When initially configuring ldapauthenticator, I accidentally left bind_dn_template out

If don't set bind_dn_template - <code class="notransl

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Without bind_dn_template, any password is authenticated successfully!,about jupyterhub/ldapauthenticator

dhirschfeld commented on June 6, 2024 1

This sounds like a bug. I'll check if I can reproduce to confirm...

from ldapauthenticator.

ermakovpetr commented on June 6, 2024

this is fact!
after update 1.1->1.2.2 have this problem

from ldapauthenticator.

ermakovpetr commented on June 6, 2024

If don't set bind_dn_template - bind_dn_template=[]
and isBound don't set True
https://github.com/jupyterhub/ldapauthenticator/blob/master/ldapauthenticator/ldapauthenticator.py#L315-L335

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Lines 315 to 335 in 718eb59

    
           for dn in bind_dn_template: 
        
               userdn = dn.format(username=resolved_username) 
        
               msg = 'Status of user bind {username} with {userdn} : {isBound}' 
        
               try: 
        
                   conn = getConnection(userdn, username, password) 
        
               except ldap3.core.exceptions.LDAPBindError as exc: 
        
                   isBound = False 
        
                   msg += '\n{exc_type}: {exc_msg}'.format( 
        
                       exc_type=exc.__class__.__name__, 
        
                       exc_msg=exc.args[0] if exc.args else '' 
        
                   ) 
        
               else: 
        
                   isBound = conn.bind() 
        
               msg = msg.format( 
        
                   username=username, 
        
                   userdn=userdn, 
        
                   isBound=isBound 
        
               ) 
        
               self.log.debug(msg) 
        
               if isBound: 
        
                   break

from ldapauthenticator.

ermakovpetr commented on June 6, 2024

But we can take userdn from connection after search user conn.response[0]['dn']
my temporarily dirty fix :
#88
If you ok about the idea, I try to make pull-request correctly and beautifully

from ldapauthenticator.

AnirudhVyas commented on June 6, 2024

How do we set bind_dn_template?

from ldapauthenticator.

dhirschfeld commented on June 6, 2024

@AnirudhVyas - bind_dn_template is set in your jupyterhub_config.py file.
https://github.com/jupyterhub/ldapauthenticator#ldapauthenticatorbind_dn_template

from ldapauthenticator.

dhirschfeld commented on June 6, 2024

I can't reproduce and I can't follow the logic how this could be the case.

isBound is initially set to False:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 298 in 718eb59

isBound = False

If bind_dn_template is empty this entire block is skipped:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 315 in 718eb59

for dn in bind_dn_template:

therefore isBound is still False here and this block is also skipped:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 337 in 718eb59

if isBound:

which then falls through to the else clause which blocks access:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Lines 377 to 381 in 718eb59

    
           else: 
        
               self.log.warn('Invalid password for user {username}'.format( 
        
                   username=username, 
        
               )) 
        
               return None

from ldapauthenticator.

dhirschfeld commented on June 6, 2024

Poking around some more, it seems that if your bind_dn_template is an empty string '' then it does indeed authenticate any password :(

from ldapauthenticator.

ermakovpetr commented on June 6, 2024

@dhirschfeld
correctly I understand that my PR (#88) doesn't conflict your PR. and I can add functionality (get bind_dn_template from first request's response)
?

from ldapauthenticator.

dhirschfeld commented on June 6, 2024

@ermakovpetr - yes, I think the functionality in #88 is orthogonal to that in #95

from ldapauthenticator.

Without bind_dn_template, any password is authenticated successfully! about ldapauthenticator HOT 10 CLOSED

Comments (10)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	for dn in bind_dn_template:
	userdn = dn.format(username=resolved_username)
	msg = 'Status of user bind {username} with {userdn} : {isBound}'
	try:
	conn = getConnection(userdn, username, password)
	except ldap3.core.exceptions.LDAPBindError as exc:
	isBound = False
	msg += '\n{exc_type}: {exc_msg}'.format(
	exc_type=exc.__class__.__name__,
	exc_msg=exc.args[0] if exc.args else ''
	)
	else:
	isBound = conn.bind()
	msg = msg.format(
	username=username,
	userdn=userdn,
	isBound=isBound
	)
	self.log.debug(msg)
	if isBound:
	break

	else:
	self.log.warn('Invalid password for user {username}'.format(
	username=username,
	))
	return None