Skip to content

(ticket-537) user bindUser for group detection #247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 3 commits into from
Closed

(ticket-537) user bindUser for group detection #247

wants to merge 3 commits into from

Conversation

RainerW
Copy link
Contributor

@RainerW RainerW commented Mar 23, 2015

This should is a fix for *( https://code.google.com/p/gitblit/issues/detail?id=537) *
-> For security reason a normal user cannot read groups from our LDAP, so in this case the search user has to be used for group/team detection.

would appreciate some feedback :
1: Based on the comment "// Binding will stop any LDAP-Injection Attacks ...." should there be a separate setting for enabling this 'feature', or what actually is a LDAP-Injection Attack?
2: getLdapConnection() should now be called createLdapConnection() ?

Edit:
Original google code ticket is not available anymore?
Problem was:

  • inital ldap bind does work to authenticate the user
  • the new connection was then used to no query the team memberships
    • his works with an AD, but on OpenLDAP a user has not the right's to see the groups
  • so in (our) OpenLDAP setup the Team memberships have to user the 'old' non user ldap connection

@gitblit
Copy link
Collaborator

gitblit commented Mar 23, 2015

At a quick glance you are changing the existing behavior to solve your issue, but you may be breaking other installs. This needs some discussion on the mailing list. Clearly with LDAP what works for some may not work for all - hence the reason for your PR.

gitblit added a commit that referenced this pull request May 22, 2015
@gitblit
Merged #247 "Add Kerberos5/GSS authentication to ssh"
bcb1bee
RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 2, 2015
@RainerW
gitblit-org#247 allow enable/disable of ldap bind switch via config
f04f891 
     new config key : "realm.ldap.groupQueryWithUser"
@RainerW
Copy link
Contributor Author

RainerW commented Oct 2, 2015

created new branch and extracted new behaviour into it with a config key ( commit f04f891)

This was referenced Oct 2, 2015
Closed
Closed
RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 8, 2015
@RainerW
gitblit-org#247 allow enable/disable of ldap bind switch via config r…
bf07822 
…ebase to develop
RainerW added a commit to RainerW/gitblit that referenced this pull request Oct 8, 2015
@RainerW
gitblit-org#247 allow enable/disable of ldap bind switch via config r…
f723152 
…ebase to develop
@RainerW
Copy link
Contributor Author

RainerW commented Oct 8, 2015

rebased to develop, not sure about the "since 1.7.0" Information in defaults.properties

@gitblit
Copy link
Collaborator

gitblit commented Oct 9, 2015

Hi @RainerW.

Github doesn't allow you to merge a PR to another branch AFAIK i.e. if I merge now, your change will merge to master even though you rebased on develop because master is the branch for which the PR was initially opened.

Having said that, while your change solves your problem and may solve #920, I don't like this solution - changing the behavior of isAuthenticated. If the problem is related to group/team search then the fix should be isolated to the connection used in getTeamsFromLdap.

@gitblit gitblit closed this Oct 9, 2015
@flaix flaix mentioned this pull request Nov 14, 2016
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@RainerW @gitblit