From e8fd5f6b63a2fba46b501c730839f2fb318cfc8c Mon Sep 17 00:00:00 2001
From: logan <admin@attacker.club>
Date: Sun, 31 May 2026 00:18:43 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20LDAP=E5=AF=BC=E5=85=A5=E7=94=A8=E6=88=B7?=
 =?UTF-8?q?=20auth=5Fsource=20=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- BatchImportLdapUsers: 设置 AuthSource='ldap' + HashedPassword='-' + IsActive=true
- 修正已有 zhangsan/lisi/wangwu 用户 auth_source 从 local 改为 ldap
---
 backend/internal/handler/workflow.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/backend/internal/handler/workflow.go b/backend/internal/handler/workflow.go
index 16aa716..dbc3610 100644
--- a/backend/internal/handler/workflow.go
+++ b/backend/internal/handler/workflow.go
@@ -282,8 +282,6 @@ func BatchImportLdapUsers(c *gin.Context) {
 
 	successCount := 0
 	var errors []string
-	defaultPassword := "admin123"
-	hash, _ := bcrypt.GenerateFromPassword([]byte(defaultPassword), bcrypt.DefaultCost)
 
 	for _, u := range input.Users {
 		// Derive username: uid > username > cn
@@ -322,12 +320,15 @@ func BatchImportLdapUsers(c *gin.Context) {
 			emailPtr = nil
 		}
 
+		isActive := true
 		user := model.User{
 			Username:       username,
 			DisplayName:    displayName,
 			Email:          emailPtr,
-			HashedPassword: string(hash),
+			HashedPassword: "-", // LDAP users don't need local password
 			Role:           "developer",
+			AuthSource:     "ldap",
+			IsActive:       &isActive,
 		}
 		if err := model.DB.Create(&user).Error; err != nil {
 			errors = append(errors, "fail: "+username+" - "+err.Error())