matrix-org / matrix-org/matrix-synapse-ldap3
Invalid server address does not error
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 139
- Forks
- 47
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
If the LDAP server URI is something invalid like ldap://ldap.example.com:389 , then auth just hangs.
To Reproduce
Steps to reproduce the behavior:
- Configure with the default example URI ldap://ldap.example.com:389 (which is invalid)
- Try to login
- No error, the UI just hangs since it's awaiting server response.
Expected behavior
Server should return error since LDAP server is unreachable.
Additional context
In versions 0.1.4, you will see something like below in the logs when user tries to login:
2021-07-24 06:06:14,840 - synapse.access.http.8008 - 349 - DEBUG - OPTIONS-70 - 73.15.171.124 - 8008 - Received request: OPTIONS /_matrix/client/r0/login
2021-07-24 06:06:14,841 - synapse.access.http.8008 - 389 - DEBUG - OPTIONS-70 - 73.15.171.124 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.002sec, 0.000sec) (0.000sec/0.000sec/0) 0B 204 "OPTIONS /_matrix/client/r0/login HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0" [0 dbevts]
2021-07-24 06:06:14,859 - synapse.access.http.8008 - 349 - DEBUG - POST-71 - 73.15.171.124 - 8008 - Received request: POST /_matrix/client/r0/login
2021-07-24 06:06:14,860 - synapse.rest.client.v1.login - 216 - INFO - POST-71 - Got login request with identifier: {'type': 'm.id.user', 'user': 'girish'}, medium: None, address: None, user: None
2021-07-24 06:06:14,860 - ldap_auth_provider - 92 - DEBUG - POST-71 - Attempting LDAP connection with ldap://ldap.example.com:389
2021-07-24 06:06:14,861 - ldap_auth_provider - 425 - DEBUG - sentinel - Established LDAP connection in search mode: ldap://ldap.example.com:389 - cleartext - user: ou=users,dc=cloudron - not lazy - unbound - closed - <no socket> - tls not started - not listening - SyncStrategy - internal decoder
2021-07-24 06:06:14,864 - ldap_auth_provider - 516 - WARNING - sentinel - Error during LDAP authentication: invalid server address
2021-07-24 06:06:14,864 - ldap_auth_provider - 187 - WARNING - sentinel - Error during ldap authentication: invalid server address
The code immediately errors with the above warning. In the recent release 0.1.5,
2021-07-24 06:11:04,253 - synapse.access.http.8008 - 349 - DEBUG - POST-27 - 73.15.171.124 - 8008 - Received request: POST /_matrix/client/r0/login
2021-07-24 06:11:04,253 - synapse.rest.client.v1.login - 271 - INFO - POST-27 - Got login request with identifier: {'type': 'm.id.user', 'user': 'girish'}, medium: None, address: None, user: None
2021-07-24 06:11:04,254 - ldap_auth_provider - 107 - DEBUG - POST-27 - Attempting LDAP connection with ['ldap://ldap.example.com:389']
2021-07-24 06:11:04,255 - ldap_auth_provider - 471 - DEBUG - sentinel - Established LDAP connection in simple bind mode: ldap://ldap.example.com:389 - cleartext - user: ou=users,dc=cloudron - not lazy - unbound - closed - <no socket> - tls not started - not listening - SyncStrategy - internal decoder
2021-07-24 06:11:08,371 - synapse.storage.txn - 530 - DEBUG - prune_old_user_ips-25 - [TXN START] {_prune_old_user_ips-8a}
2021-07-24 06:11:08,371 - synapse.storage.txn - 530 - DEBUG - update_client_ips-25 - [TXN START] {_update_client_ips_batch-8b}
2021-07-24 06:11:08,372 - synapse.storage.txn - 633 - DEBUG - update_client_ips-25 - [TXN END] {_update_client_ips_batch-8b} 0.000445 sec
2021-07-24 06:11:08,373 - synapse.storage.txn - 633 - DEBUG - prune_old_user_ips-25 - [TXN END] {_prune_old_user_ips-8a} 0.001677 sec
2021-07-24 06:11:08,415 - synapse.handlers.presence - 860 - DEBUG - handle_presence_timeouts-19 - Handling presence timeouts
2021-07-24 06:11:08,416 - synapse.util.metrics - 137 - DEBUG - handle_presence_timeouts-19 - Entering block presence_update_states
2021-07-24 06:11:08,416 - synapse.util.metrics - 145 - DEBUG - handle_presence_timeouts-19 - Exiting block presence_update_states
2021-07-24 06:11:08,416 - synapse.handlers.typing - 93 - DEBUG - typing._handle_timeouts-25 - Checking for typing timeouts
2021-07-24 06:11:08,496 - synapse.rest.media.v1.preview_url_resource - 591 - DEBUG - expire_url_cache_data-12 - Running url preview cache expiry
2021-07-24 06:11:08,497 - synapse.storage.txn - 530 - DEBUG - expire_url_cache_data-12 - [TXN START] {get_expired_url_cache-8c}
2021-07-24 06:11:08,498 - synapse.storage.txn - 633 - DEBUG - expire_url_cache_data-12 - [TXN END] {get_expired_url_cache-8c} 0.001031 sec
2021-07-24 06:11:08,498 - synapse.rest.media.v1.preview_url_resource - 625 - DEBUG - expire_url_cache_data-12 - No entries removed from url cache
2021-07-24 06:11:08,498 - synapse.storage.txn - 530 - DEBUG - expire_url_cache_data-12 - [TXN START] {get_url_cache_media_before-8d}
2021-07-24 06:11:08,499 - synapse.storage.txn - 633 - DEBUG - expire_url_cache_data-12 - [TXN END] {get_url_cache_media_before-8d} 0.000913 sec
2021-07-24 06:11:08,500 - synapse.rest.media.v1.preview_url_resource - 675 - DEBUG - expire_url_cache_data-12 - No media removed from url cache
2021-07-24 06:11:08,512 - synapse.storage.TIME - 487 - DEBUG - sentinel - Total database time: 0.059% {_prune_old_user_ips(2): 0.032%, get_expired_url_cache(1): 0.010%, get_url_cache_media_before(1): 0.009%}
2021-07-24 06:11:10,009 - synapse.access.http.8008 - 349 - DEBUG - GET-28 - 172.18.0.1 - 8008 - Received request: GET /
2021-07-24 06:11:10,009 - synapse.access.http.8008 - 389 - INFO - GET-28 - 172.18.0.1 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 208B 302 "GET / HTTP/1.1" "Mozilla (CloudronHealth)" [0 dbevts]
The code doesn't error. The UI also just hangs because of this:

Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the ldap_auth_provider authentication path and the synapse.rest.client.v1.login entry point shown in the logs. Reproduce a login using the invalid LDAP URI and trace how the connection result is handled. Done means the invalid or unreachable server produces an error response and the UI no longer waits indefinitely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100