LDAP authorization issue: group membership check broken for 'Group Member Type' = 'Username' #462
Comments
paddydoyle
pushed a commit
to paddydoyle/cacti
that referenced
this issue
Mar 21, 2017
Fix the logic for: - Require Group Membership: on - Group Member Type: Username Reverts a change from c5a5e02 which added extra DN search logic to the Username branch, and removed the Username check.
cigamit
added a commit
that referenced
this issue
Mar 22, 2017
LDAP authorization issues: group membership check broken for 'Group Member Type' = 'Username'
|
Please test the commit that was just done. Trying to meet in the middle and improve the log handling at the same time. If it works, we can simply close the pull request. |
|
Hi Jimmy, Yup, d13f1f8 fixes it for me as well. Thanks for the speedy response and fix! Paddy |
|
Thanks for testing too. Every bug makes Cacti better. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi,
We're using cacti on Scientific Linux 6 (old, I know!), and got caught recently with an LDAP authorization bug when RHEL6 upgraded from 0.8.8h to 1.0.4.
The issue occurs with these LDAP settings:
In the apache error logs, we see:
PHP Warning: ldap_get_dn() expects parameter 2 to be resource, boolean given in /usr/share/cacti/lib/ldap.php on line 267After some digging, it seems that commit c5a5e02 flipped the logic between 'Group Member Type: Username' and 'Group Member Type: Distinguished Name', and the expanded DN search code was added to the Username branch (it got rid of Username completely).
I'll submit a fairly small pull request which fixes it.
Thanks,
Paddy
The text was updated successfully, but these errors were encountered: