From 96d1c6ff89f99cceb98270ba3089797c0ab67962 Mon Sep 17 00:00:00 2001
From: Michal Fox <me@dualfroz.com>
Date: Sat, 3 Oct 2026 02:10:21 +0200
Subject: [PATCH] fix #6889: ldap sync: use the description of groups as
 comment

Synced users get their comment from the 'comment' attribute, but synced
groups never get one, as only the name and the members of a group are
queried. With FreeIPA for example, groups are described with the
'description' attribute, which is then not visible in Proxmox VE.

Set the comment of a synced group to its description, if it has one.
Like for the attributes of users, an existing comment is overwritten
by the synced one, and kept if the group has no description, unless
'properties' is part of 'remove-vanished'.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
 src/PVE/Auth/LDAP.pm        | 1 +
 src/test/realm_sync_test.pl | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 6a73ee8..f29d1ba 100644
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -387,6 +387,7 @@ sub get_groups {
             }
 
             $ret->{$name} = { users => {} };
+            $ret->{$name}->{comment} = $group->{description} if defined($group->{description});
             foreach my $member (@{ $group->{members} }) {
                 if (my $user = $dnmap->{ lc($member) }) {
                     $ret->{$name}->{users}->{$user} = 1;
diff --git a/src/test/realm_sync_test.pl b/src/test/realm_sync_test.pl
index 10520db..e55b6cb 100644
--- a/src/test/realm_sync_test.pl
+++ b/src/test/realm_sync_test.pl
@@ -36,7 +36,7 @@ my $initialusercfg = {
         },
     },
     groups => {
-        'group1-syncedrealm' => { users => {} },
+        'group1-syncedrealm' => { users => {}, comment => 'outdated comment' },
         'group2-syncedrealm' => { users => {} },
     },
     acl_root => {
@@ -65,6 +65,7 @@ my $sync_response = {
     groups => [
         {
             dn => 'dc=group1,dc=syncedrealm',
+            description => 'First group',
             members => [
                 'uid=user1,dc=syncedrealm',
             ],
@@ -176,6 +177,7 @@ my $tests = [
                     users => {
                         'user1@syncedrealm' => 1,
                     },
+                    comment => 'First group',
                 },
                 'group2-syncedrealm' => { users => {} },
                 'group3-syncedrealm' => { users => {} },
@@ -216,6 +218,7 @@ my $tests = [
                     users => {
                         'user1@syncedrealm' => 1,
                     },
+                    comment => 'First group',
                 },
                 'group3-syncedrealm' => { users => {} },
             },
@@ -260,6 +263,7 @@ my $tests = [
                     users => {
                         'user1@syncedrealm' => 1,
                     },
+                    comment => 'First group',
                 },
                 'group2-syncedrealm' => { users => {} },
                 'group3-syncedrealm' => { users => {} },
@@ -298,6 +302,7 @@ my $tests = [
                     users => {
                         'user1@syncedrealm' => 1,
                     },
+                    comment => 'First group',
                 },
                 'group3-syncedrealm' => { users => {} },
             },
@@ -336,6 +341,7 @@ my $tests = [
                     users => {
                         'user1@syncedrealm' => 1,
                     },
+                    comment => 'First group',
                 },
                 'group3-syncedrealm' => { users => {} },
             },