Account provider Bind DN validation error

[DavidePrincipi]

The Edit provider input form fails to validate the Bind DN / password credentials against a remote AD accounts provider.

Steps to reproduce

• Configure a remote AD accounts provider
• Enter the credentials for LDAP applications. Use the DOMAIN\user Bind DN syntax

Expected behavior

The credentials must be accepted in both DOMAIN\user and user@realm form

Actual behavior

That Bind DN DOMAIN\user syntax is rejected.

Instead if user@realm form is used the password is accepted.

The remote MS AD provider accepts both forms:

 ldapwhoami -w 'secr3t'  -D 'MYDOM\ldapuser' -H ldap://dc1.mydom.tld
 u:MYDOM\ldapuser
 ldapwhoami -w 'secr3t'  -D 'ldapuser@mydom.tld' -H ldap://dc1.mydom.tld
 u:MYDOM\ldapuser

Note that both DN syntaxes map to the same user name.

Components

nethserver-sssd-1.7.1-1.ns7.noarch

---

Thanks to @lucagasparini

[stephdl]

the good practice is to use the user principal name (UPN) , the proposed format is inherited of NETBIOS and limited to 15 characters. Not sure but it could bring more issues than we want to solve.

Some characters are prohibited too like _

[stephdl]

We send to the API

[root@backup ~]# echo '{"StartTls":"enabled","BindPassword":"password","BaseDN":"DC=ad,DC=domain,DC=fr","BindDN":"domain\\administrator","LdapURI":"ldap://nsdc-server.ad.domain.fr","UserDN":"DC=ad,DC=domain,DC=fr","GroupDN":"DC=ad,DC=domain,DC=fr","action":"bind-credentials"}' | /usr/bin/sudo /usr/libexec/nethserver/api/system-accounts-provider/validate

but the api prints

domain\administrator{"type":"NotValid","message":"validation_failed","attributes":[{"parameter":"BindDN","value":null,"error":"domainadministratorldap-credentials,ldaptestbind,49"}]}

/usr/libexec/nethserver/api/system-accounts-provider/validate print $data['BindDN' = domain\administrator
/etc/e-smith/validators/ldap-credentials/S20ldaptestbind prints domainadministrator

The culprit is there

[stephdl]

QA

test the bug is not more reproducible, you can use a netbios way to set an AD user : DOMAIN\administrator

[nethbot]

in 7.9.2009/testing:

• nethserver-cockpit-1.10.1-1.2.g9ec1cab.ns7.noarch.rpm x86_64 armhfp aarch64
• nethserver-cockpit-lib-1.10.1-1.2.g9ec1cab.ns7.noarch.rpm x86_64 armhfp aarch64

[lucagasparini]

The bug is not reproducible 👍
Now you can use DOMAIN\username for the BindDN

[nethbot]

in 7.9.2009/updates:

• nethserver-cockpit-1.10.2-1.ns7.noarch.rpm x86_64 armhfp aarch64
• nethserver-cockpit-lib-1.10.2-1.ns7.noarch.rpm x86_64 armhfp aarch64

[stephdl]

closed as released