DependencyTrack / DependencyTrack/dependency-track

Teams failure when Active Directory Group Name Contains Space

Open
#241 1 comment 0 reactions 0 assignees View on GitHub
cannot reproduce
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Defect:

### Current Behavior:
Dependency Track LDAP using Active Directory is working correctly for authentication (users are created on first login). When configuring Teams, I can see a complete listing of all of our 250 AD groups.

- The AD group "Developers" works for us.
- The AD group "Domain Users" does not work. A user who is a member of that group (and not in "Developers") receives an HTTP 403 (Forbidden) error after login. They are not added to a Team. If I manually add them to a Team, then they are automatically then removed from the Team by Dependency Track (which is probably correct behaviour in the context).
- Ditto for any other group with a space in the name.
- Ditto for adding "Domain Users" to a group "DT-Test" in Active Directory and trying to set up Dependency-Track to use "DT-Test".

### Steps to Reproduce (if defect):
- With Active Directory configured, create a Team (eg "users") in Dependency-Track
- Configure the team "users" with permission VIEW+PORTFOLIO
- Select an LDAP group that has a space (Look for something like OU=Domain Users)
- Pick a user from that group that has no other permissions that would allow access to Dependency-Track)
- Login as that user.

### Expected Behavior:
- The user should be able to login
- The user should be able to View Portfolio. ie, no "Forbidden" error.
- The user should be listed in the UI as a member of 1 Team, and that Team should be "Users"

### Environment:
- Dependency-Track Version: v3.3.1
- Distribution: [Executable WAR]
- BoM Format & Version: N/A
- Database Server: [ H2 ]
- Browser: Any
- LDAP Server = Active Directory.

### Other Details:
There are no events in the logs apart from those recording the HTTP 403 Forbidden.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.