From 08007da70ea400a6327acdb2575be6f0f6516f12 Mon Sep 17 00:00:00 2001
From: Livio Spring <9405495+livio-a@users.noreply.github.com>
Date: Mon, 4 May 2026 07:05:54 +0200
Subject: [PATCH] Merge commit from fork

---
 internal/idp/providers/ldap/session.go      | 8 ++------
 internal/idp/providers/ldap/session_test.go | 6 ++++++
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/internal/idp/providers/ldap/session.go b/internal/idp/providers/ldap/session.go
index c194ebe56..6a55bb0b2 100644
--- a/internal/idp/providers/ldap/session.go
+++ b/internal/idp/providers/ldap/session.go
@@ -169,11 +169,6 @@ func trySearchAndUserBind(
 
 	user := sr.Entries[0]
 	// Bind as the user to verify their password
-	_, err = ldap.ParseDN(user.DN)
-	if err != nil {
-		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user parse DN failed")
-		return nil, err
-	}
 	if err = conn.Bind(user.DN, password); err != nil {
 		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user bind failed")
 		return nil, ErrFailedLogin
@@ -218,9 +213,10 @@ func objectClassesToSearchQuery(classes []string) string {
 }
 
 func userFiltersToSearchQuery(filters []string, username string) []string {
+	escapedUsername := ldap.EscapeFilter(username)
 	searchQueries := make([]string, len(filters))
 	for i, filter := range filters {
-		searchQueries[i] = "(" + filter + "=" + username + ")"
+		searchQueries[i] = "(" + filter + "=" + escapedUsername + ")"
 	}
 	return searchQueries
 }
diff --git a/internal/idp/providers/ldap/session_test.go b/internal/idp/providers/ldap/session_test.go
index 89fee6871..04f0e053f 100644
--- a/internal/idp/providers/ldap/session_test.go
+++ b/internal/idp/providers/ldap/session_test.go
@@ -75,6 +75,12 @@ func TestProvider_userFiltersToSearchQuery(t *testing.T) {
 			username: "user",
 			want:     []string{"(test1=user)", "(test2=user)", "(test3=user)", "(test4=user)", "(test5=user)"},
 		},
+		{
+			name:     "escaped",
+			fields:   []string{"test"},
+			username: "user)(*",
+			want:     []string{`(test=user\29\28\2a)`},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {