authenticateAndReturnPermittedGroups and authenticate treat "RestrictedGroups" differently

[maheshkelkar]

In LdapAuthenticator::authenticate() - if restrictedGroups is not configured, then intersection of user groups with restrcitedGroups is skipped. As a result user is authenticated successfully.

But, LdapAuthenticator:authenticateAndReturnPermittedGroups - if restrictedGroups is not configured, then intersection is still enforced and resultantly authentication is denied.

IMO, the behavior doesn't match and should be changed from:

   private Set<String> getGroupMembershipsIntersectingWithRestrictedGroups(
   ::
                if (configuration.getRestrictToGroups().contains(group)) {
                        overlappingGroups.add(group);
                }

to:

   private Set<String> getGroupMembershipsIntersectingWithRestrictedGroups(
   ::
                if (configuration.getRestrictToGroups().isEmpty() ||
                            configuration.getRestrictToGroups().contains(group)) {
                        overlappingGroups.add(group);
                }

[chrisgray]

I agree, this makes sense. I'll make this change in the following release.