Project

General

Profile

Actions

Bug #17992

closed

500 when external usergroup users don't match filter

Added by Daniel Lobato Garcia about 7 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Normal
Category:
Authentication
Target version:
Fixed in Releases:
Found in Releases:

Description

Given an Auth source LDAP with a filter like:

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=Red Hat Foreman Users,OU=Groups,OU=Unix,DC=example,DC=net))

with a base DN of 'DC=example, DC=net'

and a LDAP tree like:

- OU = Groups (OU=Unix, DC=example, DC=net..)
- CN = Red Hat Foreman Users
- CN = Foreman Admins

If one tries to add 'Foreman Admins' as an external user group, it will fail with a 500 LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException, as Foreman does not know how to handle this exception. The failure is fine as Foreman Admins doesn't match the LDAP Filter, however we should give better hints to the admin as to what's going on.

1. Foreman looks for the group Foreman Admins within it's base DN. Success
2. ldap_fluff lists all users for the group. Fail: it uses the LDAP filter to do this operation, and users in Foreman Admins will not satisfy "memberOf:1.2.840.113556.1.4.1941:=CN=Red Hat Foreman Users" (member of the Red Hat Foreman Users hierarchy), as it's a different hierarchy tree. It throws UIDNotFoundException, and Foreman doesn't know what to do at this point so it 500s.

Possible solutions:

1. Make sure we apply the filter also on group lookup on LDAP fluff.
2. Handle LdapFluff::Exception on the user group page in Foreman, and try to figure out the cause (say, lookup for the user list without the filter, if that works, explain what's going on)


Related issues 1 (0 open1 closed)

Related to Foreman - Bug #18103: Errors when submitting external user groups not displayedClosedDaniel Lobato Garcia01/17/2017Actions
Actions #1

Updated by Daniel Lobato Garcia about 7 years ago

  • Bugzilla link set to 1408135
Actions #2

Updated by Daniel Lobato Garcia about 7 years ago

Seems like the tree didn't display properly:

  • OU = groups
    • CN = Red Hat Foreman Users
    • CN = Foreman Admins

A proper tree to match the filter would look like:

  • OU = groups
    • CN = Red Hat Foreman Users
      • CN = Foreman Admins
Actions #3

Updated by Daniel Lobato Garcia about 7 years ago

  • Related to Bug #18103: Errors when submitting external user groups not displayed added
Actions #4

Updated by The Foreman Bot about 7 years ago

  • Status changed from New to Ready For Testing
  • Assignee set to Daniel Lobato Garcia
  • Pull request https://github.com/theforeman/foreman/pull/4199 added
Actions #5

Updated by Daniel Lobato Garcia about 7 years ago

  • Target version set to 169
Actions #6

Updated by Brad Buckingham about 7 years ago

  • Target version deleted (169)
Actions #7

Updated by Daniel Lobato Garcia about 7 years ago

  • Bugzilla link deleted (1408135)
  • Pull request deleted (https://github.com/theforeman/foreman/pull/4199)

Unlinking from BZ as the issue was not the one described there.

Actions #8

Updated by Dominic Cleal about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/4199 added
Actions #9

Updated by Daniel Lobato Garcia about 7 years ago

  • Target version set to 1.11.0
Actions #10

Updated by Robert Heinzmann about 7 years ago

This problem also occures when I try to specify an ldap filter that limits the valid users to certain accounts (e.g. selected users).

(|(sAMAccountName=admin1)(sAMAccountName=operator1)(sAMAccountName=user1))
<pre>

When an external group is created I get the Error 500, as SOME members of the external group are excluded by this filter intensionally.

Then ldap_fluff generates queries like: 

<pre>
[ filter=(&(CN=Joe Admin)(|(|(sAMAccountName=admin1)(sAMAccountName=operator1))(sAMAccountName=user1))), base=OU=User,DC=example,DC=com ]
<pre>

As soon as a group member of the externl group is excluded by the filter (e.g. user99), I get:

<pre>
LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException: LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException
</pre>

So this does not only look like a "documentation issue", but also a logical error about how to use the ldap filters.
Actions #11

Updated by Tomer Brisker over 6 years ago

  • translation missing: en.field_release set to 296
Actions #12

Updated by Anonymous over 6 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions #13

Updated by The Foreman Bot over 6 years ago

  • Pull request https://github.com/theforeman/foreman/pull/4902 added
Actions

Also available in: Atom PDF