From c806099e1b113ccf5f2548db5602ab180217ce18 Mon Sep 17 00:00:00 2001
From: Paolo Schiro <paolo.schiro@kpnqwest.it>
Date: Wed, 10 Jan 2018 10:58:03 +0100
Subject: [PATCH] Avoid including domain users in a group not belonging to a
 domain

Signed-off-by: Alexander A. Klimov <alexander.klimov@icinga.com>

refs #3250
---
 AUTHORS                                                        | 1 +
 .../Icinga/Authentication/UserGroup/LdapUserGroupBackend.php   | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/AUTHORS b/AUTHORS
index bbaa6536c..314331454 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -48,6 +48,7 @@ Mikko Peltokangas <mikko@peltokangas.org>
 Munzir Taha <munzirtaha@gmail.com>
 Nicolai Buchwitz <nicolai.buchwitz@enda.eu>
 Noah Hilverling <noah.hilverling@icinga.com>
+Paolo Schiro <paolo.schiro@kpnqwest.it>
 Paul Richards <paul@minimoo.org>
 Pavlos Daoglou <pdaoglou@gmail.com>
 Pieter Lexis <pieter.lexis@powerdns.com>
diff --git a/library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php b/library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php
index 56c03b4ee..9c76ee5b7 100644
--- a/library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php
+++ b/library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php
@@ -689,6 +689,9 @@ class LdapUserGroupBackend extends LdapRepository implements UserGroupBackendInt
 
             $username = $user->getLocalUsername();
         } else {
+            if ($user->hasDomain()) {
+                return array();
+            }
             $username = $user->getUsername();
         }