Support ms-DS-ConsistencyGuid as LDAP sync_field

[danicouso]

Checklist before requesting a review

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

Closes #24332

AuthLDAP only handled the attribute named objectGUID when reading and searching binary GUID values. Any other binary GUID attribute used as sync_field was stored and shown as raw bytes, and user lookups against it returned no results because the LDAP filter was not hex-escaped.

ms-DS-ConsistencyGuid has the same binary layout as objectGUID and is the immutable anchor used in Entra ID Connect hybrid setups, where it survives inter-forest migrations that objectGUID does not.

Changes

The conversion now applies to a small case-insensitive list of binary GUID attribute names (objectguid, ms-ds-consistencyguid) in two places:

• searchUserDn() — the value is hex-escaped before building the LDAP filter, so the directory search actually matches. Without this, user import and synchronization by ms-DS-ConsistencyGuid return no results.
• getFieldValue() — the value read back from the directory is converted to the canonical GUID string for display and storage.

Attribute names are matched case-insensitively per RFC 4512.

Tests

Added to tests/LDAP/AuthLdapTest.php, alongside the existing testGetFieldValue() and testGuidToHex() (both kept untouched as non-regression checks):

• testGetFieldValueConvertsObjectGuidBinary — existing objectGUID conversion still works on binary input.
• testGetFieldValueConvertsMsDsConsistencyGuid — the new attribute.
• testGetFieldValueIsCaseInsensitiveForGuidAttributes — mixed-case name, as it appears in Microsoft documentation.
• testGetFieldValueDoesNotDoubleConvertGuidString — values already in GUID string form are returned unchanged.
• testGuidToHexForBinaryGuidSearch — the hex-escaped form searchUserDn() builds for the LDAP filter.

Verified against a real directory

Tested on a GLPI 11.0.7 instance against an Active Directory with ms-DS-ConsistencyGuid populated on user objects, with the LDAP sync_field set to that attribute.

Before — the value is stored and shown as raw bytes in the LDAP information tab:

After — the same value is rendered as a canonical GUID string:

User synchronization — users are correctly imported and synchronized using ms-DS-ConsistencyGuid as sync_field:

Out of scope

• objectSid uses a different binary layout (SID → SDDL) and would need its own decoder. Happy to address in a follow-up if there is interest.

Local checks

• php -l clean on both files.
• php-cs-fixer fix --dry-run clean against the project config.
• phpstan analyze src/AuthLDAP.php clean.

---

AI-assisted: used an LLM to verify code references and draft the wording; all logic reviewed and authored by me.

[cconard96]

I don't have the type of environment needed to fully test this, but it seems OK.