[MM-25568] LDAP Sync skip users and log when they dont match the restricted email of a team or channel (#14895)

* Dont return an error if createDefaultChannelMemberships fails due to email domain restriction on team

* Add test ensuring sync works as intended and only skips over failed users

* Remove unneeded line

* Update wording

* Trigger CI

app/syncables.go

@@ -36,6 +36,14 @@ func (a *App) createDefaultChannelMemberships(since int64, channelID *string) er
 		if tmem == nil {
 			_, err = a.AddTeamMember(channel.TeamId, userChannel.UserID)
 			if err != nil {
+				if err.Id == "api.team.join_user_to_team.allowed_domains.app_error" {
+					a.Log().Info("User not added to channel - the domain associated with the user is not in the list of allowed team domains",
+						mlog.String("user_id", userChannel.UserID),
+						mlog.String("channel_id", userChannel.ChannelID),
+						mlog.String("team_id", channel.TeamId),
+					)
+					continue
+				}
 				return err
 			}
 			a.Log().Info("added teammember",
@@ -77,6 +85,13 @@ func (a *App) createDefaultTeamMemberships(since int64, teamID *string) error {
 	for _, userTeam := range teamMembers {
 		_, err := a.AddTeamMember(userTeam.TeamID, userTeam.UserID)
 		if err != nil {
+			if err.Id == "api.team.join_user_to_team.allowed_domains.app_error" {
+				a.Log().Info("User not added to team - the domain associated with the user is not in the list of allowed team domains",
+					mlog.String("user_id", userTeam.UserID),
+					mlog.String("team_id", userTeam.TeamID),
+				)
+				continue
+			}
 			return err
 		}
 

app/syncables_test.go

@@ -328,6 +328,48 @@ func TestCreateDefaultMemberships(t *testing.T) {
 	if err != nil {
 		t.Errorf("expected channel member: %s", err.Error())
 	}
+
+	t.Run("Team with restricted domains skips over members that do not match the allowed domains", func(t *testing.T) {
+		restrictedUser := th.CreateUser()
+		restrictedUser.Email = "restricted@mattermost.org"
+		_, err = th.App.UpdateUser(restrictedUser, false)
+		require.Nil(t, err)
+		_, err = th.App.UpsertGroupMember(scienceGroup.Id, restrictedUser.Id)
+		require.Nil(t, err)
+
+		restrictedTeam, err := th.App.CreateTeam(&model.Team{
+			DisplayName:    "Restricted",
+			Name:           "restricted" + model.NewId(),
+			Email:          "restricted@mattermost.org",
+			AllowedDomains: "mattermost.org",
+			Type:           model.TEAM_OPEN,
+		})
+		require.Nil(t, err)
+		_, err = th.App.UpsertGroupSyncable(model.NewGroupTeam(scienceGroup.Id, restrictedTeam.Id, true))
+		require.Nil(t, err)
+
+		restrictedChannel, err := th.App.CreateChannel(&model.Channel{
+			TeamId:      restrictedTeam.Id,
+			DisplayName: "Restricted",
+			Name:        "restricted" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, false)
+		require.Nil(t, err)
+		_, err = th.App.UpsertGroupSyncable(model.NewGroupChannel(scienceGroup.Id, restrictedChannel.Id, true))
+		require.Nil(t, err)
+
+		pErr = th.App.CreateDefaultMemberships(0)
+		require.Nil(t, pErr)
+
+		// Ensure only the restricted user was added to both the team and channel
+		cMembersCount, err = th.App.GetChannelMemberCount(restrictedChannel.Id)
+		require.Nil(t, err)
+		require.Equal(t, cMembersCount, int64(1))
+		tmembers, err := th.App.GetTeamMembers(restrictedTeam.Id, 0, 100, nil)
+		require.Nil(t, err)
+		require.Len(t, tmembers, 1)
+		require.Equal(t, tmembers[0].UserId, restrictedUser.Id)
+	})
 }
 
 func TestDeleteGroupMemberships(t *testing.T) {