New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP group mapping: stringwise comparison fails due to different DN formats #1790

Closed
alpha-centauri opened this Issue Feb 9, 2016 · 0 comments

Comments

Projects
None yet
3 participants
@alpha-centauri

alpha-centauri commented Feb 9, 2016

LDAP group mapping is a very appreciated feature for us. Thanks for implementing it!
However, the mapping seems broken if the RDNs are separated without whitespaces in the member attribute of a group (for example "uid=12345,ou=A,o=B").

This is what the trace shows:
TRACE: org.graylog2.security.ldap.LdapConnector - DN uid=12345, ou=A, o=B == uid=12345,ou=A,o=B member?

In LdapConnector.findGroups, the DN of ldapEntry is compared stringswise with each member attribute of a group:

if (dn.equalsIgnoreCase(member.getString())) {
    groups.add(groupId);
}

Since org.apache.directory.api.ldap.model.name.Dn.getName() returns a string where RDNs are separated by comma and whitespace, the strings do not match although the DNs are semantically equal.

According to RFC 2253, whitespaces are allowed between RDNs while RFC 4514 defines the string representation without whitespaces. So maybe you could remove whitespaces from the strings before comparing them by something like replaceAll("\\s","") or replaceAll(",\\s",","). Perhaps parsing DNs would be another solution.

PS: We are using Graylog 1.3.3

@bernd bernd added bug S3 P2 ldap labels Feb 11, 2016

@bernd bernd added this to the 2.0.0 milestone Feb 11, 2016

@kroepke kroepke modified the milestones: 2.0.0, 2.1.0 May 2, 2016

bernd added a commit that referenced this issue Jul 14, 2016

Fix group membership lookup if DN contains whitespace
Normalize the DN before comparing the strings to avoid mapping problems
if the DNs have different whitespace formatting.

Fixes #1790

@bernd bernd self-assigned this Jul 14, 2016

@joschi joschi closed this in #2484 Jul 15, 2016

joschi added a commit that referenced this issue Jul 15, 2016

Fix group membership lookup if DN contains whitespace (#2484)
Normalize the DN before comparing the strings to avoid mapping problems
if the DNs have different whitespace formatting.

Fixes #1790

@kroepke kroepke added the triaged label Sep 21, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment