RocketChat / RocketChat/Rocket.Chat
Ldap Filter Broken in 60.3 and 60.4
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The authentication with rocket chat users not works.
The LDAP connection works fine, and the authentication of the user seems too.
But the result it's always: User not found or incorrect password
What is wrong in my configuration?
Server Setup Information:
Version of Rocket.Chat Server: 0.60.3 and 0.60.3
Operating System: centOS7
Deployment Method(snap/docker/tar/etc): docker
Number of Running Instances: 2
DB Replicaset Oplog:
Node Version: n 8.9.3
Steps to Reproduce:
- Updated to 0.60.3 also tested with 0.60.4
- Ldap search filter in the settings is: (&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))
- Try to login with ldap
- Error: User not found or incorrect password
- Debug log query is wrong: LDAP ➔ Search.debug searchOptions { filter: '(&(&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))(|(uid=jdoe)(mail=jdoe)))',
Expected behavior:
Login works as before the update
Actual behavior:
Error: User not found or incorrect password
Relevant logs:
Debug log query is wrong: LDAP ➔ Search.debug searchOptions { filter: '(&(&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))(|(uid=jdoe)(mail=jdoe)))',
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the LDAP login failure on Rocket.Chat 0.60.3 or 0.60.4 using the configuration and search filter in the issue. Inspect the LDAP debug output, especially the generated search filter, and compare it with the configured filter. Done means LDAP users can authenticate and the generated query behaves as expected.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100