Refactor some LDAP code (#32849)

wxiaoguang · web-flow · commit b01b0b99a596 · 2024-12-15T11:59:18.000Z
diff --git a/services/auth/source/ldap/source.go b/services/auth/source/ldap/source.go
@@ -56,8 +56,7 @@ type Source struct {
 	UserUID               string // User Attribute listed in Group
 	SkipLocalTwoFA        bool   `json:",omitempty"` // Skip Local 2fa for users authenticated with this source
 
-	// reference to the authSource
-	authSource *auth.Source
+	authSource *auth.Source // reference to the authSource
 }
 
 // FromDB fills up a LDAPConfig from serialized format.
@@ -107,7 +106,7 @@ func (source *Source) UseTLS() bool {
 
 // ProvidesSSHKeys returns if this source provides SSH Keys
 func (source *Source) ProvidesSSHKeys() bool {
-	return len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
+	return strings.TrimSpace(source.AttributeSSHPublicKey) != ""
 }
 
 // SetAuthSource sets the related AuthSource
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
@@ -31,13 +31,13 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
 		return nil, user_model.ErrUserNotExist{Name: loginName}
 	}
 	// Fallback.
-	if len(sr.Username) == 0 {
+	if sr.Username == "" {
 		sr.Username = userName
 	}
-	if len(sr.Mail) == 0 {
+	if sr.Mail == "" {
 		sr.Mail = fmt.Sprintf("%s@localhost.local", sr.Username)
 	}
-	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
+	isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""
 
 	// Update User admin flag if exist
 	if isExist, err := user_model.IsUserExist(ctx, 0, sr.Username); err != nil {
@@ -51,11 +51,11 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
 		}
 		if user != nil && !user.ProhibitLogin {
 			opts := &user_service.UpdateOptions{}
-			if len(source.AdminFilter) > 0 && user.IsAdmin != sr.IsAdmin {
+			if source.AdminFilter != "" && user.IsAdmin != sr.IsAdmin {
 				// Change existing admin flag only if AdminFilter option is set
 				opts.IsAdmin = optional.Some(sr.IsAdmin)
 			}
-			if !sr.IsAdmin && len(source.RestrictedFilter) > 0 && user.IsRestricted != sr.IsRestricted {
+			if !sr.IsAdmin && source.RestrictedFilter != "" && user.IsRestricted != sr.IsRestricted {
 				// Change existing restricted flag only if RestrictedFilter option is set
 				opts.IsRestricted = optional.Some(sr.IsRestricted)
 			}
@@ -99,7 +99,7 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
 				return user, err
 			}
 		}
-		if len(source.AttributeAvatar) > 0 {
+		if source.AttributeAvatar != "" {
 			if err := user_service.UploadAvatar(ctx, user, sr.Avatar); err != nil {
 				return user, err
 			}
diff --git a/services/auth/source/ldap/source_search.go b/services/auth/source/ldap/source_search.go
@@ -147,7 +147,7 @@ func bindUser(l *ldap.Conn, userDN, passwd string) error {
 }
 
 func checkAdmin(l *ldap.Conn, ls *Source, userDN string) bool {
-	if len(ls.AdminFilter) == 0 {
+	if ls.AdminFilter == "" {
 		return false
 	}
 	log.Trace("Checking admin with filter %s and base %s", ls.AdminFilter, userDN)
@@ -169,7 +169,7 @@ func checkAdmin(l *ldap.Conn, ls *Source, userDN string) bool {
 }
 
 func checkRestricted(l *ldap.Conn, ls *Source, userDN string) bool {
-	if len(ls.RestrictedFilter) == 0 {
+	if ls.RestrictedFilter == "" {
 		return false
 	}
 	if ls.RestrictedFilter == "*" {
@@ -250,8 +250,17 @@ func (source *Source) getUserAttributeListedInGroup(entry *ldap.Entry) string {
 
 // SearchEntry : search an LDAP source if an entry (name, passwd) is valid and in the specific filter
 func (source *Source) SearchEntry(name, passwd string, directBind bool) *SearchResult {
+	if MockedSearchEntry != nil {
+		return MockedSearchEntry(source, name, passwd, directBind)
+	}
+	return realSearchEntry(source, name, passwd, directBind)
+}
+
+var MockedSearchEntry func(source *Source, name, passwd string, directBind bool) *SearchResult
+
+func realSearchEntry(source *Source, name, passwd string, directBind bool) *SearchResult {
 	// See https://tools.ietf.org/search/rfc4513#section-5.1.2
-	if len(passwd) == 0 {
+	if passwd == "" {
 		log.Debug("Auth. failed for %s, password cannot be empty", name)
 		return nil
 	}
@@ -323,17 +332,17 @@ func (source *Source) SearchEntry(name, passwd string, directBind bool) *SearchR
 		return nil
 	}
 
-	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
-	isAtributeAvatarSet := len(strings.TrimSpace(source.AttributeAvatar)) > 0
+	isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""
+	isAttributeAvatarSet := strings.TrimSpace(source.AttributeAvatar) != ""
 
 	attribs := []string{source.AttributeUsername, source.AttributeName, source.AttributeSurname, source.AttributeMail}
-	if len(strings.TrimSpace(source.UserUID)) > 0 {
+	if strings.TrimSpace(source.UserUID) != "" {
 		attribs = append(attribs, source.UserUID)
 	}
 	if isAttributeSSHPublicKeySet {
 		attribs = append(attribs, source.AttributeSSHPublicKey)
 	}
-	if isAtributeAvatarSet {
+	if isAttributeAvatarSet {
 		attribs = append(attribs, source.AttributeAvatar)
 	}
 
@@ -375,7 +384,7 @@ func (source *Source) SearchEntry(name, passwd string, directBind bool) *SearchR
 		isRestricted = checkRestricted(l, source, userDN)
 	}
 
-	if isAtributeAvatarSet {
+	if isAttributeAvatarSet {
 		Avatar = sr.Entries[0].GetRawAttributeValue(source.AttributeAvatar)
 	}
 
@@ -440,14 +449,14 @@ func (source *Source) SearchEntries() ([]*SearchResult, error) {
 
 	userFilter := fmt.Sprintf(source.Filter, "*")
 
-	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
-	isAtributeAvatarSet := len(strings.TrimSpace(source.AttributeAvatar)) > 0
+	isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""
+	isAttributeAvatarSet := strings.TrimSpace(source.AttributeAvatar) != ""
 
 	attribs := []string{source.AttributeUsername, source.AttributeName, source.AttributeSurname, source.AttributeMail, source.UserUID}
 	if isAttributeSSHPublicKeySet {
 		attribs = append(attribs, source.AttributeSSHPublicKey)
 	}
-	if isAtributeAvatarSet {
+	if isAttributeAvatarSet {
 		attribs = append(attribs, source.AttributeAvatar)
 	}
 
@@ -503,7 +512,7 @@ func (source *Source) SearchEntries() ([]*SearchResult, error) {
 			user.SSHPublicKey = v.GetAttributeValues(source.AttributeSSHPublicKey)
 		}
 
-		if isAtributeAvatarSet {
+		if isAttributeAvatarSet {
 			user.Avatar = v.GetRawAttributeValue(source.AttributeAvatar)
 		}
 
diff --git a/services/auth/source/ldap/source_sync.go b/services/auth/source/ldap/source_sync.go
@@ -25,7 +25,7 @@ import (
 func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 	log.Trace("Doing: SyncExternalUsers[%s]", source.authSource.Name)
 
-	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
+	isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""
 	var sshKeysNeedUpdate bool
 
 	// Find all users with this login type - FIXME: Should this be an iterator?
@@ -86,26 +86,26 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 			return db.ErrCancelledf("During update of %s before completed update of users", source.authSource.Name)
 		default:
 		}
-		if len(su.Username) == 0 && len(su.Mail) == 0 {
+		if su.Username == "" && su.Mail == "" {
 			continue
 		}
 
 		var usr *user_model.User
-		if len(su.Username) > 0 {
+		if su.Username != "" {
 			usr = usernameUsers[su.LowerName]
 		}
-		if usr == nil && len(su.Mail) > 0 {
+		if usr == nil && su.Mail != "" {
 			usr = mailUsers[strings.ToLower(su.Mail)]
 		}
 
 		if usr != nil {
 			keepActiveUsers.Add(usr.ID)
-		} else if len(su.Username) == 0 {
+		} else if su.Username == "" {
 			// we cannot create the user if su.Username is empty
 			continue
 		}
 
-		if len(su.Mail) == 0 {
+		if su.Mail == "" {
 			su.Mail = fmt.Sprintf("%s@localhost.local", su.Username)
 		}
 
@@ -141,7 +141,7 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 				}
 			}
 
-			if err == nil && len(source.AttributeAvatar) > 0 {
+			if err == nil && source.AttributeAvatar != "" {
 				_ = user_service.UploadAvatar(ctx, usr, su.Avatar)
 			}
 		} else if updateExisting {
@@ -151,8 +151,8 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 			}
 
 			// Check if user data has changed
-			if (len(source.AdminFilter) > 0 && usr.IsAdmin != su.IsAdmin) ||
-				(len(source.RestrictedFilter) > 0 && usr.IsRestricted != su.IsRestricted) ||
+			if (source.AdminFilter != "" && usr.IsAdmin != su.IsAdmin) ||
+				(source.RestrictedFilter != "" && usr.IsRestricted != su.IsRestricted) ||
 				!strings.EqualFold(usr.Email, su.Mail) ||
 				usr.FullName != fullName ||
 				!usr.IsActive {
@@ -180,7 +180,7 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 			}
 
 			if usr.IsUploadAvatarChanged(su.Avatar) {
-				if err == nil && len(source.AttributeAvatar) > 0 {
+				if err == nil && source.AttributeAvatar != "" {
 					_ = user_service.UploadAvatar(ctx, usr, su.Avatar)
 				}
 			}
diff --git a/services/auth/source/ldap/util.go b/services/auth/source/ldap/util.go
@@ -6,11 +6,11 @@ package ldap
 // composeFullName composes a firstname surname or username
 func composeFullName(firstname, surname, username string) string {
 	switch {
-	case len(firstname) == 0 && len(surname) == 0:
+	case firstname == "" && surname == "":
 		return username
-	case len(firstname) == 0:
+	case firstname == "":
 		return surname
-	case len(surname) == 0:
+	case surname == "":
 		return firstname
 	default:
 		return firstname + " " + surname
diff --git a/tests/integration/auth_ldap_test.go b/tests/integration/auth_ldap_test.go

Original file line number	Diff line number	Diff line change
`@@ -56,8 +56,7 @@ type Source struct {`
`56`	`56`	`UserUID string // User Attribute listed in Group`
`57`	`57`	SkipLocalTwoFA bool `json:",omitempty"` // Skip Local 2fa for users authenticated with this source
`58`	`58`
`59`		`- // reference to the authSource`
`60`		`- authSource *auth.Source`
	`59`	`+ authSource *auth.Source // reference to the authSource`
`61`	`60`	`}`
`62`	`61`
`63`	`62`	`// FromDB fills up a LDAPConfig from serialized format.`
`@@ -107,7 +106,7 @@ func (source *Source) UseTLS() bool {`
`107`	`106`
`108`	`107`	`// ProvidesSSHKeys returns if this source provides SSH Keys`
`109`	`108`	`func (source *Source) ProvidesSSHKeys() bool {`
`110`		`- return len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0`
	`109`	`+ return strings.TrimSpace(source.AttributeSSHPublicKey) != ""`
`111`	`110`	`}`
`112`	`111`
`113`	`112`	`// SetAuthSource sets the related AuthSource`
Original file line number	Diff line number	Diff line change
`@@ -31,13 +31,13 @@ func (source Source) Authenticate(ctx context.Context, user user_model.User, u`
`31`	`31`	`return nil, user_model.ErrUserNotExist{Name: loginName}`
`32`	`32`	`}`
`33`	`33`	`// Fallback.`
`34`		`- if len(sr.Username) == 0 {`
	`34`	`+ if sr.Username == "" {`
`35`	`35`	`sr.Username = userName`
`36`	`36`	`}`
`37`		`- if len(sr.Mail) == 0 {`
	`37`	`+ if sr.Mail == "" {`
`38`	`38`	`sr.Mail = fmt.Sprintf("%[email protected]", sr.Username)`
`39`	`39`	`}`
`40`		`- isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0`
	`40`	`+ isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""`
`41`	`41`
`42`	`42`	`// Update User admin flag if exist`
`43`	`43`	`if isExist, err := user_model.IsUserExist(ctx, 0, sr.Username); err != nil {`
`@@ -51,11 +51,11 @@ func (source Source) Authenticate(ctx context.Context, user user_model.User, u`
`51`	`51`	`}`
`52`	`52`	`if user != nil && !user.ProhibitLogin {`
`53`	`53`	`opts := &user_service.UpdateOptions{}`
`54`		`- if len(source.AdminFilter) > 0 && user.IsAdmin != sr.IsAdmin {`
	`54`	`+ if source.AdminFilter != "" && user.IsAdmin != sr.IsAdmin {`
`55`	`55`	`// Change existing admin flag only if AdminFilter option is set`
`56`	`56`	`opts.IsAdmin = optional.Some(sr.IsAdmin)`
`57`	`57`	`}`
`58`		`- if !sr.IsAdmin && len(source.RestrictedFilter) > 0 && user.IsRestricted != sr.IsRestricted {`
	`58`	`+ if !sr.IsAdmin && source.RestrictedFilter != "" && user.IsRestricted != sr.IsRestricted {`
`59`	`59`	`// Change existing restricted flag only if RestrictedFilter option is set`
`60`	`60`	`opts.IsRestricted = optional.Some(sr.IsRestricted)`
`61`	`61`	`}`
`@@ -99,7 +99,7 @@ func (source Source) Authenticate(ctx context.Context, user user_model.User, u`
`99`	`99`	`return user, err`
`100`	`100`	`}`
`101`	`101`	`}`
`102`		`- if len(source.AttributeAvatar) > 0 {`
	`102`	`+ if source.AttributeAvatar != "" {`
`103`	`103`	`if err := user_service.UploadAvatar(ctx, user, sr.Avatar); err != nil {`
`104`	`104`	`return user, err`
`105`	`105`	`}`
Original file line number	Diff line number	Diff line change
`@@ -147,7 +147,7 @@ func bindUser(l *ldap.Conn, userDN, passwd string) error {`
`147`	`147`	`}`
`148`	`148`
`149`	`149`	`func checkAdmin(l ldap.Conn, ls Source, userDN string) bool {`
`150`		`- if len(ls.AdminFilter) == 0 {`
	`150`	`+ if ls.AdminFilter == "" {`
`151`	`151`	`return false`
`152`	`152`	`}`
`153`	`153`	`log.Trace("Checking admin with filter %s and base %s", ls.AdminFilter, userDN)`
`@@ -169,7 +169,7 @@ func checkAdmin(l ldap.Conn, ls Source, userDN string) bool {`
`169`	`169`	`}`
`170`	`170`
`171`	`171`	`func checkRestricted(l ldap.Conn, ls Source, userDN string) bool {`
`172`		`- if len(ls.RestrictedFilter) == 0 {`
	`172`	`+ if ls.RestrictedFilter == "" {`
`173`	`173`	`return false`
`174`	`174`	`}`
`175`	`175`	`if ls.RestrictedFilter == "*" {`
`@@ -250,8 +250,17 @@ func (source Source) getUserAttributeListedInGroup(entry ldap.Entry) string {`
`250`	`250`
`251`	`251`	`// SearchEntry : search an LDAP source if an entry (name, passwd) is valid and in the specific filter`
`252`	`252`	`func (source Source) SearchEntry(name, passwd string, directBind bool) SearchResult {`
	`253`	`+ if MockedSearchEntry != nil {`
	`254`	`+ return MockedSearchEntry(source, name, passwd, directBind)`
	`255`	`+ }`
	`256`	`+ return realSearchEntry(source, name, passwd, directBind)`
	`257`	`+}`
	`258`	`+`
	`259`	`+var MockedSearchEntry func(source Source, name, passwd string, directBind bool) SearchResult`
	`260`	`+`
	`261`	`+func realSearchEntry(source Source, name, passwd string, directBind bool) SearchResult {`
`253`	`262`	`// See https://tools.ietf.org/search/rfc4513#section-5.1.2`
`254`		`- if len(passwd) == 0 {`
	`263`	`+ if passwd == "" {`
`255`	`264`	`log.Debug("Auth. failed for %s, password cannot be empty", name)`
`256`	`265`	`return nil`
`257`	`266`	`}`
`@@ -323,17 +332,17 @@ func (source Source) SearchEntry(name, passwd string, directBind bool) SearchR`
`323`	`332`	`return nil`
`324`	`333`	`}`
`325`	`334`
`326`		`- isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0`
`327`		`- isAtributeAvatarSet := len(strings.TrimSpace(source.AttributeAvatar)) > 0`
	`335`	`+ isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""`
	`336`	`+ isAttributeAvatarSet := strings.TrimSpace(source.AttributeAvatar) != ""`
`328`	`337`
`329`	`338`	`attribs := []string{source.AttributeUsername, source.AttributeName, source.AttributeSurname, source.AttributeMail}`
`330`		`- if len(strings.TrimSpace(source.UserUID)) > 0 {`
	`339`	`+ if strings.TrimSpace(source.UserUID) != "" {`
`331`	`340`	`attribs = append(attribs, source.UserUID)`
`332`	`341`	`}`
`333`	`342`	`if isAttributeSSHPublicKeySet {`
`334`	`343`	`attribs = append(attribs, source.AttributeSSHPublicKey)`
`335`	`344`	`}`
`336`		`- if isAtributeAvatarSet {`
	`345`	`+ if isAttributeAvatarSet {`
`337`	`346`	`attribs = append(attribs, source.AttributeAvatar)`
`338`	`347`	`}`
`339`	`348`
`@@ -375,7 +384,7 @@ func (source Source) SearchEntry(name, passwd string, directBind bool) SearchR`
`375`	`384`	`isRestricted = checkRestricted(l, source, userDN)`
`376`	`385`	`}`
`377`	`386`
`378`		`- if isAtributeAvatarSet {`
	`387`	`+ if isAttributeAvatarSet {`
`379`	`388`	`Avatar = sr.Entries[0].GetRawAttributeValue(source.AttributeAvatar)`
`380`	`389`	`}`
`381`	`390`
`@@ -440,14 +449,14 @@ func (source Source) SearchEntries() ([]SearchResult, error) {`
`440`	`449`
`441`	`450`	`userFilter := fmt.Sprintf(source.Filter, "*")`
`442`	`451`
`443`		`- isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0`
`444`		`- isAtributeAvatarSet := len(strings.TrimSpace(source.AttributeAvatar)) > 0`
	`452`	`+ isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""`
	`453`	`+ isAttributeAvatarSet := strings.TrimSpace(source.AttributeAvatar) != ""`
`445`	`454`
`446`	`455`	`attribs := []string{source.AttributeUsername, source.AttributeName, source.AttributeSurname, source.AttributeMail, source.UserUID}`
`447`	`456`	`if isAttributeSSHPublicKeySet {`
`448`	`457`	`attribs = append(attribs, source.AttributeSSHPublicKey)`
`449`	`458`	`}`
`450`		`- if isAtributeAvatarSet {`
	`459`	`+ if isAttributeAvatarSet {`
`451`	`460`	`attribs = append(attribs, source.AttributeAvatar)`
`452`	`461`	`}`
`453`	`462`
`@@ -503,7 +512,7 @@ func (source Source) SearchEntries() ([]SearchResult, error) {`
`503`	`512`	`user.SSHPublicKey = v.GetAttributeValues(source.AttributeSSHPublicKey)`
`504`	`513`	`}`
`505`	`514`
`506`		`- if isAtributeAvatarSet {`
	`515`	`+ if isAttributeAvatarSet {`
`507`	`516`	`user.Avatar = v.GetRawAttributeValue(source.AttributeAvatar)`
`508`	`517`	`}`
`509`	`518`
Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,7 @@ import (`
`25`	`25`	`func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`26`	`26`	`log.Trace("Doing: SyncExternalUsers[%s]", source.authSource.Name)`
`27`	`27`
`28`		`- isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0`
	`28`	`+ isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""`
`29`	`29`	`var sshKeysNeedUpdate bool`
`30`	`30`
`31`	`31`	`// Find all users with this login type - FIXME: Should this be an iterator?`
`@@ -86,26 +86,26 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`86`	`86`	`return db.ErrCancelledf("During update of %s before completed update of users", source.authSource.Name)`
`87`	`87`	`default:`
`88`	`88`	`}`
`89`		`- if len(su.Username) == 0 && len(su.Mail) == 0 {`
	`89`	`+ if su.Username == "" && su.Mail == "" {`
`90`	`90`	`continue`
`91`	`91`	`}`
`92`	`92`
`93`	`93`	`var usr *user_model.User`
`94`		`- if len(su.Username) > 0 {`
	`94`	`+ if su.Username != "" {`
`95`	`95`	`usr = usernameUsers[su.LowerName]`
`96`	`96`	`}`
`97`		`- if usr == nil && len(su.Mail) > 0 {`
	`97`	`+ if usr == nil && su.Mail != "" {`
`98`	`98`	`usr = mailUsers[strings.ToLower(su.Mail)]`
`99`	`99`	`}`
`100`	`100`
`101`	`101`	`if usr != nil {`
`102`	`102`	`keepActiveUsers.Add(usr.ID)`
`103`		`- } else if len(su.Username) == 0 {`
	`103`	`+ } else if su.Username == "" {`
`104`	`104`	`// we cannot create the user if su.Username is empty`
`105`	`105`	`continue`
`106`	`106`	`}`
`107`	`107`
`108`		`- if len(su.Mail) == 0 {`
	`108`	`+ if su.Mail == "" {`
`109`	`109`	`su.Mail = fmt.Sprintf("%[email protected]", su.Username)`
`110`	`110`	`}`
`111`	`111`
`@@ -141,7 +141,7 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`141`	`141`	`}`
`142`	`142`	`}`
`143`	`143`
`144`		`- if err == nil && len(source.AttributeAvatar) > 0 {`
	`144`	`+ if err == nil && source.AttributeAvatar != "" {`
`145`	`145`	`_ = user_service.UploadAvatar(ctx, usr, su.Avatar)`
`146`	`146`	`}`
`147`	`147`	`} else if updateExisting {`
`@@ -151,8 +151,8 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`151`	`151`	`}`
`152`	`152`
`153`	`153`	`// Check if user data has changed`
`154`		`- if (len(source.AdminFilter) > 0 && usr.IsAdmin != su.IsAdmin) \|\|`
`155`		`- (len(source.RestrictedFilter) > 0 && usr.IsRestricted != su.IsRestricted) \|\|`
	`154`	`+ if (source.AdminFilter != "" && usr.IsAdmin != su.IsAdmin) \|\|`
	`155`	`+ (source.RestrictedFilter != "" && usr.IsRestricted != su.IsRestricted) \|\|`
`156`	`156`	`!strings.EqualFold(usr.Email, su.Mail) \|\|`
`157`	`157`	`usr.FullName != fullName \|\|`
`158`	`158`	`!usr.IsActive {`
`@@ -180,7 +180,7 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`180`	`180`	`}`
`181`	`181`
`182`	`182`	`if usr.IsUploadAvatarChanged(su.Avatar) {`
`183`		`- if err == nil && len(source.AttributeAvatar) > 0 {`
	`183`	`+ if err == nil && source.AttributeAvatar != "" {`
`184`	`184`	`_ = user_service.UploadAvatar(ctx, usr, su.Avatar)`
`185`	`185`	`}`
`186`	`186`	`}`