Automatically strip unnecessary parentheses from custom ldap filters

fixes #9348

application/forms/Config/UserBackend/LdapBackendForm.php

@@ -99,8 +99,8 @@ class LdapBackendForm extends Form
                     . 'Leave empty to not to use any additional filter rules.'
                 ),
                 'requirement'   => $this->translate(
-                    'The filter needs to be expressed as standard LDAP expression, without'
+                    'The filter needs to be expressed as standard LDAP expression.'
-                    . ' outer parentheses. (e.g. &(foo=bar)(bar=foo) or foo=bar)'
+                    . ' (e.g. &(foo=bar)(bar=foo) or foo=bar)'
                 ),
                 'validators'    => array(
                     array(
@@ -108,10 +108,15 @@ class LdapBackendForm extends Form
                         false,
                         array(
                             'callback'  => function ($v) {
-                                return strpos($v, '(') !== 0;
+                                // This is not meant to be a full syntax check. It will just
+                                // ensure that we can safely strip unnecessary parentheses.
+                                $v = trim($v);
+                                return ! $v || $v[0] !== '(' || (
+                                    strpos($v, ')(') !== false ? substr($v, -2) === '))' : substr($v, -1) === ')'
+                                );
                             },
                             'messages'  => array(
-                                'callbackValue' => $this->translate('The filter must not be wrapped in parantheses.')
+                                'callbackValue' => $this->translate('The filter is invalid. Please check your syntax.')
                             )
                         )
                     )

library/Icinga/Authentication/User/LdapUserBackend.php

@@ -148,6 +148,10 @@ class LdapUserBackend extends LdapRepository implements UserBackendInterface
     public function setFilter($filter)
     {
         if (($filter = trim($filter))) {
+            if ($filter[0] === '(') {
+                $filter = substr($filter, 1, -1);
+            }
+
             $this->filter = $filter;
         }
 

library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php

@@ -356,6 +356,10 @@ class LdapUserGroupBackend /*extends LdapRepository*/ implements UserGroupBacken
     public function setUserFilter($filter)
     {
         if (($filter = trim($filter))) {
+            if ($filter[0] === '(') {
+                $filter = substr($filter, 1, -1);
+            }
+
             $this->userFilter = $filter;
         }