Fixed issue #17654 : spurious error "Incorrect username …" in webserver Auth

[Shnoulle]

Fixed issue #18169: Potential redirect loop with Authwebserver
Dev: Add optional param \LimeSurvey\PluginManager\PluginEvent when potentially needed

[Shnoulle]

Update API version … new feature in API : 5.4

[Shnoulle]

Error: '/home/runner/work/LimeSurvey/LimeSurvey/third_party/composer/tmp-39795d923d59d80ad603e95578ec9345' is a corrupted zip archive (0 bytes), try again. thi nk it's not related with the commit ;)

[gabrieljenik]

Code structure looks OK. Haven't tested it

[olleharstedt]

@Shnoulle Did you test your own PR? o0

[Shnoulle]

I check again after last commit,

Else : https://bugs.limesurvey.org/view.php?id=17654#c67723

[olleharstedt]

Really, a developer testing his/her own stuff is not a valid test...

[Shnoulle]

Really, a developer testing his/her own stuff is not a valid test...

prigaux test the previous one #2170
But let's go to have another test with this one

[Shnoulle]

Connect as superadmin (and stay connected)
Create an user TEST for login , just give him right to connect via AuthDB
configure Authwebserver to get user by $_SERVER['TEST_USER'];
update config.php and add $_SERVER['TEST_USER'] = 'TEST'; at start
Open another browser, go to limesurvey admin page

Ad check with removing TEST user with autocreate and without.

https://bugs.limesurvey.org/view.php?id=18169

[brenard]

Hello, in case of an upgrade if a limesurvey instance using Authserver, I reproduce this bug : my users haven't the auth_webserver permission and have a loop during their authentication.

My diagnostic was complexified because in the admin interface, when I try to edit their permissions, the corresponding permission is checked (even if I can't find it in database). By saving permissions of this user, without changing anything, the permission is effectively added in database and the user is enabled to connect. Do you think it could be also fixed ?

Futhermore, in my case, I didn't find a proper solution to bulk add the missing permission to my users. When trying to fix it, I found this post suggering to add the $config['auth_webserver'] = true; in config.php to make new users to automatically have this permission. This parameter already exists in config-defaults.php and the documentation specify that it is to do, but I thought I'd understood that all parameters have been migrating in the plugin configuration. Moreover, in the plugin code, the permission is automatically added to all users. I think to documentaion and help center isn't uptodate.

To finish, if you have any advice to how to add the missing permission after upgrading, it could be useful for me (and idealy documented in upgrade process).

[Shnoulle]

Hello, in case of an upgrade if a limesurvey instance using Authserver, I reproduce this bug : my users haven't the auth_webserver permission and have a loop during their authentication.

Can you test with this commit ?
This commit must fix this issue …

[brenard]

Hello, in case of an upgrade if a limesurvey instance using Authserver, I reproduce this bug : my users haven't the auth_webserver permission and have a loop during their authentication.

Can you test with this commit ? This commit must fix this issue …

I just test your commits by patching the two files and it seem working great : existing users without the auth_webserver permission could login. I'm not sure to understand how it's work because, in beforeLogin() method, you seem authorized only existing users with the auth_webserver permission or inexisting user when autocreate is enabled.

[Shnoulle]

Hello, in case of an upgrade if a limesurvey instance using Authserver, I reproduce this bug : my users haven't the auth_webserver permission and have a loop during their authentication.

Can you test with this commit ? This commit must fix this issue …

I just test your commits by patching the two files and it seem working great : existing users without the auth_webserver permission could login. I'm not sure to understand how it's work because, in beforeLogin() method, you seem authorized only existing users with the auth_webserver permission or inexisting user when autocreate is enabled.

Yes it's the case. And if you set AuthWeb by default : throw a clean 401. Else : leave AuthDB doing his own task.

[brenard]

Yes it's the case. And if you set AuthWeb by default : throw a clean 401. Else : leave AuthDB doing his own task.

OK, so it seem not working as expected unless the auth_webserver permission is defaulty enabled to all users.

In my case, with an user without the auth_webserver permission (check in DB) and AuthWeb set by default, I haven't the expected 401 error.

By adding some debug in your code, I see that the Permission::model()->hasGlobalPermission() check return True, so this suggests that the permission is true by default, but is this the expected behavior? If so, I don't understand the interest of this permission because I don't see how we could disable it.

[Shnoulle]

If i don't make error Permission::model()->hasGlobalPermission('auth_webserver', 'read', $oUser->uid) return true for superadmin user.

It's the case here ?

Show the Permission settings for this user.

[brenard]

If i don't make error Permission::model()->hasGlobalPermission('auth_webserver', 'read', $oUser->uid) return true for superadmin user.

It's the case here ?

You're right ! I try with another user (not superadmin) and I have the 401 error. So it's seem work as expected.

Do you have any advice to how to bulk adding the missing permission to my users ? As said before, it could be great to document a good method in the upgrade process.

[Shnoulle]

Do you have any advice to how to bulk adding the missing permission to my users ? As said before, it could be great to document a good method in the upgrade process.

No … except db update via direct SQL

[Shnoulle]

@olleharstedt i remove the need testing part …

[olleharstedt]

Should be merged to develop?

[Shnoulle]

Should be merged to develop?

There are real issue currently with WebAuth … with or without WebAuth set as default.

This one for example : https://bugs.limesurvey.org/view.php?id=18169 if user is set by SERVER : always get a loop (if it don't have the right to connect to AuthWeb)