Having an option to simply turn off this groups feature could serve as a workaround

The problem currently is that there is no workaround. I have attempted to remove the $login var, and use a regular account instead - but this only results in login hanging forever. (And thus still not able to log in).

If you have an LDAP user logging in, it will first do a bind - and refuse login if credentials are invalid. If credentials are valid, it continues to do group lookup. At this point you would already have an authenticated ldap connection available to do the subsequent searches. If you need to look up LDAP groups for a non-ldap user I would argue that the feature is broken.

The PR I submitted will skip this update process when $login is used, so login should now work properly.

Jon Skarpeteig wrote:

The problem currently is that there is no workaround. I have attempted to remove the $login var, and use a regular account instead - but this only results in login hanging forever. (And thus still not able to log in).

I'll probably add a toggle into the auth source so the user group update feature can be disabled on login, which as you said earlier will give us a workaround for when it hangs. I'll do that under ticket #10340.

I don't know yet why it would hang, but it could be a bug in ldap_fluff. Nightly builds now have debug logging of LDAP operations (#10406) so we might soon be able to get to the bottom of that.

If you have an LDAP user logging in, it will first do a bind - and refuse login if credentials are invalid. If credentials are valid, it continues to do group lookup. At this point you would already have an authenticated ldap connection available to do the subsequent searches. If you need to look up LDAP groups for a non-ldap user I would argue that the feature is broken.

True, we would have an authed connection, but there are two other reasons for not supporting $login with group syncing:

1. the user group pages rely on having an LDAP connection available to associate them to LDAP groups, so a service account is required for them to function
2. the syncing isn't fine grained as it syncs all groups that the user is in, so if the user's account had limited visibility on the LDAP server then it could fail finding users in the group, or remove them etc.

It's probably possible to fix these if somebody was determined enough, but when we implemented it, we opted for supporting only one or the other.

Dominic Cleal wrote:

I'll probably add a toggle into the auth source so the user group update feature can be disabled on login, which as you said earlier will give us a workaround for when it hangs. I'll do that under ticket #10340.

Correction, I'll use #10509 to add a toggle and #10340 can remain open for debugging that hang during login.