From 49a986fa65ff8820ccd8f880521b754e2101c647 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=94=D0=B5=D0=BD=D0=B8=D1=81=20=D0=9A=D1=80=D0=B8=D0=B2?= =?UTF-8?q?=D0=BE=D1=87=D0=B5=D0=BD=D0=BA=D0=BE?= Date: Wed, 22 Jul 2026 00:41:53 +0700 Subject: [PATCH] fix: don't escape @ in email for LDAP filter --- instruct/handlers.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/instruct/handlers.py b/instruct/handlers.py index 78a9cd3..6666054 100644 --- a/instruct/handlers.py +++ b/instruct/handlers.py @@ -41,14 +41,16 @@ def _get_user_cn(user_id: str) -> str: server = Server(AD_SERVER, get_info=ALL) conn = Connection(server, user=AD_USER, password=AD_PASSWORD, auto_bind=True) - # Фильтр как в lk/handlers.py — работает - safe_user_id = escape_filter_chars(search_id) + # escape_filter_chars экранирует @ и . в email, что ломает фильтр. + # Для email и UPN передаём raw. Для sAMAccountName — экранируем. + safe_sam = escape_filter_chars(short_username) + search_filter = ( f"(&(objectClass=user)(|" - f"(mail={safe_user_id})" - f"(userPrincipalName={safe_user_id})" - f"(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')}))" - f"(sAMAccountName={escape_filter_chars(short_username)})))" + f"(mail={search_id})" + f"(userPrincipalName={search_id})" + f"(userPrincipalName={short_username}@sibcem.ru))" + f"(sAMAccountName={safe_sam})))" ) logger.info(f"AD filter: {search_filter}")