RocketChat / RocketChat/Rocket.Chat

Auto Sync LDAP Groups to Channels not working

Open
#16,633 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: authentication sponsored
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Hello,

we are using the following configuration
Server Setup Information
Version of Rocket.Chat Server: 2.4.9
Operating System: Ubuntu LTS
Deployment Method: snap
Number of Running Instances: 1
DB Replicaset Oplog:
NodeJS Version: v8.17.0
MongoDB Version: 3.6.14
Proxy: caddy
Firewalls involved: no
Active Directory: Windows Server 2012R2

If we enable "Auto Sync LDAP Groups to Channels", one user can login. After this login the Channels are created and now no one else can login to rocket chat. They got an error message "wrong user or passwort". If i logout with this user, the user can not login anymore. I have to delete these channels with the rocket chat admin and then the same happens - i can login one time, channels are created and no login is possible after that.

If i disable LDAP Group to Channel Sync the AD Authenthication is working fine.

The Config looks like this:
Base DN
OU=KTS,DC=my,DC=domain,DC=com
User Group Filter
(&(sAMAccountName=#{username})(memberOf:1.2.840.113556.1.4.1941:=CN=#{groupName},OU=RocketChat,OU=SecurityGroups,OU=KTS,DC=my,DC=domain,DC=com))
LDAP Group BaseDN
OU=KTS,DC=my,DC=domain,DC=com
User Search filter
(&(objectCategory=person)(objectclass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=RC_Users,OU=RocketChat,OU=SecurityGroup,OU=KTS,DC=my,DC=domain,DC=com))

Any Idea whats going wrong? I was doing my first tests with a earlier version and the Group Sync was working fine.

i wrote a mail to the support but i dont get any feedback to this problem.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the LDAP Group to Channel Sync configuration and the login flow described for Rocket.Chat 2.4.9, using the supplied Active Directory filters and deployment versions to reproduce the failure. Done means channels are synchronized without preventing other users from logging in, and authentication continues to work after the first login.

Written by the indexing model from the issue text.

Assessment

Tech stack
mongodb, node.js, typescript
Domain
authentication, authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.