Skip to content

[1.17.0-rc2] LDAP Failed authentication when user CN attribute contains escaped characters #20422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gd197 opened this issue Jul 20, 2022 · 0 comments

Comments

@gd197
Copy link

gd197 commented Jul 20, 2022

Description

When using LDAP with BindDN authentication and configuring the auth source to grab user name from the CN attribute, if the user CN attribute is containing escaped characters (here coma ",") then the authentication fail
`
2022/07/20 11:03:05 ...dap/source_search.go:82:findUserDN() [T] [62d7c4c9] Search for LDAP user: axxxxxx
2022/07/20 11:03:05 ...dap/source_search.go:90:findUserDN() [T] [62d7c4c9] Searching for DN using filter (&(objectClass=user)(sAMAccountName=axxxxxx)) and base ou=PEOPLE,dc=MY,dc=COMPANY,dc=CORP
2022/07/20 11:03:05 ...dap/source_search.go:142:bindUser() [T] [62d7c4c9] Binding with userDN: CN=NAME, SURNAME,OU=Internal,OU=People,DC=my,DC=company,DC=corp
2022/07/20 11:03:05 ...dap/source_search.go:148:bindUser() [T] [62d7c4c9] Bound successfully with userDN: CN=NAME, SURNAME,OU=Internal,OU=People,DC=my,DC=company,DC=corp
2022/07/20 11:03:05 ...dap/source_search.go:353:SearchEntry() [T] [62d7c4c9] Fetching attributes 'cn', 'givenName', 'sn', 'mail', '', '', 'dn' with filter '(&(objectClass=user)(sAMAccountName=axxxxxx))' and base 'CN=NAME, SURNAME,OU=Internal,OU=People,DC=my,DC=company,DC=corp'
2022/07/20 11:03:05 ...dap/source_search.go:156:checkAdmin() [T] [62d7c4c9] Checking admin with filter (memberof=CN=adminusr,OU=ApplicationsManagement,DC=MY,DC=COMPANY,DC=CORP) and base CN=NAME, SURNAME,OU=Internal,OU=People,DC=my,DC=company,DC=corp
2022/07/20 11:03:05 ...vices/auth/signin.go:116:UserSignIn() [W] [62d7c4c9] Failed to login 'axxxx' via 'LDAP': User name is invalid [NAME, SURNAME]: must be valid alpha or numeric or dash(-_) or dot characters
2022/07/20 11:03:05 ...s/context/context.go:218:HTML() [D] [62d7c4c9] Template: user/auth/signin
2022/07/20 11:03:05 ...ers/web/auth/auth.go:200:SignInPost() [I] [62d7c4c9] Failed authentication attempt for axxxxxx from 152.30.1.53:0: user does not exist [uid: 0, name: axxxxxx, keyid: 0]

`
I Guess same issue as for #20181 and probably there since time but I never tested it until today
By removing the CN attribute in the username attribute field, then authentication works

Gitea Version

1.17.0-rc2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

RHEL 7

How are you running Gitea?

Binary from the "release" tab on github

Database

MySQL

@gd197 gd197 added the type/bug label Jul 20, 2022
@gd197 gd197 changed the title [1.17.0-rc2] LDAP Failed authentication when user CN attribute contains coma [1.17.0-rc2] LDAP Failed authentication when user CN attribute contains escaped characters Jul 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants