From 3a91b409c448b2e4610b8a058c32f642f7999058 Mon Sep 17 00:00:00 2001
From: Dmitry Popovich <32481693+Tualua@users.noreply.github.com>
Date: Wed, 15 Oct 2025 17:40:41 +0800
Subject: [PATCH] fix(zitadel): LDAP binding error with non-ASCII characters in
 DN (#10578)

<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

LDAP binding with non-ASCII characters in DN

# How the Problems Are Solved

The root of the problem is that ParseDN() function messes DN with
non-ASCII character. Instead of using DN object, returned from ParseDN
we use user.DN in binding request. ParseDN stays only for verifying
correctness of DN.

# Additional Context
- Closes #9970

---------

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
---
 internal/idp/providers/ldap/session.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/idp/providers/ldap/session.go b/internal/idp/providers/ldap/session.go
index 6a56cd613..7f205f8ca 100644
--- a/internal/idp/providers/ldap/session.go
+++ b/internal/idp/providers/ldap/session.go
@@ -216,12 +216,12 @@ func trySearchAndUserBind(
 
 	user := sr.Entries[0]
 	// Bind as the user to verify their password
-	userDN, err := ldap.ParseDN(user.DN)
+	_, err = ldap.ParseDN(user.DN)
 	if err != nil {
 		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user parse DN failed")
 		return nil, err
 	}
-	if err = conn.Bind(userDN.String(), password); err != nil {
+	if err = conn.Bind(user.DN, password); err != nil {
 		logging.WithFields("userDN", user.DN).WithError(err).Info("ldap user bind failed")
 		return nil, ErrFailedLogin
 	}