dotnet / dotnet/aspnetcore

Group claim duplication when using Negotiate authentication on Linux AD domain member with LDAP

Open
#55,705 2 comments 0 reactions 0 assignees View on GitHub
api-suggestion area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

When using the Negotiate authentication on a Linux AD domain member with LDAP claim resolution as described at [link](https://learn.microsoft.com/de-de/aspnet/core/security/authentication/windowsauth?view=aspnetcore-8.0&tabs=visual-studio), the nested groups are resolved multiple times, because in file aspnetcore/src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs on line [73](https://github.com/dotnet/aspnetcore/blob/3307bf66ac87308d157ce9f9fa10bb56c1ebf602/src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs#L73) a new HashSet is created in every iteration of the surrounding foreach loop. Furthermore, on Windows the claims contain the SIDs of the groups instead of the names, whereas on linux only the group names are returned. To allow for more portable code adding the SIDs would be helpful.
Adding the SIDs has also been requested previously by #31959.

### Expected Behavior

- Unique group claims should be returned upon authentication.
- Object SIDs should be added to the claims to allow for portable claim based/policy based authorization.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

8.0.204

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.