From 57cc6e4808f0bf58bb1553cd2764f4fe75b44826 Mon Sep 17 00:00:00 2001
From: Ruslan Musaev <43766501+HocKu7@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:11:21 +0200
Subject: [PATCH] dbeaver/pro#10048 fix ldap groups matching (#4508)

Co-authored-by: Evgenia <139753579+EvgeniaBzzz@users.noreply.github.com>
---
 .../service/ldap/auth/LdapAuthProvider.java   | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
index 7b9440d3e3..165998d619 100644
--- a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
+++ b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
@@ -48,6 +48,7 @@ import java.util.*;
 import javax.naming.Context;
 import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
+import javax.naming.PartialResultException;
 import javax.naming.directory.*;
 import javax.naming.ldap.LdapName;
 import javax.naming.ldap.Rdn;
@@ -562,12 +563,22 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
             }
 
             context = initConnection(environment);
-            List<String> groupsByMemberOfAttribute = findGroupsByMemberOfAttribute(fullDN, context);
-            log.debug("Found " + groupsByMemberOfAttribute.size() + " groups by memberOf attribute");
-            result.addAll(groupsByMemberOfAttribute);
-            List<String> groupsByMemberAttribute = findGroupsByMemberAttribute(fullDN, ldapSettings, context);
-            log.debug("Found " + groupsByMemberAttribute.size() + " groups by member attribute");
-            result.addAll(groupsByMemberAttribute);
+            // Run both lookups independently: a failure in one must not discard the groups
+            // already collected by the other.
+            try {
+                List<String> groupsByMemberOfAttribute = findGroupsByMemberOfAttribute(fullDN, context);
+                log.debug("Found " + groupsByMemberOfAttribute.size() + " groups by memberOf attribute");
+                result.addAll(groupsByMemberOfAttribute);
+            } catch (Exception e) {
+                log.error("Failed to fetch groups by memberOf attribute. " + e.getMessage());
+            }
+            try {
+                List<String> groupsByMemberAttribute = findGroupsByMemberAttribute(fullDN, ldapSettings, context);
+                log.debug("Found " + groupsByMemberAttribute.size() + " groups by member attribute");
+                result.addAll(groupsByMemberAttribute);
+            } catch (Exception e) {
+                log.error("Failed to fetch groups by member attribute. " + e.getMessage());
+            }
         } catch (Exception e) {
             log.error("Group not found. " + e.getMessage());
         } finally {
@@ -579,6 +590,7 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
                 log.error("Close resource of ldap group search failed", e);
             }
         }
+        log.debug("Resolved " + result.size() + " external group id(s) for member '" + fullDN + "': " + result);
         return new ArrayList<>(result);
     }
 
@@ -602,6 +614,8 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
                     }
                 }
             }
+        } catch (PartialResultException e) {
+          log.debug("Ignoring LDAP continuation references while reading memberOf for '" + fullDN + "'");
         } finally {
             if (userRecord != null) {
                 userRecord.close();
@@ -634,6 +648,8 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
                     log.error("Failed fetch user group. " + e.getMessage());
                 }
             }
+        } catch (PartialResultException e) {
+            log.debug("Ignoring LDAP continuation references during member group search for '" + fullDN + "'");
         } finally {
             if (searchResults != null) {
                 searchResults.close();