mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #797] [BUG] WebUI Case Sensitivity #287
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#287
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @inaneverb on GitHub (Jan 15, 2024).
Original GitHub issue: https://github.com/lldap/lldap/issues/797
Describe the bug
Cannot login using 31-len username + 63-len password. But OK if used 5-len username + 11-len password.
I cannot login using these credentials by WebUI (17170 port), but Authelia can successfully login using these creds (at the startup check).
Perhaps, there's some cuts in WebUI? But even if it's so, there's no hint message, like (username too long, or password too long).
To Reproduce
Steps to reproduce the behavior:
user1and passwordpassword123- OK. Everything is fine. Can login using WebUI, can login using Authelia.S46EAHa4OTDzPkLjGmOPZ6jIjVpL0Xiand passwordLnAzLNVn16mVASPu1u5HlTe6SOcj4bQ2aHJkE4E1PB15Ntupz7BU24ujARvtvBO- Fail. Cannot login using WebUI, can login using Authelia.S46EAHa4OTDzPkLjGmOPZ6jIjVpL0Xiand passwordpassword123- Fail. Cannot login using WebUI, can login using Authelia.Expected behavior
Any of:
Logs
Nothing special. According to my tests, providing correct or incorrect credentials leads to the same log message of
lldap:Additional context
Maybe there's some limitations I don't know about? Are they mentioned somewhere?
Provided 31-len username and 63-len password are just randomly generated strings and obviously used only for local tests. So, I don't care exposing them here.
@nitnelave commented on GitHub (Jan 15, 2024):
There are no meaningful restrictions on the user/password. The user ID should be <256 characters to fit in the DB, but that's not the issue here. The password is not actually sent to the server but a zero-knowledge proof is negotiated with the server to prove that you have the same password as when you registered. That proof uses the same code for the web login (where the client doesn't send the password) and for an LDAP login as with Authelia (where the client sends the password - the server acts as both parties to verify the proof).
Some things to test: Is it due to the password length or the username length? What if you try logging in with a long password and short username, or vice-versa?
As for the logs, logging in from the web UI takes 2 messages: You showed me the
opaque_login_start, there should be anopaque_login_finishto match that, unless the password is wrong.You say that logging in fails: what is the error? And at which step? Can you describe it more accurately?
@inaneverb commented on GitHub (Jan 15, 2024):
Thank you for your fast response.
Let me describe the setup more precisely.
There's 3 services: PostgreSQL (for LLDAP and Authelia), LLDAP and Authelia. All envs that are used for LLDAP and Authelia are linked to each other. So, generally speaking, Authelia's LLDAP vars derive their values from the LLDAP ones.
So, when I start the whole stack, both of LLDAP and Authelia runs fine. I mentioned it here, because Authelia has startup checks including check LLDAP conn with given credentials. And no matter what combination of described credentials here will I use, Authelia successfully passes that check. But, if I'd provide an explicitly incorrect password (not the same, that I give to LLDAP), it will fail during startup. This observations leads me to the following thought:
From the Authelia POV, any combination of login+pass I'm talking here about are correct and can be used to authenticate using LDAP protocol (3890 port).
In the first post I mentioned, that I also tried long username + short password and it leads to "Invalid username or password" error.
I tried the combination of short username + long password right now and it works correctly. I can login using either WebUI or Authelia.
So, I think the problem with the username's length.
I tested again 2 cases:
Both of them has following artefacts:
opaque_login_startin logs and no presence ofopaque_login_finish.@Masgalor commented on GitHub (Jan 15, 2024):
FYI
I can not reproduce this problem, all the given user/password combinations work for me.
LLDAP: 0.5.0
Browser: Firefox/Librewolf 121.0
Browser Addons: uBlock, LocalCDN
@inaneverb commented on GitHub (Jan 15, 2024):
Ah, forgot to mention versions.
Docker image's version:
lldap:2024-01-08-alpineLLDAP version output:
lldap 0.5.1-alphaBrowser: Chrome Version 120.0.6099.199 (Official Build) (arm64)
@Masgalor you cannot reproduce the problem using LLDAP's WebUI, right? Not the LDAP port.
@Masgalor commented on GitHub (Jan 15, 2024):
Right, I'm talking about the WebUI.
@nitnelave commented on GitHub (Jan 15, 2024):
And there are no JS errors in the dev console?
@inaneverb commented on GitHub (Jan 15, 2024):
@nitnelave yes, I have JS error in dev console. Sorry for forgetting to check it and provide it alongside with the report.
It refers to
lldap_app.js:597.@Masgalor commented on GitHub (Jan 15, 2024):
Do you have a reverse-proxy or a waf in front of lldap?
Maybe something is limiting your request size or changing your request in another way.
@inaneverb commented on GitHub (Jan 15, 2024):
For all these testings - nope. I use SSH tun to the remote machine directly to the LLDAP WebUI port. So, it's only SSH tun + Docker routes.
SSH tun is opened by
ssh -L 17170:<lldap_ip>:17170 <server_ip> -Nv@nitnelave commented on GitHub (Jan 15, 2024):
Could we get a screenshot of the network requests from the browser when trying to log in?
The JS error is expected (it means it couldn't verify the password, likely because the password was wrong).
@inaneverb commented on GitHub (Jan 15, 2024):
Sure. I attached the screenshot. Also, looks like the main request is
start, because there's no other one. So, here's the data of it:JSON request
{ "username": "S46EAHa4OTDzPkLjGmOPZ6jIjVpL0Xi", "login_start_request": "xlIiZqCbLsbIN2o9++czjj/b2B1PvS0jWyEgj+9IhzjHtabC5+Ii5AxpMlRv8d7k0TQ6r2+troAoZWkbSi/mDcQ/h2qdIO2tMky6OgmdI+nliHSJxwVBxN3AQpmTn9US" }JSON response
{ "server_data": "/8DATnRwTnY21tUGdO/PcH0DBaeZ0oc0QAplrl9rm5aAQoVP2e87oYwlrDAmNle3k1zrwXU0pnmK4aNR+3yQu3POKCjLrFiZ618EFJcR9I6mHCHta2kz1pEISjLKUAJSTOC0CpesDlBJwAKIpSbcXvf9LnEDutqAL9K7qAkgE8sDMjXntVN6Pyn8VqX+K3i6+qqJaCB6H2F4velE/l4lp8bgwMUSR2gbYuhXVjqQvk0ESriKnLVo9HNjEfJMMCK2f+A/TxMOrej0acxosw32aGOQhqbqUj85F+OHjfTgBv+ux2wQgNHom9fALx6QHULAXMI03f9cVI8SIyaGWuBGCIKMUOjUo+lM1Zu6BHE8zB4pJSYVMDlC", "credential_response": "AipMrM/IiBKHqZIFiBUMeyFfRoHszs8VfV0BbN91Y2qwy5dXjSpoMdcoRR17SGp7urIP+SWM6ZIh3ZKeamh9LWEprGiDm4DdmxASAgfAk6s94J1Y8JaSdO+GeJVxS39wXxiVdXmoK9Q42hipZKJ+KgE3mb5e7I43rclN+wzAaJSxBHPyKthEKa8MmiQp/FZ05IUYlxkJDrnie7upfOVRPkbRgrZgBKDIyfUHJnr9mD4qu/RSSlfSDGo8WBKu/cAfgB+uDz15oUkz8uJYEAw8I2xZSDuQ8v2nVTU75dtdMKqK+1UEzIdyJ9Z2dnGA8jN1Zmm7T3DYVr/ZopIWQeK6MJejVEUrHiKKmZz1mi1/rBMg0W4wC8+Kgai9WdhaIVsr9EX0voFF0Tuf+ypwxvt1DiKJ6+cdV7bwqq8X3G0ZMcE=" }Moreover, if it may help you to investigate I may provide all ENVs using which LLDAP is started.
ENV secrets
Screenshot
@martadinata666 commented on GitHub (Jan 15, 2024):
I think this is about case sensitivity. 🤔 Rather than character size.
@inaneverb commented on GitHub (Jan 15, 2024):
@martadinata666 Seems like you're right. I just tested
User1/password123anduser1/password123. First one has been failed and second one successfully logged in.@nitnelave commented on GitHub (Jan 15, 2024):
erf, yeah I see it. That should be an easy fix.
@nitnelave commented on GitHub (Jan 15, 2024):
@inaneverb can you confirm that it's fixed in latest?
@inaneverb commented on GitHub (Jan 16, 2024):
@nitnelave yes, I can confirm that the bug is fixed. Tested in the
:latest-alpinedocker image.Not quite sure that it's expected behaviour, 'cause when I'm logged in I see that my username is lowercase forced despite the case it has been provided originally.
I understand that likely it's the best option to provide backward compatibility and case sensitivity for entities like username, logins, etc is still discussible topic. However, maybe it's better to display username with the same case it has been provided by the user during its creation and use case-insensitive variant of it during some checks and lookups.
Anyway. It works and you got my big thanks for the blazing fast delivery of that fix.
Thank you.
@nitnelave commented on GitHub (Jan 16, 2024):
The username is stored lowercase in the DB (as are most case-insensitive strings apart from email and group names), so it gets displayed as lowercase.
I try to strive for utility first, so a "nicer-looking" feature that would add complexity doesn't pass the bar :)
@nitnelave commented on GitHub (Jan 16, 2024):
And note that thanks to your report, I also fixed the
lldap_set_passwordbinary that had the same case-sensitivity issues!