RocketChat / RocketChat/Rocket.Chat

Service user should not be a requirement for LDAP integration

Open
#11,100 12 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

area: authentication
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Server has been configured to perform authentication against an LDAP server. However, it does not seem that authentication is working. The server seems to expect that there must be an admin service user available. When trying to log on, a response as follows is given:

User not found or incorrect password

On the server log, the following entry appears:

LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection

Steps to reproduce:

Log on to server that has been configured with LDAP authentication.

Expected behavior:

The RC server should be able to use the supplied credentials to bind to the given LDAP server to confirm login details are correct and copy user from server, without the need for an admin service user.

Actual behavior:

As described above.

Server Setup Information:
  • Version of Rocket.Chat Server: 0.65.1
  • Operating System: 4.15.0-23-generic
  • Deployment Method: snap
  • Number of Running Instances: 1
  • DB Replicaset Oplog:
  • NodeJS Version: v8.11.2
  • MongoDB Version:
Additional context
Relevant logs:
I20180612-13:12:41.356(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:14:04.226(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:14:07.085(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Search.error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:14:07.087(2) rocketchat_logger rocketchat_logger.js:278 LDAPHandler ➔ error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:14:19.353(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Search.error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:14:19.355(2) rocketchat_logger rocketchat_logger.js:278 LDAPHandler ➔ error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:14:34.239(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:15:04.255(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:15:04.256(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:15:41.440(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:16:45.654(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Search.error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:16:45.655(2) rocketchat_logger rocketchat_logger.js:278 LDAPHandler ➔ error { OperationsError: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580     at messageCallback (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)     at Parser.onMessage (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)     at emitOne (events.js:116:13)     at Parser.emit (events.js:211:7)     at Parser.write (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)     at Socket.onData (/snap/rocketchat-server/1273/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)     at emitOne (events.js:116:13)     at Socket.emit (events.js:211:7)     at addChunk (_stream_readable.js:263:12)     at readableAddChunk (_stream_readable.js:250:11)     at Socket.Readable.push (_stream_readable.js:208:10)     at TCP.onread (net.js:597:20)    lde_message: '000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580\u0000',   lde_dn: null } 
I20180612-13:17:04.325(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' } 
I20180612-13:17:34.334(2) rocketchat_logger rocketchat_logger.js:278 LDAP ➔ Connection.error connection { Error: read ECONNRESET     at _errnoException (util.js:992:11)     at TCP.onread (net.js:618:25)  code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the LDAPHandler errors and the ldapjs client path shown in the logs; trace how the server binds and searches when a user logs in. Verify authentication and user copying with only the supplied user credentials, without an admin service user, and confirm the bind-related errors no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.