the nestedADaccounts branch from ecb571d to ae15643 Compare October 22, 2025 10:53

DaanHoogland requested a review from Copilot October 23, 2025 13:25

DaanHoogland marked this pull request as ready for review October 23, 2025 13:26

Daan Hoogland added 3 commits October 23, 2025 15:26

add isPerson check to query

c3e0830

space

613beaf

created an ad specific usertype filter

ac14522

DaanHoogland force-pushed the nestedADaccounts branch from ae15643 to ac14522 Compare October 23, 2025 13:26

Copilot AI reviewed Oct 23, 2025

View reviewed changes

Pearl1594 approved these changes Oct 23, 2025

View reviewed changes

	return LdapConfiguration.getUserMemberOfAttribute(domainId);
	return _ldapConfiguration.getUserMemberOfAttribute(domainId);

Uh oh!

add isPerson check to query for AD #11843

Are you sure you want to change the base?

add isPerson check to query for AD #11843

Conversation

DaanHoogland commented Oct 15, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

DaanHoogland commented Oct 15, 2025

Uh oh!

blueorangutan commented Oct 15, 2025

Uh oh!

codecov bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Oct 15, 2025

Uh oh!

DaanHoogland commented Oct 16, 2025

Uh oh!

blueorangutan commented Oct 16, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 20, 2025

Uh oh!

DaanHoogland commented Oct 20, 2025

Uh oh!

blueorangutan commented Oct 20, 2025

Uh oh!

blueorangutan commented Oct 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Pearl1594 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Oct 15, 2025 •

edited

Loading