278735 - ldap/msad authentication fails with extra parts in LDAPbinddn

Status: RESOLVED WORKSFORME

(Bugzilla :: User Accounts, defect)

Description

[Don Seiler]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041207 Firefox/1.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041207 Firefox/1.0

Using bugzilla-2.18.

My ldapbinddn is like this: cn=User Name:password,ou=User Group.  When I try to
log in against our MS Active Directory, I get auth_err, and no other useful info
or error messages.

Reproducible: Always

Steps to Reproduce:
1. Try to log in.
2. BAM.

Actual Results:  
big red auth_err

Expected Results:  
Log in.

Comment 1

[Don Seiler]

Just an aside that this same cn and ou work fine on our RT install at my employer.

Comment 2

[Don Seiler]

Problem is parsing in Bugzilla/Auth/LDAP.pm

        my ($LDAPbinddn,$LDAPbindpass) = split(":",Param("LDAPbinddn"));

In my case, it puts the ou in with the password.  I've tried to re-order entries
in the binddn, but the AD only likes the certain order.  So parsing will need to
be fixed.

Simplest brute-force option would be to first split LDAPbinddn on ",", assume
first entry is user/pass, then split that on ":".  Might not be ideal.

Comment 3

[Don Seiler]

Edited summary to more accurately reflect nature of bug.

I'll be attaching a patch with my simplistic change.

Comment 4

[Don Seiler]

Attachment: Change to LDAP.pm to parse extra info out of LDAPbinddn

Relies on LDAPbinddn to be in a certain order, but MSAD does so anyway.

Comment 5

[Chris Gianelloni]

I have no problem authenticating with a binddn that has the :password appended
to the end, and this is what Bugzilla expects (with the 2.18 code).

Your ldapbinddn would be:
cn=User Name,ou=User Group:password

Comment 6

[Don Seiler]

Ah.  I bet that would work.  Naturally I overlook the simplest solution.

I'll test this out and check back.

Comment 7

[Don Seiler]

GAH.  This worked just great with stock code.

Thanks for the cluestick, Chris.

Resolving WORKSFORME, if you don't mind.