From dd3f00a3a8c1a6533185db86cff3f5b14f7ca8d6 Mon Sep 17 00:00:00 2001
From: Ruslan Musaev <43766501+HocKu7@users.noreply.github.com>
Date: Tue, 4 Nov 2025 19:45:21 +0100
Subject: [PATCH] dbeaver/pro#7356 fix escaping special symbols for group
 search in LDAP (#3865)

---
 .../service/ldap/auth/LdapAuthProvider.java   | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
index 5a89f10c72..01ef4303ba 100644
--- a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
+++ b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
@@ -39,6 +39,7 @@ import org.jkiss.dbeaver.model.security.SMController;
 import org.jkiss.utils.CommonUtils;
 
 import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
 import java.security.KeyStore;
 import java.security.SecureRandom;
 import java.security.cert.Certificate;
@@ -48,6 +49,8 @@ import javax.naming.Context;
 import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
 import javax.naming.directory.*;
+import javax.naming.ldap.LdapName;
+import javax.naming.ldap.Rdn;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManagerFactory;
 
@@ -306,18 +309,22 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
 
     @NotNull
     private String findUserNameFromDN(@NotNull String fullUserDN, @NotNull LdapSettings ldapSettings)
-        throws DBException {
-        String userId = null;
-        for (String dn : fullUserDN.split(",")) {
-            if (dn.startsWith(ldapSettings.getUserIdentifierAttr() + "=")) {
-                userId = dn.split("=")[1];
-                break;
+    throws DBException {
+        try {
+            LdapName ldapDN = new LdapName(fullUserDN);
+            for (Rdn rdn : ldapDN.getRdns()) {
+                if (rdn.getType().equalsIgnoreCase(ldapSettings.getUserIdentifierAttr())) {
+                    Object v = rdn.getValue();
+                    if (v instanceof byte[]) {
+                        return new String((byte[]) v, StandardCharsets.UTF_8);
+                    }
+                    return String.valueOf(v);
+                }
             }
-        }
-        if (userId == null) {
             throw new DBException("Failed to determine userId from user DN: " + fullUserDN);
+        } catch (Exception e) {
+            throw new DBException("Invalid user DN: " + fullUserDN, e);
         }
-        return userId;
     }
 
     @NotNull
@@ -548,14 +555,16 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
 
             context = initConnection(environment);
 
-            String searchFilter = "(member=" + fullDN + ")";
+            String searchFilter = "(member={0})";
             SearchControls searchControls = new SearchControls();
             searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
-
-            searchResults = context.search(ldapSettings.getBaseDN(), searchFilter, searchControls);
+            searchResults = context.search(ldapSettings.getBaseDN(), searchFilter, new Object[] {fullDN}, searchControls);
             while (searchResults.hasMore()) {
                 try {
                     SearchResult next = searchResults.next();
+                    //add full dn
+                    result.add(next.getNameInNamespace());
+                    //add relative dn to base dn
                     result.add(next.getName());
                 } catch (Exception e) {
                     log.error("Failed fetch user group. Skipping...", e);