connector/ldap: hex-encode UserID to ensure it is UTF8

connector/ldap/tweak.go

 package ldap
 
 import (
+	"encoding/hex"
 	"strings"
 
 	"github.com/dexidp/dex/connector"
@@ -9,10 +10,18 @@ import (
 // TweakIdentity adjusts attributes received from the LDAP directory. Don't ask
 // why this is necessary. Just learn to accept it.
 func tweakIdentity(id connector.Identity) connector.Identity {
+	id.UserID = tweakUserID(id)
 	id.Username = tweakName(id)
 	return id
 }
 
+func tweakUserID(id connector.Identity) string {
+	// If the UserID happens to be something that is not valid UTF8 (like
+	// Windows/AD SIDs), it gets mangled during JSON marshaling when saved to
+	// storage. Ensure it is UTF8.
+	return hex.EncodeToString([]byte(id.UserID))
+}
+
 func tweakName(id connector.Identity) string {
 	name := id.Username
 	if name == " " {