LDAP + App passwords causes failed login attempts on the LDAP server
Open
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 17
- Forks
- 19
- Avg merge
- 11h 40m
- Merged PRs (30d)
- 2
Description
Steps to reproduce
- Set up LDAP
- Create a LDAP user
- Log in as LDAP user
- Create app password to be used by ownCloud Client sync
- Set up a new sync connection in the ownCloud Client with user/App password credentials
- Watch log
Expected behaviour
- ownCloud log should contain no errors
- LDAP server should not encounter failed
BINDs
Actual behaviour
-
This is logged for every HTTP connection made by the ownCloud Client:
{"reqId":"W0lIOLAHzP9ODFdp3ygi","level":2,"time":"2018-01-06T14:37:25+00:00","remoteAddr":"172.19.0.1","user":"test","app":"core","method":"PROPFIND","url":"\/remote.php\/dav\/files\/test\/","message":"Login failed: 'test' (Remote IP: '172.19.0.1')"} -
slapd logs
[bind.c:167] conn=1836 op=0 BIND dn="uid=test,cn=users,dc=wghoch4,dc=local" method=128 [result.c:871] conn=1836 op=0 RESULT tag=97 err=49 text= [unbind.c:49] conn=1836 op=1 UNBIND [connection.c:709] conn=1836 fd=30 closed(
err=49means invalid credentials) -
If you set up slapd to auto-lock accounts that failed to
BINDsuccessfully a certain number of times your LDAP users will be locked out by the failed attempts
Server configuration
Operating system: Windows (ownCloud Client), Linux
Web server: nginx
Database: MariaDB
PHP version: PHP 7.0.26
ownCloud version: 10.0.4
Where did you install ownCloud from: docker
List of activated apps:
Enabled:
- activity: 2.3.6
- checksum: 0.3.5
- comments: 0.3.0
- configreport: 0.1.1
- dav: 0.3.2
- federatedfilesharing: 0.3.1
- federation: 0.1.0
- files: 1.5.1
- files_clipboard: 0.6.2
- files_external: 0.7.1
- files_pdfviewer: 0.8.2
- files_sharing: 0.10.1
- files_texteditor: 2.2.1
- files_trashbin: 0.9.1
- files_versions: 1.3.0
- files_videoplayer: 0.9.8
- firstrunwizard: 1.1
- gallery: 16.0.2
- impersonate: 0.1.2
- market: 0.2.3
- notifications: 0.3.2
- oauth2: 0.2.1
- provisioning_api: 0.5.0
- systemtags: 0.3.0
- templateeditor: 0.1
- twofactor_totp: 0.4.3
- updatenotification: 0.2.1
- user_ldap: 0.10.0
Disabled:
- encryption
- external
- files_antivirus
- theme-example
- user_external
Are you using external storage, if yes which one: no
Are you using encryption: no
Are you using an external user-backend, if yes which one: LDAP
LDAP configuration (delete this part if not used)
+-------------------------------+-------------------------------------------------------------------------------------------------------+
| Configuration | |
+-------------------------------+-------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport | 1 |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | uid=owncloud,cn=users,dc=wghoch4,dc=local |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | dc=wghoch4,dc=local |
| ldapBaseGroups | cn=groups,dc=wghoch4,dc=local |
| ldapBaseUsers | cn=users,dc=wghoch4,dc=local |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | mail |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | entryuuid |
| ldapExpertUsernameAttr | uid |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (&(|(objectclass=posixGroup))(|(cn=owncloud))) |
| ldapGroupFilterGroups | owncloud |
| ldapGroupFilterMode | 1 |
| ldapGroupFilterObjectclass | posixGroup |
| ldapGroupMemberAssocAttr | uniqueMember |
| ldapHost | ldaps://nas.wghoch4.local |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(&(|(objectclass=inetOrgPerson))(|(memberof=cn=owncloud,cn=groups,dc=wghoch4,dc=local)))(uid=%uid)) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 0 |
| ldapLoginFilterMode | 1 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 636 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | gecos |
| ldapUserDisplayName2 | |
| ldapUserFilter | (&(|(objectclass=inetOrgPerson))(|(memberof=cn=owncloud,cn=groups,dc=wghoch4,dc=local))) |
| ldapUserFilterGroups | owncloud |
| ldapUserFilterMode | 1 |
| ldapUserFilterObjectclass | inetOrgPerson |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 1 |
| useMemberOfToDetectMembership | 1 |
+-------------------------------+-------------------------------------------------------------------------------------------------------+
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the LDAP login and app-password sync flow described in the issue, then trace the authentication entry point used by the ownCloud Client's PROPFIND requests. Compare the ownCloud log with the LDAP server's BIND results. Done means successful client requests without ownCloud login errors or failed LDAP BINDs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100