starred/cypht

Fork 0

mirror of https://github.com/cypht-org/cypht.git synced 2026-04-25 04:56:03 +03:00

[GH-ISSUE #292] Ldap contact and password strange behavior #254

New issue

Closed

opened 2026-02-25 21:34:34 +03:00 by kerem · 7 comments

kerem commented

2026-02-25 21:34:34 +03:00

Owner

Originally created by @lesar on GitHub (Oct 15, 2018).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/292

Originally assigned to: @jasonmunro on GitHub.

I'm trying cypht and I like it a lott.

I have configured ldap module and work well. I have put user and psw in site config and not in the module ini file. I try to remove the user and psw but:

If I put a blank empty value no change are saved.
If I put some random letter and save change, the change are saved, but the ldap contact module still read all contact.

Is there a ldap search on the roadmap?

Best regards,
Leonardo

Originally created by @lesar on GitHub (Oct 15, 2018). Original GitHub issue: https://github.com/cypht-org/cypht/issues/292 Originally assigned to: @jasonmunro on GitHub. I'm trying cypht and I like it a lott. I have configured ldap module and work well. I have put user and psw in site config and not in the module ini file. I try to remove the user and psw but: * If I put a blank empty value no change are saved. * If I put some random letter and save change, the change are saved, but the ldap contact module still read all contact. Is there a ldap search on the roadmap? Best regards, Leonardo

kerem

2026-02-25 21:34:34 +03:00

closed this issue
added the
bug

ldap_contacts
labels

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@jasonmunro commented on GitHub (Oct 17, 2018):

I'm trying cypht and I like it a lott.

Thanks! I appreciate your feedback.

I have configured ldap module and work well. I have put user and psw in site config and not in the module ini file. I try to remove the user and psw but:

I would not recommend doing that, but I don't think it breaks anything.

If I put a blank empty value no change are saved.

If I put some random letter and save change, the change are saved, but the ldap contact module still read all contact.

To clarify - you are changing the hm3.ini file to remove the user and pass values for the LDAP server, then rerunning the config_gen.php script (and logging out and back in) - and it still is able to access the LDAP contact list?

If that is correct, are you sure your LDAP server is configured to require authentication?

Is there a ldap search on the roadmap?

Not currently, but it would be a nice improvement especially for large addressbooks. I will create a new issue to track that request.

@jasonmunro commented on GitHub (Oct 17, 2018): > I'm trying cypht and I like it a lott. Thanks! I appreciate your feedback. > I have configured ldap module and work well. I have put user and psw in site config and not in the module ini file. I try to remove the user and psw but: I would not recommend doing that, but I don't think it breaks anything. > * If I put a blank empty value no change are saved. > * If I put some random letter and save change, the change are saved, but the ldap contact module still read all contact. To clarify - you are changing the hm3.ini file to remove the user and pass values for the LDAP server, then rerunning the config_gen.php script (and logging out and back in) - and it still is able to access the LDAP contact list? If that is correct, are you sure your LDAP server is configured to require authentication? > Is there a ldap search on the roadmap? Not currently, but it would be a nice improvement especially for large addressbooks. I will create a new issue to track that request.

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@lesar commented on GitHub (Oct 18, 2018):

To clarify - you are changing the hm3.ini file to remove the user and pass values for the LDAP server, then rerunning the config_gen.php script (and logging out and back in) - and it still is able to access the LDAP contact list?

No I'm try to change this setting on http://localhost/mail/?page=settings
under Addressbooks -> Personal

In my hm3.ini I have put only the ldap_auth_base_dn and give the user and pws run time during authentication.

In ldap.ini I have not put user and pws.

If that is correct, are you sure your LDAP server is configured to require authentication?

My Ldap server is configure to require authentication: I have installed it.

Best regards,
Leonardo

@lesar commented on GitHub (Oct 18, 2018): >To clarify - you are changing the hm3.ini file to remove the user and pass values for the LDAP server, then rerunning the config_gen.php script (and logging out and back in) - and it still is able to access the LDAP contact list? No I'm try to change this setting on http://localhost/mail/?page=settings under `Addressbooks -> Personal` In my hm3.ini I have put only the `ldap_auth_base_dn` and give the user and pws run time during authentication. In ldap.ini I have ***not*** put user and pws. >If that is correct, are you sure your LDAP server is configured to require authentication? My Ldap server is configure to require authentication: I have installed it. Best regards, Leonardo

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@jasonmunro commented on GitHub (Oct 18, 2018):

@lesar Ok, thanks for the clarification. I will dig into that part of the code and see what is going on!

@jasonmunro commented on GitHub (Oct 18, 2018): @lesar Ok, thanks for the clarification. I will dig into that part of the code and see what is going on!

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@jasonmunro commented on GitHub (Oct 18, 2018):

Looks like the code is not actually using the username and password from the settings page! Because of that, we are doing an "anonymous bind" to the server. I just tested this locally and see what you are seeing. However, if you are still getting a contact list from your LDAP server that likely means you have not disabled anonymous binding, so you might want to check that. I had to apply an ldif like:

dn: olcDatabase={-1}frontend,cn=config
add: olcRequires
olcRequires: authc

Working on a fix for the username and password now.

@jasonmunro commented on GitHub (Oct 18, 2018): Looks like the code is not actually using the username and password from the settings page! Because of that, we are doing an "anonymous bind" to the server. I just tested this locally and see what you are seeing. However, if you are still getting a contact list from your LDAP server that likely means you have not disabled anonymous binding, so you might want to check that. I had to apply an ldif like: ``` dn: olcDatabase={-1}frontend,cn=config add: olcRequires olcRequires: authc ``` Working on a fix for the username and password now.

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@jasonmunro commented on GitHub (Oct 18, 2018):

A fix has been pushed to the master branch. Thanks for the feedback!

@jasonmunro commented on GitHub (Oct 18, 2018): A fix has been pushed to the master branch. Thanks for the feedback!

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@lesar commented on GitHub (Oct 19, 2018):

Thank you for the fix. You are right I have anonymous binding enable: I do not know that in ubuntu is enable by default.

Now I have disable it.

To disable it I have use this ldif:

#sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /usr/share/slapd/ldap_disable_bind_anon.ldif
dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon

dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc

@lesar commented on GitHub (Oct 19, 2018): Thank you for the fix. You are right I have anonymous binding enable: I do not know that in ubuntu is enable by default. Now I have disable it. To disable it I have use this ldif: ```ldif #sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /usr/share/slapd/ldap_disable_bind_anon.ldif dn: cn=config changetype: modify add: olcDisallows olcDisallows: bind_anon dn: cn=config changetype: modify add: olcRequires olcRequires: authc dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcRequires olcRequires: authc ```

kerem commented

2026-02-25 21:34:34 +03:00

Author

Owner

@jasonmunro commented on GitHub (Oct 30, 2018):

I believe this is resolved so I'm closing this issue. Thanks for the feedback! If you are still having problems please re-open or file a new issue.

@jasonmunro commented on GitHub (Oct 30, 2018): I believe this is resolved so I'm closing this issue. Thanks for the feedback! If you are still having problems please re-open or file a new issue.