DependencyTrack / DependencyTrack/dependency-track

Not retrieving LDAP groups

Open
#2,531 2 comments 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I configured Dependency Track with my LDAP instance (NetIQ/Novell eDirectory). The authentication goes well but when I try to map an LDAP group in a Team, the dependency track finds no groups:
![image](https://user-images.githubusercontent.com/37578397/221549472-ebe4edc0-fb3b-48bd-91da-c58ca3a5f537.png)

I checked logs but I didn't find the call to retrieve all LDAP groups. However, i think that the problem could be in LDAP search filters for groups. alpine.ldap.groups.filter and alpine.ldap.groups.search.filter.

I followed guidelines of the [documentation](https://docs.dependencytrack.org/getting-started/configuration/) and this is my config:
```
ALPINE_LDAP_SERVER_URL: ldap://ldapmgsv.mycompany.it:389
ALPINE_LDAP_BASEDN: o=Accounts,dc=CORP,dc=MYCOMPANY,dc=NET
ALPINE_LDAP_SECURITY_AUTH: simple
ALPINE_LDAP_AUTH_USERNAME_FORMAT: "%s"
ALPINE_LDAP_BIND_USERNAME: cn=LDAP_ADMIN_READ,ou=Application,ou=Technical,o=Accounts,dc=CORP,dc=MYCOMPANY,dc=NET
ALPINE_LDAP_BIND_PASSWORD: mypassword
ALPINE_LDAP_ATTRIBUTE_NAME: cn
ALPINE_LDAP_ATTRIBUTE_MAIL: mail
ALPINE_LDAP_USER_PROVISIONING: "true"
ALPINE_LDAP_TEAM_SYNCHRONIZATION: "true"
ALPINE_LDAP_GROUPS_FILTER: (|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames))
ALPINE_LDAP_GROUPS_SEARCH_FILTER: (&(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames))(cn=*{SEARCH_TERM}*))
```

I tried many others values in ALPINE_LDAP_GROUPS_FILTER and ALPINE_LDAP_GROUPS_SEARCH_FILTER, including the value proposed [here](https://docs.dependencytrack.org/getting-started/configuration/) for NetIQ/Novell eDirectory but the result is the same.

Logs:
```
2023-02-27 11:38:36,357 DEBUG [LdapAuthenticationService] Attempting to authenticate user: user7159
2023-02-27 11:38:36,357 DEBUG [LdapAuthenticationService] Validating credentials for: user7159
2023-02-27 11:38:36,374 DEBUG [LdapConnectionWrapper] Creating LDAP context for: cn=user7159,ou=User,o=Accounts,dc=CORP,dc=MYCOMPANY,dc=NET
2023-02-27 11:38:36,384 DEBUG [LdapAuthenticationService] The supplied credentials are valid for: user7159
2023-02-27 11:38:36,388 DEBUG [LdapAuthenticationService] Attempting to authenticate user: user7159
2023-02-27 11:38:38,213 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:com.mycompanygroup.arte\:ldap\-web\-services\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:38:38,314 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:ldap\-web\-services\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:38:38,314 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'ldap-web-services'
2023-02-27 11:38:38,323 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: product:ldap-web-services~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:38:38,330 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:com.ggs.ldap\:ldap_jar\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:38:38,428 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:ldap_jar\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:38:38,428 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'ldap_jar'
2023-02-27 11:38:38,429 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: product:ldap_jar~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:25,897 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:com.mycompanygroup.arte\:ldap\-web\-services\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:25,987 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:ldap\-web\-services\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:25,987 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'ldap-web-services'
2023-02-27 11:39:25,995 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: product:ldap-web-services~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:26,006 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:com.ggs.ldap\:ldap_jar\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:26,107 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:ldap_jar\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
2023-02-27 11:39:26,108 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'ldap_jar'
2023-02-27 11:39:26,110 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: product:ldap_jar~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
```

When the query to retrieve LDAP groups is done? In logs there is no trace of it. Why?
How I have to change my configuration to make it works?

### Steps to Reproduce

1. Configure NetIQ/Novell eDirectory LDAP
2. Authenticate
3. In the Administration panel open Teams
4. Click "+" on Mapped LDAP groups
5. Result: No matching records found
6. Check logs but finds nothing of LDAP query to retrieve all groups

### Expected Behavior

To find all groups from LDAP in the dialog above

### Dependency-Track Version

4.7.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.