RocketChat / RocketChat/Rocket.Chat

API Delete User fails (incomplete user data)

Open
#18,826 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: authentication
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

User can not be deleted because of incomplete user data

Steps to reproduce:
  1. delete user
Expected behavior:

user will be deleted with "success": true

Actual behavior:

Because a user seems to not have completely synced from LDAP/Active Directory, he is not able to login for the first time.
Also because of this, his userdata seems to be broken (sensitive data masked):

root@8b00406b639d:/app/bundle# curl -sH "X-Auth-Token: q_jgzp-UQEzJ1gFMxxxxAx4LriK9F" -H "X-User-Id: xmxxxu" http://localhost:3000/api/v1/users.info?username=johndoe | jq
{
  "user": {
    "_id": "AGDdxxxGRsy",
    "createdAt": "2020-09-01T07:00:00.692Z",
    "services": {
      "ldap": {
        "id": "399448cdbb75d14db9bca469039db3f9",
        "idAttribute": "objectGUID"
      }
    },
    "username": "johndoe",
    "emails": [
      {
        "address": "john.doe@acme.corp",
        "verified": true
      }
    ],
    "type": "user",
    "status": "offline",
    "active": true,
    "name": "John Doe"
  },
  "success": true
}

When I try to delete the user:

root@8b00406b639d:/app/bundle# curl -sH "X-Auth-Token: q_jgzp-UQxxcmikZ7Pdw54LriK9F" -H "X-User-Id: xm4xxvu" -H "Content-type:application/json" http://localhost:3000/api/v1/users.delete -d '{ "username": "johndoe" }'

{"success":false,"error":"Cannot read property 'indexOf' of undefined"}
Server Setup Information:
  • Version of Rocket.Chat Server: 3.6.0
  • Operating System: CentOS 8
  • Deployment Method: Docker Swarm
  • Number of Running Instances: 1
  • DB Replicaset Oplog: Enabled
  • NodeJS Version: 12.16.1 - x64
  • MongoDB Version: 3.6.19
Client Setup Information
  • Desktop App or Browser Version: all
  • Operating System: all
Additional context

My assumption is: the userdata is not fully populated and a key which is referenced in the delete function is missing.

How can I forcefully delete the user or initiate a new ldap sync which hopefully corrects the user? Ldap sync from webadmin does not solve it.

Relevant logs:

Server does not log anything on failed USER DELETE

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the users.delete API entry point and reproduce deletion for the incomplete LDAP/Active Directory user described in the report. Trace the undefined value behind the "indexOf" error and verify that the endpoint returns success true and deletes the user without complete synced data.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.