Syspass: LDAP configuration not working as expected with group filter

[ejouvin]

Yesterday, I try to complete my installation by setting restriction with group name in the LDAP configuration.

let's say I have the following organization in my OpenLDAP, with memberOf overly installed.

Base search: dc=ejnserver,dc=fr
Two organization unit:

• Groups: ou=groups,dc=ejnserver,dc=fr
• Users: ou=people,dc=ejnserver,dc=fr

I have one group for the filter : cn=syspassUsers,ou=groups,dc=ejnserver,dc=fr

So In the configuration, I just in group name: syspassUsers

On the LDAP configuration page, verification say I have 1 match, which is expected.

But, other users than the expected one can try to connect to the interface. The account is created in the user tables under sysPass, waiting for activation. I can give a temporary master password and the user can use the application. As if the filter on the group is not applied on authenticate.

I have ontice the fact that the group should be under the same root as the user, but why on configuration page it gives me only one match, but in fact anyone can connect ?

[nuxsmin]

Can you get some excerpt from a LDAP user/group search?. It would be useful to check if the overlay is working fine, because there are two ways to get the current user group membership:

• By looking at the user's attributes
• By looking for group member attributes.

[ejouvin]

Hum, I am pretty sure my overlays works fine, because the ldap is already by other applications with LDAP search filter.

I will try to investigate the case. But what confuse me, is the fact that on configuration only 1 user was matching, and not during the login.

For the expected user to be valide, the value in memberof contains : cn=syspassUsers,ou=groups,dc=ejnserver,dc=fr

And in the group it contains : uid=etienne,ou=people,dc=ejnserver,dc=fr
which is the user dn.

[nuxsmin]

Can you try out to put the full group DN?

[ejouvin]

Just did this try:

Still the same organization
Base search: dc=ejnserver,dc=fr
Two organization unit:

Groups: ou=groups,dc=ejnserver,dc=fr
Users: ou=people,dc=ejnserver,dc=fr

But the group name set in LDAP configuration is the full DN : cn=syspassUsers,ou=groups,dc=ejnserver,dc=fr

And it works as expected.

Last try, because putting the full DN works, was to set the specific people branch as base search, so ou=people,dc=ejnserver,dc=fr, but no chance for that.

As it is working now, I guess this is not a bug.

Just a little bit confusing in the first case, because the configuration validate only one user and "anyone" can connect.

Thanks for the tips. But I have some other issue/improvement in my bag, for latter ;)

[nuxsmin]

Sure, reviewing the code I've found some bugs that will be fixed in the next commit.

The base search is used to look for users and groups so if one of them is out of the scope, it will fail...

Thanks for the feedback!!