RocketChat / RocketChat/Rocket.Chat

LDAP -> RocketChat user collision

Open
#6,206 7 comments 2 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

area: authentication triaged type: improvement
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Rocket.Chat Version: 0.52.0
Running Instances: 1
DB Replicaset OpLog: (Shows disabled but it's initiated at oplog size 1024)
Node Version: 4.5.0

Given two LDAP users named John Smith (domain\jsmith) and John A. Smith (domain\jasmith)
and given a Domain Search User ID value of sAMAccountName
and given a Username Field value of #{givenName}.#{sn}:

Expected behavior:

Authenticate first user's sAMAccountName against LDAP and on first login create a user with a unique _id value, and a username of #{givenName}.#{sn} (john.smith). When authenticating second user, note the different sAMAccountName value at login, and create a new user with a different unique _id value but the same #{givenName}.#{sn}. In most chat systems, two users of the same display name is perfectly valid and it is up to the end user to differentiate between John Smiths on a secondary value such as email or full proper name.

Current behavior:

Authenticate first user's sAMAccountName against LDAP and on first login create a user with a unique _id value, and a username of #{givenName}.#{sn} (john.smith). When authenticating second user, logs second user into existing user account for username of #{givenName}.#{sn}. Second user has complete access to first users account: private channels, direct messages, the whole shebang.

Current workarounds:

-Set Username Field value to sAMAccountName which is guaranteed to be unique.

I do not know how deeply integrated a unique username is in the RocketChat system, but the unique identifying value should really be the user id. An option to show proper names on messages as imported from LDAP instead of usernames would also be preferable to the current behavior.

EDIT: Note this issue occurs with any non-unique LDAP value set to the username. cn, displayName, givenName+sn, etc.

EDIT2: The "Show Real Names" option has proven a good workaround in our organization. Usernames are still samaccountname for the guaranteed unique values, but the usability of full names is now present.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.