Fix NPE in LDAP user lookup when memberOf attribute is absent (service accounts)

[Copilot]

LdapUserRepository.resultToUserEntry crashes with a NullPointerException for LDAP principals that have no memberOf attribute (e.g. service accounts), because attrs.get("memberOf") returns null and .getAll() is called unconditionally.

Overview

Fix — make memberOf access null-safe in resultToUserEntry:

• Option(attrs.get("memberOf")) defaults to Seq.empty[String] when the attribute is absent
• Emits a WARN log when memberOf is missing so the gap is visible without noise

// Before
val groups = attrs.get("memberOf").getAll.asScala.map(...)  // NPE if absent

// After
val groups = Option(attrs.get("memberOf")) match {
  case None =>
    logger.warn(s"No memberOf attribute found for user: $username - defaulting to empty groups")
    Seq.empty[String]
  case Some(memberOfAttr) =>
    memberOfAttr.getAll.asScala.map(group => group.toString.substring(3, group.toString.indexOf(","))).toSeq
}

Testability — resultToUserEntry changed from private to private[search] to allow direct unit testing.

Tests added in LdapUserRepositoryTest using ScalaMock covering:

• Normal user with one or more memberOf group DNs parsed correctly
• Service account with no memberOf attribute → empty groups, no exception
• User with memberOf present but empty → empty groups
• Optional attributes mapped correctly when memberOf is absent

Release Notes

• Fix: LDAP user lookup no longer throws NullPointerException for principals without a memberOf attribute (e.g. service accounts); missing memberOf now defaults to empty groups

Related

Closes #177

[lsulak]

I checked the OneDS and the user indeed does have memberOf atteibute empty. The fix basically just wraps the processing of this attribute into Option and matches on it. Also added few unit tests, this should be ok, approving but feel free to check @TheLydonKing or @dk1844

[dk1844]

LGTM (read the code, ran tests)

[github-actions]

JaCoCo Coverage Report

Metric (instruction)	Coverage	Threshold	Status
Overall	71.91%	71.0%	✅
Changed Files	40.38%	80.0%	❌

Group	Coverage (O/Ch)	Threshold (O/Ch)	Status (O/Ch)
login-service-api	73.74% / 40.38%	73.0% / 80.0%	✅/❌

Report	Coverage (O/Ch)	Threshold (O/Ch)	Status (O/Ch)
Report: api - scala:2.12.17	73.74% / 40.38%	73.0% / 80.0%	✅/❌

File Path	Coverage	Threshold	Status
LdapUserRepository.scala	40.38%	60.0%	❌

---

Run 28100271342 · Event: pull_request