Repository: minio/minio (language: go)

Issue:
Can't detach LDAP policy from non existent group
<!--- Provide a general summary of the issue in the Title above -->
After an LDAP group has been deleted, policy associations cannot be removed from it.

## Expected Behavior
I would expect minio to be able to remove but not add policy associations to deleted groups.
<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->

## Current Behavior
`mc: <ERROR> Unable to make LDAP policy association. The specified group does not exist. (Specified group does not exist)`
When running with `--debug` I see(partially redeacted): 
```
mc: <DEBUG> POST /minio/admin/v3/idp/ldap/policy/detach HTTP/1.1
Host: [REDACTED]
User-Agent: MinIO (linux; amd64) madmin-go/2.0.0 mc/RELEASE.2023-11-06T04-19-23Z
Content-Length: 162
Accept-Encoding: zstd,gzip
Authorization: AWS4-HMAC-SHA256 Credential=[REDACTED]/20231109//s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
Content-Type: application/octet-stream
X-Amz-Content-Sha256: 1f950e2f7a20cd2598054a7a045a29fae210a33b8da6d5d449bc56403ca0f0d3
X-Amz-Date: 20231109T171954Z

mc: <DEBUG> HTTP/1.1 404 Not Found
Content-Length: 274
Accept-Ranges: bytes
Content-Type: application/json
Date: Thu, 09 Nov 2023 17:19:54 GMT
Server: MinIO
Strict-Transport-Security: max-age=63072000
Vary: Origin
Vary: Accept-Encoding
X-Amz-Id-2: fa3fa4db3082ada6b1b57308566ced1c9a842ca95c0b70bc9209ca7a6558fa22
X-Amz-Request-Id: 179604143764520E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block

{"Code":"XMinioAdminNoSuchGroup","Message":"The specified group does not exist. (Specified group does not exist)","Resource":"/minio/admin/v3/idp/ldap/policy/detach","RequestId":"179604143764520E","HostId":"[REDACTED]"}
mc: <DEBUG> TLS Certificate found:  [REDACTED]

mc: <ERROR> Unable to make LDAP policy association. The specified group does not exist. (Specified group does not exist)
 (0) idp-ldap-policy-subcommands.go:236 cmd.mainIDPLdapPolicyDetach(..)
 Release-Tag:RELEASE.2023-11-06T04-19-23Z | Commit:011c61b2547e | Host:nick-Virtual-Machine | OS:linux | Arch:amd64 | Lang:go1.21.3 | Mem:67 MiB/84 MiB | Heap:67 MiB/76 MiB.
```

<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->

## Possible Solution
Remove check if the group exists when removing policy assocations.
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->

## Steps to Reproduce (for bugs)
<!--- Provide a link to a live example, or an unambiguous set of steps to -->
<!--- reproduce this bug. Include code to reproduce, if relevant -->
<!--- and make sure you have followed https://github.com/minio/minio/tree/release/docs/debugging to capture relevant logs -->

1. Create a policy association to a LDAP group
2. Delete the group from the LDAP server
3. Try to remove the policy assocation

## Context
<!--- How has this issue affected you? What are you trying to accomplish? -->
<!--- Providing context helps us come up with a solution that is most useful in the real world -->
I am trying to cleanup these policy associations that are left over in minio from some of our groups being deleted. These assocations still appear with `mc idp ldap policy entities <alias>`

## Regression
<!-- Is this issue a regression? (Yes / No) -->
<!-- If Yes, optionally please include minio version or commit id or PR# that caused this regression, if you have these details. -->
No

## Your Environment
<!--- Include as many relevant details about the environment you experienced the bug in -->
* Version used (`minio --version`):
```
minio version RELEASE.2023-11-06T22-26-08Z (commit-id=754f7a8a395e87a744050476d8b16c16af50a800)
Runtime: go1.21.3 linux/amd64
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Copyright: 2015-2023 MinIO, Inc.
```
* Server setup and configuration: Triple node cluster running in podman across 3 machines
* Operating System and version (`uname -a`): `Linux minio 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 x86_64 x86_64 GNU/Linux`


Discussion / hints:

Fix patch:
diff --git a/cmd/iam.go b/cmd/iam.go
index 5eba439af482d..2feadabe1f91b 100644
--- a/cmd/iam.go
+++ b/cmd/iam.go
@@ -1663,18 +1663,25 @@ func (sys *IAMSys) PolicyDBUpdateLDAP(ctx context.Context, isAttach bool,
 			return
 		}
 		if dn == "" {
-			err = errNoSuchUser
-			return
+			// Still attempt to detach if provided user is a DN.
+			if !isAttach && sys.LDAPConfig.IsLDAPUserDN(r.User) {
+				dn = r.User
+			} else {
+				err = errNoSuchUser
+				return
+			}
 		}
 		isGroup = false
 	} else {
-		var exists bool
-		if exists, err = sys.LDAPConfig.DoesGroupDNExist(r.Group); err != nil {
-			logger.LogIf(ctx, err)
-			return
-		} else if !exists {
-			err = errNoSuchGroup
-			return
+		if isAttach {
+			var exists bool
+			if exists, err = sys.LDAPConfig.DoesGroupDNExist(r.Group); err != nil {
+				logger.LogIf(ctx, err)
+				return
+			} else if !exists {
+				err = errNoSuchGroup
+				return
+			}
 		}
 		dn = r.Group
 		isGroup = true


Test patch: