From 85960abb0848f151e5382fa6c844acc302c269c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sven=20H=C3=BCster?= <sven.svelle@gmail.com>
Date: Wed, 20 Nov 2019 14:52:26 +0100
Subject: [PATCH] add group filter support to ldap-check.sh (#11935)

* add group filter support to ldap-check.sh

* Update scripts/ldap-check.sh

Co-Authored-By: George Goldberg <george@gberg.me>
---
 scripts/ldap-check.sh | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/scripts/ldap-check.sh b/scripts/ldap-check.sh
index 17f251bfb1..783acd7645 100755
--- a/scripts/ldap-check.sh
+++ b/scripts/ldap-check.sh
@@ -17,8 +17,9 @@ ldapsearch_cmd=ldapsearch
 
 if [[ -z ${1} ]]; then
 	echo "We could not find a username";
-	echo "usage: ./ldap-check.sh [username]"
-	echo "example: ./ldap-check.sh john"
+	echo "usage: ./ldap-check.sh -u/-g [username/groupname]"
+	echo "example: ./ldap-check.sh -u john"
+	echo "example: ./ldap-check.sh -g admin-staff"
 	exit 1;
 fi
 
@@ -54,14 +55,35 @@ UserFilter=`cat $config_file | jq -r .LdapSettings.UserFilter`
 EmailAttribute=`cat $config_file | jq -r .LdapSettings.EmailAttribute`
 UsernameAttribute=`cat $config_file | jq -r .LdapSettings.UsernameAttribute`
 IdAttribute=`cat $config_file | jq -r .LdapSettings.IdAttribute`
+GroupFilter=`cat $config_file | jq -r .LdapSettings.GroupFilter`
+GroupIdAttribute=`cat $config_file | jq -r .LdapSettings.GroupIdAttribute`
 
 if [[ -z ${UserFilter} ]]; then
-	UserFilter="($IdAttribute=$1)"
+	UserFilter="($IdAttribute=$2)"
 else
-	UserFilter="(&($IdAttribute=$1)$UserFilter)"
+	UserFilter="(&($IdAttribute=$2)$UserFilter)"
 fi
 
+if [[ -z ${GroupFilter} ]]; then
+	GroupFilter="($GroupIdAttribute=$2)"
+else
+	GroupFilter="(&($GroupIdAttribute=$2)$GroupFilter)"
+fi
+
+if [[ $1 == '-u' ]]; then
+
 cmd_to_run="$ldapsearch_cmd -LLL -x -h $LdapServer -p $LdapPort -D \"$BindUsername\" -w \"$BindPassword\" -b \"$BaseDN\" \"$UserFilter\" $IdAttribute $UsernameAttribute $EmailAttribute"
 echo $cmd_to_run
 echo "-------------------------"
 eval $cmd_to_run
+
+elif [[ $1 == '-g' ]]; then
+
+cmd_to_run="$ldapsearch_cmd -LLL -x -h $LdapServer -p $LdapPort -D \"$BindUsername\" -w \"$BindPassword\" -b \"$BaseDN\" \"$GroupFilter\""
+echo $cmd_to_run
+echo "-------------------------"
+eval $cmd_to_run
+
+else 
+	echo "User or Group not specified"
+fi