Self Service Login fails if one UserIdResolver is unavailable

[countzero]

Description

The user login to the self service fails if one UserIdResolver is unavailable.

Steps to reproduce

Steps to reproduce the behavior:

1. Install LinOTP 3
2. Add two LDAP UserIdResolvers ActiveDirectory & OpenLDAP
3. Add one realm local with both UserIdResolvers
4. Add a policy Self Service for the realm and both UserIdResolvers
5. Deactivate the access to OpenLDAP (via networking or misconfiguration)
6. Access the Self Service website /selfservice
7. Try to log in with a user account that exists in ActiveDirectory
8. See error in /var/log/linotp/linotp.log

2023-07-04 13:08:37,578 ERROR: userservice login failed: ResolverNotAvailable("Unable to bind to servers ['ldaps://10.0.0.20']") [in /usr/lib/python3/dist-packages/linotp/controllers/userservice.py:1091]

Expected behavior

The user authentication should work if its containing source is available.

The LinOTP system should be resilient against partial outages of secondary systems it is attached to.

Screenshots

Environment

The environment in which the bug can be reproduced:

• LinOTP: 3.2.3-1~bpo10+1
• OS: Debian 10

Additional context

Policy Configuration

curl \
    --insecure \
    --cookie "access_token_cookie=${access_token_cookie}" \
    --header "X-CSRF-TOKEN: ${csrf_access_token}" \
    --data-urlencode "name=Self Service" \
    --data-urlencode "user=ActiveDirectory:,OpenLDAP:" \
    --data-urlencode "action=disable, resync, reset, webprovisionGOOGLEtime" \
    --data-urlencode "scope=selfservice" \
    --data-urlencode "realm=local" \
    --data-urlencode "time=* * * * * *;" \
    --data-urlencode "client=*" \
    --data-urlencode "active=True" \
    https://localhost:5000/system/setPolicy

[lukengda]

Hi @countzero, thanks for reaching out to us and the detailed report! Indeed, this should not be the intended behaviour that you experienced. I am adding the issue to our product backlog to prioritise.

Please note, that if you have an active support subscription, you can reach out to our support team directly via phone or the mail ticket system to receive direct support regarding your issue.