Prevent User LDAP filter from leaking into group lookupById - #48234

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/query/internal/LDAPQuery.java:88

• userQuery is ambiguous: it reads like 'this query returns users', but it actually controls whether the custom user search filter is applied during lookupById. Consider renaming to something explicit (e.g., applyCustomUserSearchFilterToLookupById or applyCustomUserFilter) so callers don’t accidentally mis-set it.

    // When true, the custom User LDAP filter from federation settings will be applied
    // to lookupById queries. Should only be true for user searches, not group/role searches.
    private boolean userQuery = false;

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/query/internal/LDAPQuery.java:101

• userQuery is ambiguous: it reads like 'this query returns users', but it actually controls whether the custom user search filter is applied during lookupById. Consider renaming to something explicit (e.g., applyCustomUserSearchFilterToLookupById or applyCustomUserFilter) so callers don’t accidentally mis-set it.

    public boolean isUserQuery() {
        return userQuery;
    }

    public LDAPQuery setUserQuery(boolean userQuery) {
        this.userQuery = userQuery;
        return this;
    }

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java:270

• This change makes lookupById apply customUserSearchFilter only when identityQuery.isUserQuery() is true, but LDAPQuery.userQuery defaults to false. Any user-facing query path that triggers the UUID fast-path but does not go through LDAPUtils.createQueryForUserSearch(...) (and therefore doesn’t set userQuery=true) will now bypass the custom user search filter. If the filter is intended to restrict all user resolution (including by ID), consider defaulting the flag to 'apply' for user queries by construction (e.g., set it in all user-query factories / constructors), or replacing the boolean with a more explicit query type/intent that cannot be forgotten.

                                .lookupById(baseDN, equalCondition.getValue().toString(), identityQuery.getReturningLdapAttributes(), identityQuery.isUserQuery());

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:406

• The default overloads still apply the custom user filter (true) even though this API can be used for non-user entities (as this PR highlights). To reduce the chance of future call sites reintroducing the bug, consider making the intent explicit in the API (e.g., providing a clearly named method for user lookups vs non-user lookups, or renaming applyCustomUserFilter to applyCustomUserSearchFilter and adding Javadoc stating the default overload is only appropriate for user queries).

    public Condition getFilterById(String id) {
        return getFilterById(id, true);
    }

    public Condition getFilterById(String id, boolean applyCustomUserFilter) {

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:432

• The default overloads still apply the custom user filter (true) even though this API can be used for non-user entities (as this PR highlights). To reduce the chance of future call sites reintroducing the bug, consider making the intent explicit in the API (e.g., providing a clearly named method for user lookups vs non-user lookups, or renaming applyCustomUserFilter to applyCustomUserSearchFilter and adding Javadoc stating the default overload is only appropriate for user queries).

        if (applyCustomUserFilter && config.getCustomUserSearchFilter() != null) {
            return builder.andCondition(new Condition[]{conditionId, builder.addCustomLDAPFilter(config.getCustomUserSearchFilter())});
        } else {
            return conditionId;
        }
    }

    public SearchResult lookupById(final LdapName baseDN, final String id, final Collection<String> returningAttributes) {
        return lookupById(baseDN, id, returningAttributes, true);
    }

    public SearchResult lookupById(final LdapName baseDN, final String id, final Collection<String> returningAttributes, final boolean applyCustomUserFilter) {
        final String filter = getFilterById(id, applyCustomUserFilter).toFilter();