New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(ticket-537) user bindUser for group detection #247

Closed
wants to merge 3 commits into
base: master
from

Conversation

Projects
None yet
2 participants
@RainerW
Contributor

RainerW commented Mar 23, 2015

This should is a fix for *( https://code.google.com/p/gitblit/issues/detail?id=537) *
-> For security reason a normal user cannot read groups from our LDAP, so in this case the search user has to be used for group/team detection.

would appreciate some feedback :
1: Based on the comment "// Binding will stop any LDAP-Injection Attacks ...." should there be a separate setting for enabling this 'feature', or what actually is a LDAP-Injection Attack?
2: getLdapConnection() should now be called createLdapConnection() ?

Edit:
Original google code ticket is not available anymore?
Problem was:

  • inital ldap bind does work to authenticate the user
  • the new connection was then used to no query the team memberships
    • his works with an AD, but on OpenLDAP a user has not the right's to see the groups
  • so in (our) OpenLDAP setup the Team memberships have to user the 'old' non user ldap connection
@gitblit

This comment has been minimized.

Show comment
Hide comment
@gitblit

gitblit Mar 23, 2015

Owner

At a quick glance you are changing the existing behavior to solve your issue, but you may be breaking other installs. This needs some discussion on the mailing list. Clearly with LDAP what works for some may not work for all - hence the reason for your PR.

Owner

gitblit commented Mar 23, 2015

At a quick glance you are changing the existing behavior to solve your issue, but you may be breaking other installs. This needs some discussion on the mailing list. Clearly with LDAP what works for some may not work for all - hence the reason for your PR.

RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 2, 2015

#247 allow enable/disable of ldap bind switch via config
     new config key : "realm.ldap.groupQueryWithUser"
@RainerW

This comment has been minimized.

Show comment
Hide comment
@RainerW

RainerW Oct 2, 2015

Contributor

created new branch and extracted new behaviour into it with a config key ( commit f04f891)

Contributor

RainerW commented Oct 2, 2015

created new branch and extracted new behaviour into it with a config key ( commit f04f891)

@RainerW

This comment has been minimized.

Show comment
Hide comment
@RainerW

RainerW Oct 8, 2015

Contributor

rebased to develop, not sure about the "since 1.7.0" Information in defaults.properties

Contributor

RainerW commented Oct 8, 2015

rebased to develop, not sure about the "since 1.7.0" Information in defaults.properties

@gitblit

This comment has been minimized.

Show comment
Hide comment
@gitblit

gitblit Oct 9, 2015

Owner

Hi @RainerW.

Github doesn't allow you to merge a PR to another branch AFAIK i.e. if I merge now, your change will merge to master even though you rebased on develop because master is the branch for which the PR was initially opened.

Having said that, while your change solves your problem and may solve #920, I don't like this solution - changing the behavior of isAuthenticated. If the problem is related to group/team search then the fix should be isolated to the connection used in getTeamsFromLdap.

Owner

gitblit commented Oct 9, 2015

Hi @RainerW.

Github doesn't allow you to merge a PR to another branch AFAIK i.e. if I merge now, your change will merge to master even though you rebased on develop because master is the branch for which the PR was initially opened.

Having said that, while your change solves your problem and may solve #920, I don't like this solution - changing the behavior of isAuthenticated. If the problem is related to group/team search then the fix should be isolated to the connection used in getTeamsFromLdap.

@gitblit gitblit closed this Oct 9, 2015

@fzs fzs referenced this pull request Nov 14, 2016

Merged

Fix LDAP binding strategies #1149

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment