99697 - LDAP authentication does not check for emailregexp parameter.

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P2)

Description

[Alexey N. Solofnenko]

When using LDAP Bugzilla silently copies LDAP accounts into profiles table
without checking user emails againts email filter. On one server it is possible
to host multiple email domains and right now there is no way to restrict which
users can access Bugzilla.

Comment 1

[Alexey N. Solofnenko]

proposed fix:
diff -c -r1.100 CGI.pl
*** CGI.pl      2001/08/26 18:51:45     1.100
--- CGI.pl      2001/10/13 00:59:12
***************
*** 907,912 ****
--- 923,938 ----
         # Mozilla::LDAP::Entry->getValues returns an array for the attribute
         # requested, even if there's only one entry.
         $enteredlogin = ($userEntry->getValues(Param("LDAPmailattribute")))[0];
+
+        my $emailregexp = Param("emailregexp");
+        unless ( $enteredlogin =~ m/$emailregexp/ ) {
+          print "Content-type: text/html\n\n";
+          PutHeader("Login Failed");
+          print "The username or password you entered is not valid..\n";
+          print "Please click <b>Back</b> and try again.\n";
+          PutFooter();
+          exit;
+        }

         # We're going to need the cryptpwd for this user from the database
         # so that we can set the cookie below, even though we're not going

Comment 2

[James A. Laska]

Perhaps we don't want the LDAP login to be an email address?  LDAP would allow
us to login as anything that can uniquely identify that user that is stored
under their LDAP record.  Employee number, ssn, ...whatever.  Once you know its
them, you could go and grab their email address from their LDAP record.  I would
suggest creating a parameter LDAPloginattribute.  The admin would specify what
LDAP attribute to authenticate it's users against.  LDAPmailattribute would be
set to the attribute which holds their email addresses.  This wouldn't require
many changes...let me know what you folks think...

Comment 3

[Joel Peshkin]

This is a bug where we have not even decided IF we want to do it, so I'm
removing the 2.18 target.

That said, I hope LDAP lets you log in with a username and then retrieve and use
the email address.

Comment 4

[Max Kanat-Alexander]

This was fixed by the Auth re-write. (You can see the change in the create_or_update_user sub in Bugzilla::Auth::Verify.)