RocketChat / RocketChat/Rocket.Chat
LDAP background sync imported new users even as it was set to "False"
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Executing background sync of LDAP data imported hundreds of new users even though "Background Sync Import New Users" is set to false.
Server Setup Information:
- Version of Rocket.Chat Server: 0.60.4
- Operating System: RHEL 7.4
- Deployment Method(snap/docker/tar/etc): docker
- Number of Running Instances: 1
- DB Replicaset Oplog: OpLog disabled
- Node Version: 8.9.4 - x64
Steps to Reproduce:
- Configure LDAP, my sync relevant options:
- Login Fallback: True
- Merge Existing Users: True
- Sync User Data: True
- Sync User Avatar: False
- Backgroud Sync: True
- Background Sync Interval: Every 24 hours
- Background Sync Import New Users: False
- Background Sync Update Existing Users: True
- Hit "Execute synchronization now".
Expected behavior:
Expected manually created users' and users with reseted password to have their password synchronized from LDAP. Our LDAP configuration has been failing for few weeks (maybe due to some old, not anymore functional user search filter) and that is why we have used the mentioned workaround to get users created and able to login.
Actual behavior:
Some 500 new users were created and joined our "general" channel. I think our LDAP server has some limit so luckily not all of our tens of thousands of employees were imported. I had to create a script to delete the users.
Relevant logs:
Too much to clean in the LDAP related logs :(
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the LDAP configuration and the “Execute synchronization now” background-sync entry point described in the issue. Reproduce the case with “Background Sync Import New Users” set to false, then trace the sync behavior and existing LDAP-related tests. Done means existing users can synchronize while new users are not created, with regression coverage for this setting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100