<div dir="ltr">control: tags -1 severity normal<div>control: tags -1 tags + help<br><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 25, 2016 at 4:17 PM, Markus Wigge <span dir="ltr"><<a href="mailto:markus@cultcom.de" target="_blank">markus@cultcom.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Package: freeradius-ldap<br>
Version: 2.2.5+dfsg-0.2<br>
Severity: important<br>
Tags: upstream<br>
<br>
Dear Maintainer,<br>
<br>
I encountered severe problems trying to match users to their LDAP Groups.<br>
<br>
Within the inner-tunnel config I check the group ACL for a given user like<br>
this:<br>
<br>
if (LDAP-Group == "NET_eduroam") {<br>
noop<br>
}<br>
else {<br>
reject<br>
}<br>
<br>
Unfortunately the groups are nested so that I need to query the LDAP server<br>
(Active Directory) like this:<br>
<br>
groupmembership_filter = "(&(objectClass=group)(member:<wbr>1.2.840.113556.1.4.1941:=%{<wbr>control:Ldap-UserDn}))"<br>
<br>
That query is working fine with ldapsearch and well tested.<br>
<br>
The rlm_ldap module needs to find the UserDN first to put it in this filter.<br>
<br>
Here I guess lies some kind of bug. Some debug output:<br>
....<br>
[ldap] performing search in dc=XXX,dc=YY, with filter (sAMAccountName=foobar)<br>
....<br>
expand: (&(objectClass=group)(member:<wbr>1.2.840.113556.1.4.1941:=%{<wbr>control:Ldap-UserDn}))<br>
-> (&(objectClass=group)(member:<wbr>1.2.840.113556.1.4.1941:=CN\<wbr>3dBar\5c\5c\2c Foo\2cOU\3dAccounts\2cDC\<wbr>3dXXX\2cDC\3dYY))<br>
<br>
rlm_ldap finds the correct user object and reads its DN. Then it places the<br>
DN inside the group filter and escapes the whole string. But as it appears to<br>
me the DN was already escaped beforehand and is now scaped twice.<br>
See the "\5c\5c" part.<br>
<br>
The CN of the User in the directory has the form:<br>
CN: <surename>, <givenname><br>
<br>
Then DN is according to that<br>
DN: CN=Bar\, Foo,OU=....<br>
<br>
The very same request is working fine with "ldapsearch" when I remove the<br>
second "\5c" occurance.<br>
<br>
<br>
I assume this bug is important because it might lead to very unexpected<br>
results.<br></blockquote><div><br></div><div>Please see <a href="https://www.debian.org/Bugs/Developer#severities">https://www.debian.org/Bugs/Developer#severities</a> for how the Debian bug severities are to be interpreted. “important” is explained as “a bug which has a major effect on the usability of a package […]”, for which I don’t see any evidence here — there seems to be a problem with an individual setup in an individual module. Hence, downgrading to “normal”.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
On a second system I tried a backported version for freeradius 3.0.12 and<br>
cannot reproduce the error. So I think this was fixed with the rewrite<br>
of the rlm_ldap module.<br></blockquote><div><br></div><div>I can’t spend any time on this issue. I’m focusing on getting version 3 into Debian. By the way, if you’re using the 3.0.12+dfsg-1 package, please respond to my question in <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797181#69">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797181#69</a></div><div><br></div><div>You might want to try reporting this issue upstream at <a href="https://github.com/FreeRADIUS/freeradius-server/">https://github.com/FreeRADIUS/freeradius-server/</a></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Hopefully some of you are better in C and are able to produce a small<br>
patch to fix this issue.<br>
<br>
<br>
Regards,<br>
Markus<br>
<br>
<br>
-- System Information:<br>
Debian Release: 8.6<br>
APT prefers stable-updates<br>
APT policy: (500, 'stable-updates'), (500, 'stable')<br>
Architecture: amd64 (x86_64)<br>
<br>
Kernel: Linux 3.16.0-4-amd64 (SMP w/16 CPU cores)<br>
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)<br>
Shell: /bin/sh linked to /bin/dash<br>
Init: systemd (via /run/systemd/system)<br>
<br>
Versions of packages freeradius-ldap depends on:<br>
ii libc6 2.19-18+deb8u6<br>
ii libldap-2.4-2 2.4.40+dfsg-1+deb8u2<br>
ii freeradius 2.2.5+dfsg-0.2<br>
ii freeradius-common 2.2.5+dfsg-0.2<br>
ii freeradius-krb5 2.2.5+dfsg-0.2<br>
ii freeradius-ldap 2.2.5+dfsg-0.2<br>
ii freeradius-utils 2.2.5+dfsg-0.2<br>
ii libfreeradius2 2.2.5+dfsg-0.2<br>
<br>
<br>
<br>
freeradius-ldap recommends no packages.<br>
<br>
freeradius-ldap suggests no packages.<br>
<br>
______________________________<wbr>_________________<br>
Pkg-freeradius-maintainers mailing list<br>
<a href="mailto:Pkg-freeradius-maintainers@lists.alioth.debian.org">Pkg-freeradius-maintainers@<wbr>lists.alioth.debian.org</a><br>
<a href="https://lists.alioth.debian.org/mailman/listinfo/pkg-freeradius-maintainers" rel="noreferrer" target="_blank">https://lists.alioth.debian.<wbr>org/mailman/listinfo/pkg-<wbr>freeradius-maintainers</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Best regards,<br>Michael</div>
</div></div></div></div>