Add support to map a LDAP group to multiple roles (#23849)

Co-authored-by: Pierre Lehnen <pierre.lehnen@rocket.chat>

apps/meteor/ee/server/lib/ldap/Manager.ts

@@ -15,6 +15,7 @@ import { templateVarHandler } from '../../../../app/utils/lib/templateVarHandler
 import { addUserToRoom, removeUserFromRoom, createRoom } from '../../../../app/lib/server/functions';
 import { syncUserRoles } from '../syncUserRoles';
 import { Team } from '../../../../server/sdk';
+import { ensureArray } from '../../../../lib/utils/arrayUtils';
 
 export class LDAPEEManager extends LDAPManager {
 	public static async sync(): Promise<void> {
@@ -221,13 +222,16 @@ export class LDAPEEManager extends LDAPManager {
 				continue;
 			}
 
-			const userField = fieldMap[ldapField];
-			const [roleId] = userField.split(/\.(.+)/);
-			allowedRoles.push(roleId);
+			const userFields = ensureArray<string>(fieldMap[ldapField]);
 
-			if (await this.isUserInGroup(ldap, syncUserRolesBaseDN, syncUserRolesFilter, { dn, username }, ldapField)) {
-				roleList.push(roleId);
-				continue;
+			for await (const userField of userFields) {
+				const [roleId] = userField.split(/\.(.+)/);
+				allowedRoles.push(roleId);
+
+				if (await this.isUserInGroup(ldap, syncUserRolesBaseDN, syncUserRolesFilter, { dn, username }, ldapField)) {
+					roleList.push(roleId);
+					continue;
+				}
 			}
 		}
 

apps/meteor/packages/rocketchat-i18n/i18n/ar.i18n.json

@@ -2615,7 +2615,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "عامل تصفية مجموعة المستخدمين",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "يستخدم عامل تصفية بحث LDAP للتحقق مما إذا كان المستخدم في مجموعة.",
   "LDAP_Sync_User_Data_RolesMap": "خريطة مجموعة بيانات المستخدم",
-  "LDAP_Sync_User_Data_RolesMap_Description": "تعيين مجموعات LDAP إلى أدوار مستخدم Rocket.Chat <br/>كمثال، \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}\" سيعين مجموعة LDAP لمسؤول rocket إلى دور \"مسؤول\" Rocket.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "تعيين مجموعات LDAP إلى أدوار مستخدم Rocket.Chat <br/>كمثال، \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}\" سيعين مجموعة LDAP لمسؤول rocket إلى دور \"مسؤول\" Rocket.",
   "LDAP_Teams_BaseDN": "الاسم المميز الأساسي لفِرَق LDAP",
   "LDAP_Teams_BaseDN_Description": "يُستخدم الاسم المميز الأساسي لـ LDAP للبحث عن فِرَق المستخدمين.",
   "LDAP_Teams_Name_Field": "سمة اسم فريق LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/ca.i18n.json

@@ -2611,7 +2611,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtre de grups d'usuaris",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "El filtre de cerca LDAP que s'usa per verificar si un usuari està en un grup.",
   "LDAP_Sync_User_Data_RolesMap": "Mapa de grup de dades d'usuari",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Mapeja els grups LDAP als rols d'usuari de Rocket.Chat <br/> Com a exemple, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` mapejarà el grup LDAP de rocket- admin a el paper de \"admin\" de Rocket.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Mapeja els grups LDAP als rols d'usuari de Rocket.Chat <br/> Com a exemple, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` mapejarà el grup LDAP de rocket- admin a el paper de \"admin\" de Rocket.",
   "LDAP_Teams_BaseDN": "Equips LDAP BaseDN",
   "LDAP_Teams_BaseDN_Description": "El LDAP BaseDN utilitza't per a cercar equips d'usuari.",
   "LDAP_Teams_Name_Field": "Atribut Nom de l'equip LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/cs.i18n.json

@@ -2204,7 +2204,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtr skupiny uživatelů",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Vyhledávací filtr LDAP používaný ke kontrole, zda je uživatel ve skupině.",
   "LDAP_Sync_User_Data_RolesMap": "Mapa skupin uživatelských dat",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Mapuje skupiny LDAP na Rocket.Chat uživatelské role <br/>Jako příklad bude \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}\" mapovat skupinu LDAP Rocket-admin do role „admin“ v Rocket.Chat.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Mapuje skupiny LDAP na Rocket.Chat uživatelské role <br/>Jako příklad bude \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}\" mapovat skupinu LDAP Rocket-admin do role „admin“ v Rocket.Chat.",
   "LDAP_Timeout": "Časový limit (ms)",
   "LDAP_Timeout_Description": "Kolik milisekund počkat na vyhledávání než bude vrácena chyba",
   "LDAP_Unique_Identifier_Field": "Jedinečný identifikátor",

apps/meteor/packages/rocketchat-i18n/i18n/da.i18n.json

@@ -2215,7 +2215,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Brugergruppefilter",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "LDAP-søgefilteret der bruges til at kontrollere om en bruger er i en gruppe.",
   "LDAP_Sync_User_Data_RolesMap": "Brugerdata-gruppeoversigt",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Relatér LDAP-grupper til Rocket.Chat-brugerroller <br/> F.eks. vil '{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}' relatere rocket-admin-LDAP-gruppen til Rockets \"admin\" -rolle.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Relatér LDAP-grupper til Rocket.Chat-brugerroller <br/> F.eks. vil '{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}' relatere rocket-admin-LDAP-gruppen til Rockets \"admin\" -rolle.",
   "LDAP_Timeout": "Timeout (ms)",
   "LDAP_Timeout_Description": "Hvor mange mileseconds venter på et søgeresultat, før du returnerer en fejl",
   "LDAP_Unique_Identifier_Field": "Unikt identifikationsfelt",

apps/meteor/packages/rocketchat-i18n/i18n/de.i18n.json

@@ -2606,7 +2606,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "LDAP-Benutzergruppen-Filter",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Der LDAP-Suchfilter, mit dem überprüft wird, ob sich ein Benutzer in einer Gruppe befindet.",
   "LDAP_Sync_User_Data_RolesMap": "Benutzerdatengruppenzuordnung",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Ordnen Sie LDAP-Gruppen zu Rocket.Chat Benutzerrollen <br/> Als Beispiel ordnet {\"rocket-admin\":\"admin\", \"tech-support\":\"support\"} die LDAP-Gruppe von rocket-admin als \"admin\" zu.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Ordnen Sie LDAP-Gruppen zu Rocket.Chat Benutzerrollen <br/> Als Beispiel ordnet {\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]} die LDAP-Gruppe von rocket-admin als \"admin\" zu.",
   "LDAP_Teams_BaseDN": "LDAP-BaseDN von Teams",
   "LDAP_Teams_BaseDN_Description": "Mit der LDAP-BaseDN wurde nach Benutzer-Teams gesucht.",
   "LDAP_Teams_Name_Field": "LDAP-Attribut des Team-Namens",

apps/meteor/packages/rocketchat-i18n/i18n/en.i18n.json

@@ -2644,7 +2644,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "User Group Filter",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "The LDAP search filter used to check if a user is in a group.",
   "LDAP_Sync_User_Data_RolesMap": "User Data Group Map",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Map LDAP groups to Rocket.Chat user roles <br/>As an example, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` will map the rocket-admin LDAP group to Rocket's \"admin\" role.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Map LDAP groups to Rocket.Chat user roles <br/>As an example, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` will map the rocket-admin LDAP group to Rocket's \"admin\" role.",
   "LDAP_Teams_BaseDN": "LDAP Teams BaseDN",
   "LDAP_Teams_BaseDN_Description": "The LDAP BaseDN used to lookup user teams.",
   "LDAP_Teams_Name_Field": "LDAP Team Name Attribute",

apps/meteor/packages/rocketchat-i18n/i18n/es.i18n.json

@@ -2606,7 +2606,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtro de grupo de usuarios",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Filtro de búsqueda LDAP que se usa para verificar si un usuario está en un grupo.",
   "LDAP_Sync_User_Data_RolesMap": "Asignación de grupos de datos de usuario",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Asigna grupos LDAP a roles de usuario de Rocket.Chat. <br/>Por ejemplo, \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}\" asignará el grupo LDAP de rocket-admin al rol de \"admin\" de Rocket.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Asigna grupos LDAP a roles de usuario de Rocket.Chat. <br/>Por ejemplo, \"{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}\" asignará el grupo LDAP de rocket-admin al rol de \"admin\" de Rocket.",
   "LDAP_Teams_BaseDN": "DN base de equipos de LDAP",
   "LDAP_Teams_BaseDN_Description": "DN base de LDAP usado para buscar equipos de usuarios.",
   "LDAP_Teams_Name_Field": "Atributo de nombre de equipo LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/fr.i18n.json

@@ -2615,7 +2615,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtre de groupe d'utilisateurs",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Filtre de recherche LDAP utilisé pour vérifier si un utilisateur fait partie d'un groupe.",
   "LDAP_Sync_User_Data_RolesMap": "Mappage de groupes de données utilisateur",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Mappe les groupes LDAP aux rôles des utilisateurs Rocket.Chat <br/>Par exemple, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` mappe le groupe LDAP \"rocket-admin\" au rôle Rocket \"admin\".",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Mappe les groupes LDAP aux rôles des utilisateurs Rocket.Chat <br/>Par exemple, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` mappe le groupe LDAP \"rocket-admin\" au rôle Rocket \"admin\".",
   "LDAP_Teams_BaseDN": "DN de base des équipes LDAP",
   "LDAP_Teams_BaseDN_Description": "DN de base LDAP utilisé pour rechercher des équipes d'utilisateurs.",
   "LDAP_Teams_Name_Field": "Attribut de nom d'équipe LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/ja.i18n.json

@@ -2607,7 +2607,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "ユーザーグループフィルター",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "ユーザーがグループに属しているかどうかを確認するためのLDAP検索フィルター。",
   "LDAP_Sync_User_Data_RolesMap": "ユーザーデータグループマップ",
-  "LDAP_Sync_User_Data_RolesMap_Description": "LDAPグループをRocket.Chatユーザーロールにマッピングします<br/>例：「{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}」は、rocket-admin LDAPグループをRocketの「admin」ロールにマッピングします。",
+  "LDAP_Sync_User_Data_RolesMap_Description": "LDAPグループをRocket.Chatユーザーロールにマッピングします<br/>例：「{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}」は、rocket-admin LDAPグループをRocketの「admin」ロールにマッピングします。",
   "LDAP_Teams_BaseDN": "LDAPチームのBaseDN",
   "LDAP_Teams_BaseDN_Description": "ユーザーチームの検索用のLDAP BaseDN。",
   "LDAP_Teams_Name_Field": "LDAPチーム名の属性",

apps/meteor/packages/rocketchat-i18n/i18n/ka-GE.i18n.json

@@ -2091,7 +2091,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "მომხმარებელთა ჯგუფის ფილტრი",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "LDAP საძიებო ფილტრი გამოიყენება იმის შესამოწმებლად, თუ მომხმარებელი ჯგუფშია.",
   "LDAP_Sync_User_Data_RolesMap": "მომხმარებელთა მონაცემთა ჯგუფის რუკა",
-  "LDAP_Sync_User_Data_RolesMap_Description": "LDAP ჯგუფების დატანა Rocket.Chat-ის მომხმარებელთა როლებზე <br/> მაგალითად, {\"rocket-admin\":\"admin\", \"tech-support\":\"support\"} დაიტანს rocket-admin LDAP ჯგუფს Rocket's-ის ადმინის როლად",
+  "LDAP_Sync_User_Data_RolesMap_Description": "LDAP ჯგუფების დატანა Rocket.Chat-ის მომხმარებელთა როლებზე <br/> მაგალითად, {\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]} დაიტანს rocket-admin LDAP ჯგუფს Rocket's-ის ადმინის როლად",
   "LDAP_Timeout": "ტაიმაუტი (მილიწამები)",
   "LDAP_Timeout_Description": "რამდენი მილიწამი დაელოდოს ძიების შედეგს სანამ შეცდომას დააბრუნებს",
   "LDAP_Unique_Identifier_Field": "უნიკალური საიდენტიფიკაციო ველი",

apps/meteor/packages/rocketchat-i18n/i18n/ko.i18n.json

@@ -2262,7 +2262,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "사용자 그룹 필터",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "사용자가 그룹에 존재하는지 확인하는 데 사용되는 LDAP 검색 필터입니다.",
   "LDAP_Sync_User_Data_RolesMap": "사용자 데이터 그룹 배치",
-  "LDAP_Sync_User_Data_RolesMap_Description": "LDAP 그룹을 Rocket에 매핑합니다. 채팅 사용자 역할 <br/> 예를 들어, [{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}`은 rocket-admin LDAP 그룹을 Rocket의 \"admin\"역할에 매핑합니다.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "LDAP 그룹을 Rocket에 매핑합니다. 채팅 사용자 역할 <br/> 예를 들어, [{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}`은 rocket-admin LDAP 그룹을 Rocket의 \"admin\"역할에 매핑합니다.",
   "LDAP_Timeout": "제한 시간 (밀리 초)",
   "LDAP_Timeout_Description": "오류를 반환하기 전에 검색 결과를 기다리는 시간 (mileeconds)",
   "LDAP_Unique_Identifier_Field": "고유 식별자 필드",

apps/meteor/packages/rocketchat-i18n/i18n/nl.i18n.json

@@ -2615,7 +2615,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Gebruikersgroepfilter",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Het LDAP-zoekfilter dat wordt gebruikt om te controleren of een gebruiker deel uitmaakt van een groep.",
   "LDAP_Sync_User_Data_RolesMap": "User Data Group Map",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Wijs LDAP-groepen toe aan Rocket.Chat-gebruikersrollen <br/>Als voorbeeld zal `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` de rocket-admin LDAP-groep toewijzen aan Rocket's rol \"admin\".",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Wijs LDAP-groepen toe aan Rocket.Chat-gebruikersrollen <br/>Als voorbeeld zal `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` de rocket-admin LDAP-groep toewijzen aan Rocket's rol \"admin\".",
   "LDAP_Teams_BaseDN": "LDAP-teams BaseDN",
   "LDAP_Teams_BaseDN_Description": "De LDAP BaseDN gebruikt om gebruikersteams op te zoeken.",
   "LDAP_Teams_Name_Field": "LDAP-teamnaam attribuut",

apps/meteor/packages/rocketchat-i18n/i18n/pl.i18n.json

@@ -2604,7 +2604,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtr grupy użytkowników",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Filtr wyszukiwania LDAP służy do sprawdzania, czy użytkownik znajduje się w grupie.",
   "LDAP_Sync_User_Data_RolesMap": "User Data Group Map",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Mapuj grupy LDAP do ról użytkownika Rocket.Chat <br/>Na przykład, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` zmapuje grupę LDAP \"rocket-admin\" do roli \"admin\" Rocketa.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Mapuj grupy LDAP do ról użytkownika Rocket.Chat <br/>Na przykład, `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` zmapuje grupę LDAP \"rocket-admin\" do roli \"admin\" Rocketa.",
   "LDAP_Teams_BaseDN": "BaseDN zespołów LDAP",
   "LDAP_Teams_BaseDN_Description": "LDAP BaseDN używany do wyszukiwania zespołów użytkowników.",
   "LDAP_Teams_Name_Field": "Atrybut nazwy zespołu LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/pt-BR.i18n.json

@@ -2615,7 +2615,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Filtro de grupo de usuário",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "O filtro de busca LDAP usado para verificar se um usuário está em um grupo.",
   "LDAP_Sync_User_Data_RolesMap": "Mapeamento de grupo de dados de usuário",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Mapeia grupos LDAP para funções de usuário do Rocket.Chat <br/>Por exemplo,  ` {\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` mapeará o grupo LDAP rocket-admin para a função de \"admin\" do Rocket.Chat.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Mapeia grupos LDAP para funções de usuário do Rocket.Chat <br/>Por exemplo,  ` {\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` mapeará o grupo LDAP rocket-admin para a função de \"admin\" do Rocket.Chat.",
   "LDAP_Teams_BaseDN": "BaseDN do LDAP de equipes",
   "LDAP_Teams_BaseDN_Description": "A BaseDN do LDAP usada para procurar equipes do usuário",
   "LDAP_Teams_Name_Field": "Atributo de nome da equipe do LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/ru.i18n.json

@@ -2615,7 +2615,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "Фильтр Группы Пользователей",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "Фильтр поиска LDAP используется для проверки того, входит ли пользователь в группу.",
   "LDAP_Sync_User_Data_RolesMap": "Карта группы пользовательских данных",
-  "LDAP_Sync_User_Data_RolesMap_Description": "Сопоставьте группы LDAP с ролями пользователей Rocket.Chat <br/>В качестве примера `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}` сопоставит группу LDAP rocket-admin с ролью \"admin\" в Rocket Chat.",
+  "LDAP_Sync_User_Data_RolesMap_Description": "Сопоставьте группы LDAP с ролями пользователей Rocket.Chat <br/>В качестве примера `{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}` сопоставит группу LDAP rocket-admin с ролью \"admin\" в Rocket Chat.",
   "LDAP_Teams_BaseDN": "BaseDN рабочих групп LDAP",
   "LDAP_Teams_BaseDN_Description": "BaseDN LDAP используется для поиска рабочих групп пользователей.",
   "LDAP_Teams_Name_Field": "Атрибут названия рабочей группы LDAP",

apps/meteor/packages/rocketchat-i18n/i18n/zh-TW.i18n.json

@@ -2553,7 +2553,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "使用者群組過濾",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "LDAP 搜尋過濾已使用在假如使用者在群組時檢查。",
   "LDAP_Sync_User_Data_RolesMap": "使用者資料群組對應",
-  "LDAP_Sync_User_Data_RolesMap_Description": "將 LDAP 群組對應到 Rocket.Chat 使用者角色<br/>例如，`{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}`將 rocket-admin LDAP 群組對應到Rocket 的 “admin” 角色。",
+  "LDAP_Sync_User_Data_RolesMap_Description": "將 LDAP 群組對應到 Rocket.Chat 使用者角色<br/>例如，`{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}`將 rocket-admin LDAP 群組對應到Rocket 的 “admin” 角色。",
   "LDAP_Teams_BaseDN": "LDAP 團體 BaseDN",
   "LDAP_Teams_BaseDN_Description": "此 LDAP BaseDN 已使用去查詢使用者的團體。",
   "LDAP_Teams_Name_Field": "LDAP 團體名稱屬性",

apps/meteor/packages/rocketchat-i18n/i18n/zh.i18n.json

@@ -2300,7 +2300,7 @@
   "LDAP_Sync_User_Data_Roles_Filter": "用户组过滤器",
   "LDAP_Sync_User_Data_Roles_Filter_Description": "LDAP搜索过滤器，用于检查用户是否在组中。",
   "LDAP_Sync_User_Data_RolesMap": "用户数据群组对应",
-  "LDAP_Sync_User_Data_RolesMap_Description": "将LDAP组对应到Rocket.Chat用户角色<br/>例如，`{\"rocket-admin\":\"admin\", \"tech-support\":\"support\"}`会将rocket-admin LDAP组对应到Rocket.Chat的“管理员”角色。",
+  "LDAP_Sync_User_Data_RolesMap_Description": "将LDAP组对应到Rocket.Chat用户角色<br/>例如，`{\"rocket-admin\":\"admin\", \"tech-support\":\"support\", \"manager\":[\"leader\", \"moderator\"]}`会将rocket-admin LDAP组对应到Rocket.Chat的“管理员”角色。",
   "LDAP_Timeout": "超时（ms）",
   "LDAP_Timeout_Description": "在返回错误之前等待搜索结果多少英里",
   "LDAP_Unique_Identifier_Field": "唯一识别字段",