Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(ticket-537) user bindUser for group detection #247

Closed
wants to merge 3 commits into from

Conversation

RainerW
Copy link
Contributor

@RainerW RainerW commented Mar 23, 2015

This should is a fix for *( https://code.google.com/p/gitblit/issues/detail?id=537) *
-> For security reason a normal user cannot read groups from our LDAP, so in this case the search user has to be used for group/team detection.

would appreciate some feedback :
1: Based on the comment "// Binding will stop any LDAP-Injection Attacks ...." should there be a separate setting for enabling this 'feature', or what actually is a LDAP-Injection Attack?
2: getLdapConnection() should now be called createLdapConnection() ?

Edit:
Original google code ticket is not available anymore?
Problem was:

  • inital ldap bind does work to authenticate the user
  • the new connection was then used to no query the team memberships
    • his works with an AD, but on OpenLDAP a user has not the right's to see the groups
  • so in (our) OpenLDAP setup the Team memberships have to user the 'old' non user ldap connection

@gitblit
Copy link
Collaborator

gitblit commented Mar 23, 2015

At a quick glance you are changing the existing behavior to solve your issue, but you may be breaking other installs. This needs some discussion on the mailing list. Clearly with LDAP what works for some may not work for all - hence the reason for your PR.

RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 2, 2015
     new config key : "realm.ldap.groupQueryWithUser"
@RainerW
Copy link
Contributor Author

RainerW commented Oct 2, 2015

created new branch and extracted new behaviour into it with a config key ( commit f04f891)

RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 8, 2015
RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 8, 2015
@RainerW
Copy link
Contributor Author

RainerW commented Oct 8, 2015

rebased to develop, not sure about the "since 1.7.0" Information in defaults.properties

@gitblit
Copy link
Collaborator

gitblit commented Oct 9, 2015

Hi @RainerW.

Github doesn't allow you to merge a PR to another branch AFAIK i.e. if I merge now, your change will merge to master even though you rebased on develop because master is the branch for which the PR was initially opened.

Having said that, while your change solves your problem and may solve #920, I don't like this solution - changing the behavior of isAuthenticated. If the problem is related to group/team search then the fix should be isolated to the connection used in getTeamsFromLdap.

@gitblit gitblit closed this Oct 9, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants