RocketChat / RocketChat/Rocket.Chat
LDAP deleted users can still use rocketchat just fine unless they log out
Open
Nobody has claimed this yet.
area: authentication
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
LDAP deleted users can still use rocketchat just fine unless they log outSteps to reproduce:
- Ldap and delete a user
If that user is already logged in he can chat just fine , even if he closes and opens his browser he is still logged in and can chat just fine . Log in fallback is set to false .
Expected behavior:
user getting kicked out of rocketchatActual behavior:
nothing happensServer Setup Information:
- Version of Rocket.Chat Server: latest 3.10.0
- Operating System: ubuntu 16.04
- Deployment Method:
- Number of Running Instances: 1
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
Client Setup Information
- Desktop App or Browser Version:
- Operating System:
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue on Rocket.Chat 3.10.0 with LDAP fallback disabled: delete a user while that user remains logged in, then reopen the browser and test access. Confirm that the completed behavior removes access for the deleted user without requiring logout.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100