optimising ldap lookup

internal/auth/ldap.go

@@ -321,6 +321,43 @@ func (a *LDAPAuthenticator) lookupUserEntry(conn *ldap.Conn, username string, us
 	}
 
 	for _, principal := range principalCandidates(username) {
+		if strings.Contains(principal, "@") {
+			entry, err := a.searchUserByAttribute(conn, "userPrincipalName", principal)
+			if err != nil {
+				return nil, "", err
+			}
+			if entry != nil {
+				return entry, "principal_upn", nil
+			}
+		}
+
+		entry, err := a.searchUserByAttribute(conn, "sAMAccountName", principal)
+		if err != nil {
+			return nil, "", err
+		}
+		if entry != nil {
+			return entry, "principal_samaccountname", nil
+		}
+
+		// Keep uid lookup as a fallback for non-AD LDAP directories.
+		entry, err = a.searchUserByAttribute(conn, "uid", principal)
+		if err != nil {
+			return nil, "", err
+		}
+		if entry != nil {
+			return entry, "principal_uid", nil
+		}
+	}
+	return nil, "", nil
+}
+
+func (a *LDAPAuthenticator) searchUserByAttribute(conn *ldap.Conn, attribute string, value string) (*ldap.Entry, error) {
+	attribute = strings.TrimSpace(attribute)
+	value = strings.TrimSpace(value)
+	if attribute == "" || value == "" {
+		return nil, nil
+	}
+
 	searchRes, err := conn.Search(ldap.NewSearchRequest(
 		a.baseDN,
 		ldap.ScopeWholeSubtree,
@@ -328,23 +365,17 @@ func (a *LDAPAuthenticator) lookupUserEntry(conn *ldap.Conn, username string, us
 		2,
 		0,
 		false,
-			fmt.Sprintf("(|(uid=%s)(cn=%s)(sAMAccountName=%s)(userPrincipalName=%s))",
+		fmt.Sprintf("(%s=%s)", attribute, ldap.EscapeFilter(value)),
-				ldap.EscapeFilter(principal),
-				ldap.EscapeFilter(principal),
-				ldap.EscapeFilter(principal),
-				ldap.EscapeFilter(principal),
-			),
 		[]string{"uid", "sAMAccountName", "userPrincipalName", "cn", "memberOf"},
 		nil,
 	))
 	if err != nil {
-			return nil, "", fmt.Errorf("%w: user lookup failed: %v", ErrLDAPOperationFailed, err)
+		return nil, fmt.Errorf("%w: user lookup failed (%s): %v", ErrLDAPOperationFailed, attribute, err)
 	}
-		if len(searchRes.Entries) > 0 {
+	if len(searchRes.Entries) == 0 {
-			return searchRes.Entries[0], "principal", nil
+		return nil, nil
 	}
-	}
+	return searchRes.Entries[0], nil
-	return nil, "", nil
 }
 
 func normalizeDN(value string) string {