processone / processone/ejabberd
Don't reject login with "policy violation" and don't ban IP if auth backend is unreachable
Open
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 6.7k
- Forks
- 1.6k
- PR merge metrics
- No merged PRs in 30d
Description
Environment
- ejabberd version: 8ccad7fadadc7ccedc4a4c9004838503d0f1c76d
- Erlang version:
Erlang (SMP,ASYNC_THREADS) (BEAM) emulator version 11.1.8 - OS: Debian Bullseye arm64
- Installed from: source
Configuration
host_config:
"mydomain.tld":
auth_method: sql
auth_password_format: scram
default_db: sql
sql_type: pgsql
sql_server: "localhost"
sql_database: "mydb"
sql_username: "myuser"
sql_password: "mypass"
new_sql_schema: true
sql_pool_size: 2
Steps
- have sql auth backend
- stop sql server (eg. plain stop or random crash)
Expected result
- unable to login
Actual result
- unable to login
- client rejected with "policy violation"
- server log says 'invalid user or password"
- client IP is banned (this might even be local multiplexer/router IP and not client IP making things odd even if the auth backend is restarted)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the supplied SQL/pgsql configuration while the SQL server is stopped, then trace how the authentication failure is classified and handled. Done means an unreachable auth backend still prevents login without producing a policy-violation rejection or banning the client IP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang, postgresql
- Domain
- authentication, backend, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100