geonetwork / geonetwork/core-geonetwork
LDAP User import with privileges and profile broken
- Dominant language
- Java
- Stars
- 521
- Forks
- 514
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 19
Description
**Issue Description:**
I am unable to import users from LDAP using pre-configured defaults, instead, users are given Registered User role:
My LDAP overrides file contains:
```ldapUserContextMapper.mapping[privilege]=,CSIRO```
```ldapUserContextMapper.mapping[profile]=,Editor```
I.e., My intention is for every user logging in via ldap to be automatically added to the CSIRO group with role Editor. And for them to have user profile Editor too.
**Explanation of cause**
This is because the following if statement clauses never execute as true
https://github.com/geonetwork/core-geonetwork/blob/main/core/src/main/java/org/fao/geonet/kernel/security/ldap/LDAPUserDetailsContextMapper.java#L67
and also
https://github.com/geonetwork/core-geonetwork/blob/main/core/src/main/java/org/fao/geonet/kernel/security/ldap/AbstractLDAPUserDetailsContextMapper.java#L147
They do not execute as true because the user profile has a default setting of RegisteredUser set here:
https://github.com/geonetwork/core-geonetwork/blob/main/domain/src/main/java/org/fao/geonet/domain/LDAPUser.java#L46
and also here,
https://github.com/geonetwork/core-geonetwork/blob/main/domain/src/main/java/org/fao/geonet/domain/User.java#L70
- GeoNetwork Version [4.4.7]
I have made a workaround for my purposes here: https://github.com/Rosspetcsiro/core-geonetwork/pull/1
But I am not sure what the correct / best fix could be. Perhaps its better to remove the default profiles, but this may have other breaking changes. I have noticed that with my fix to always evaluate those blocks (by setting true as the logical expression) the users profile is not reverted down to Editor if I grant them (as an admin) a higher role first like Reviewer. However, if i remove Editor, they will be given Editor again on next log in. This is ok for me.
Contributor guide
Research direction
Start with the LDAPUserDetailsContextMapper.java and AbstractLDAPUserDetailsContextMapper.java conditions linked in the issue, then trace the default profiles in LDAPUser.java and User.java. Compare the reported workaround with the intended LDAP privilege and profile mapping behavior, including what should happen after an administrator changes a user's role; done means the configured mappings apply consistently without unintended role changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100