Skip to content

v1.15.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 04:58
· 10 commits to main since this release
v1.15.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: NOxv8dcZlMFz3wrLdHILVNSnF6xskqAjN3bnn0i7K30
Verified
Learn about vigilant mode.
a299f5b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

OpenLDAP identifiers longer than 20 characters

Identifier validation is now chosen per directory type. Previously every server was held to Active Directory's sAMAccountName rules — a 20-character cap, no leading digit, a metacharacter blacklist — so an OpenLDAP uid longer than 20 characters was rejected with sAMAccountName too long before any query ran, and such users could not be looked up, authenticated, or have their password changed or reset. With IsActiveDirectory unset, identifiers now use the relaxed ValidateUID rules (RFC 4519 uid: no length cap beyond a 255-byte DoS bound, digits may lead, @/. are legal). Reported by @NuLL3rr0r in netresearch/ldap-selfservice-password-changer#666; fixed in #211.

Security hardening of identifier handling (#217)

  • Pooled connections no longer leak identity. A password check binds a borrowed connection as the end user; when pooling was enabled that connection returned to the pool still bound as the user, so the next borrower ran under the user's identity. The service-account bind is now restored before release (#213).
  • maskSensitiveData dropped a carve-out that returned identifiers containing test.com/example.com in cleartext, and now masks by rune so multibyte identifiers are not garbled (#215).
  • Rate-limit and cache keys are normalized, so case variants (and, for DNs, whitespace variants) of one account share a lockout counter instead of resetting it (#216).
  • UserBuilder.WithSAMAccountName accepts valid OpenLDAP uids; the standalone Validator stays strict as an advisory threat gate (#214).

Breaking

  • Minimum Go is now 1.26 (go directive 1.25 → 1.26; toolchain go1.27.0). Consumers must build with Go 1.26 or later. The errors.As call sites moved to the type-safe errors.AsType[T] (#212).

Notes

A pre-existing user-enumeration timing oracle on the DN authentication path is tracked in #219.

Full changes in CHANGELOG.md.

Contributors

NuLL3rr0r
Assets 6
Loading