RocketChat / RocketChat/Rocket.Chat

LDAP sync : uniqueId gets altered ("42" becomes "3432")

Open
#19,839 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: authentication
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

I've setup LDAP sync with uid as uniqueId field ("LDAP_Unique_Identifier_Field" in LDAP settings).
After successful sync, this ldap uid value is stored in "services.ldap.id" as expected, but the value has been "transformed" in the process. For some reason, each char in the value is prepended with "3". So "uid": "123456789" in LDAP becomes "services.ldap.id": "313233343536373839".

After multiple trials/errors, I came up with this workaround:

diff --git a/app/ldap/server/ldap.js b/app/ldap/server/ldap.js
index 63c5951b4..e6c0de27a 100644
--- a/app/ldap/server/ldap.js
+++ b/app/ldap/server/ldap.js
@@ -258,14 +258,14 @@ export default class LDAP {
 		if (attribute) {
 			filter = new this.ldapjs.filters.EqualityFilter({
 				attribute,
-				value: new Buffer(id, 'hex'),
+				value: new Buffer(id),
 			});
 		} else {
 			const filters = [];
 			Unique_Identifier_Field.forEach((item) => {
 				filters.push(new this.ldapjs.filters.EqualityFilter({
 					attribute: item,
-					value: new Buffer(id, 'hex'),
+					value: new Buffer(id),
 				}));
 			});
 
diff --git a/app/ldap/server/sync.js b/app/ldap/server/sync.js
index 9993fe545..6e20c4647 100644
--- a/app/ldap/server/sync.js
+++ b/app/ldap/server/sync.js
@@ -98,7 +98,7 @@ export function getLdapUserUniqueID(ldapUser) {
 		if (Unique_Identifier_Field) {
 			Unique_Identifier_Field = {
 				attribute: Unique_Identifier_Field,
-				value: ldapUser._raw[Unique_Identifier_Field].toString('hex'),
+				value: ldapUser._raw[Unique_Identifier_Field].toString(),
 			};
 		}
 		return Unique_Identifier_Field;

Steps to reproduce:

Setup LDAP sync with uid as uniqueId field ("LDAP_Unique_Identifier_Field" in LDAP settings).

Expected behavior:

Field "services.ldap.id" should store the "uid" value from LDAP.

Actual behavior:

Field "services.ldap.id" stores a value different from the one in LDAP.

Server Setup Information:
  • Version of Rocket.Chat Server: 3.8.0
  • Operating System: Debian GNU/Linux
  • Deployment Method: manual install (from tarball)
  • Number of Running Instances: 1
  • DB Replicaset Oplog: enabled
  • NodeJS Version: 12.18.4 - x64
  • MongoDB Version: 4.2.10
Client Setup Information
  • Desktop App or Browser Version: Any browser
  • Operating System: Any OS
Additional context

LDAP server is OpenLDAP from Debian Buster.

Relevant logs:

In this example, user "john.doe" has uid=5 in LDAP and has uid=35 in RC.

Dec 11 17:43:58 testserver rocketchat[21244]: (node:21244) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
Dec 11 17:43:58 testserver rocketchat[21244]: LDAP ➔ Search.info Final Page
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug userQuery { 'services.ldap.id': '35' }
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug userQuery merge { username: 'john.doe }
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ info Syncing user data
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug user { email: undefined, _id: 'n6t55y5xoPuqXqigG' }
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug ldapUser undefined
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug not syncing user roles
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug not syncing groups to channels
Dec 11 17:43:58 testserver rocketchat[21244]: LDAPSync ➔ debug setting {
Dec 11 17:43:58 testserver rocketchat[21244]:   "services.ldap.id": "35",
Dec 11 17:43:58 testserver rocketchat[21244]:   "services.ldap.idAttribute": "uid"
Dec 11 17:43:58 testserver rocketchat[21244]: }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in app/ldap/server/ldap.js around the LDAP equality filters and app/ldap/server/sync.js in getLdapUserUniqueID, then reproduce a sync using uid as LDAP_Unique_Identifier_Field. Compare the stored services.ldap.id with the LDAP uid and verify that the lookup and saved identifier preserve the original value.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.