RocketChat / RocketChat/Rocket.Chat

Ldap Filter Broken in 60.3 and 60.4

Open
#9,389 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: authentication
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

The authentication with rocket chat users not works.
The LDAP connection works fine, and the authentication of the user seems too.
But the result it's always: User not found or incorrect password
What is wrong in my configuration?

Server Setup Information:
Version of Rocket.Chat Server: 0.60.3 and 0.60.3 
Operating System: centOS7
Deployment Method(snap/docker/tar/etc): docker
Number of Running Instances: 2
DB Replicaset Oplog:
Node Version: n 8.9.3
Steps to Reproduce:
  1. Updated to 0.60.3 also tested with 0.60.4
  2. Ldap search filter in the settings is: (&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))
  3. Try to login with ldap
  4. Error: User not found or incorrect password
  5. Debug log query is wrong: LDAP ➔ Search.debug searchOptions { filter: '(&(&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))(|(uid=jdoe)(mail=jdoe)))',
Expected behavior:

Login works as before the update

Actual behavior:

Error: User not found or incorrect password

Relevant logs:

Debug log query is wrong: LDAP ➔ Search.debug searchOptions { filter: '(&(&(|(objectclass=inetOrgPerson)(objectclass=sambaSamAccount)(objectclass=shadowAccount))(|(mail=#{username})(uid=#{username})))(|(uid=jdoe)(mail=jdoe)))',

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the LDAP login failure on Rocket.Chat 0.60.3 or 0.60.4 using the configuration and search filter in the issue. Inspect the LDAP debug output, especially the generated search filter, and compare it with the configured filter. Done means LDAP users can authenticate and the generated query behaves as expected.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.