500 when external usergroup users don't match filter
|Assigned To:||Daniel Lobato Garcia|
|Target version:||Team Daniel - Iteration 9|
|Found in release:||Pull request:||https://github.com/theforeman/foreman/pull/4902, https://github.com/theforeman/foreman/pull/4199|
|Velocity based estimate||-|
Given an Auth source LDAP with a filter like:
(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.1135220.127.116.111:=CN=Red Hat Foreman Users,OU=Groups,OU=Unix,DC=example,DC=net))
with a base DN of 'DC=example, DC=net'
and a LDAP tree like:
- OU = Groups (OU=Unix, DC=example, DC=net..)
- CN = Red Hat Foreman Users
- CN = Foreman Admins
If one tries to add 'Foreman Admins' as an external user group, it will fail with a 500 LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException, as Foreman does not know how to handle this exception. The failure is fine as Foreman Admins doesn't match the LDAP Filter, however we should give better hints to the admin as to what's going on.
1. Foreman looks for the group Foreman Admins within it's base DN. Success
2. ldap_fluff lists all users for the group. Fail: it uses the LDAP filter to do this operation, and users in Foreman Admins will not satisfy "memberOf:1.2.840.113518.104.22.1681:=CN=Red Hat Foreman Users" (member of the Red Hat Foreman Users hierarchy), as it's a different hierarchy tree. It throws UIDNotFoundException, and Foreman doesn't know what to do at this point so it 500s.
1. Make sure we apply the filter also on group lookup on LDAP fluff.
2. Handle LdapFluff::Exception on the user group page in Foreman, and try to figure out the cause (say, lookup for the user list without the filter, if that works, explain what's going on)
When one submit an user group with external user groups, and this
doesn't work for whatever reason, like:
Net::LDAP::Error - No route to host - connect(2)
it should show these errors in the UI and ideally some text explaining
how to solve the issue.
Currently the errors are merely logged to production.log, which leaves
users unable to understand what happened.
This commit makes those errors show up in the UI with a suggestion on
how to fix those we know
#10 Updated by Robert Heinzmann 9 months ago
This problem also occures when I try to specify an ldap filter that limits the valid users to certain accounts (e.g. selected users).
(|(sAMAccountName=admin1)(sAMAccountName=operator1)(sAMAccountName=user1)) <pre> When an external group is created I get the Error 500, as SOME members of the external group are excluded by this filter intensionally. Then ldap_fluff generates queries like: <pre> [ filter=(&(CN=Joe Admin)(|(|(sAMAccountName=admin1)(sAMAccountName=operator1))(sAMAccountName=user1))), base=OU=User,DC=example,DC=com ] <pre> As soon as a group member of the externl group is excluded by the filter (e.g. user99), I get: <pre> LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException: LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException </pre> So this does not only look like a "documentation issue", but also a logical error about how to use the ldap filters.