Use service bind for searching LDAP groups #2534

mitchelldavis · 2017-03-28T02:07:18Z

Addressing #2387!

jefferai · 2017-03-28T15:05:49Z

@shomron Any chance I can get your opinion on this?

shomron

Overall 👍 - this is the fix follows what we originally discussed way back in August.

Aside from improving the error messages I think we can proceed with this logic.

Separately, the code could do with a little refactoring and cleanup to make it easier to follow and manage the relation between DiscoverDN and BindDN/BindPassword in a more concise way.

Regarding the discussion in #2387, we should definitely not perform the group search before user authentication - that would just expose the LDAP server to unauthenticated DoS.

shomron · 2017-04-05T15:30:33Z

builtin/credential/ldap/backend.go

@@ -122,6 +122,17 @@ func (b *backend) Login(req *logical.Request, username string, password string)
 		return nil, logical.ErrorResponse(fmt.Sprintf("LDAP bind failed: %v", err)), nil
 	}

+	// We re-bind to the BindDN if it's defined because we assume
+	// the BindDN should be the one to search, not the user logging in.
+	if cfg.DiscoverDN || (cfg.BindDN != "" && cfg.BindPassword != "") {


This is symmetric with the logic from getBindDN - my only hesitation is that in cases where (cfg.DiscoverDN == true && (cfg.BindDN == "" || cfg.BindPassword == "") - we will do an anonymous rebind after an authenticated user bind - potentially resulting in more restricted privileges.

I am not sure whether that is a realistic configuration to know whether this is a valid concern.

@shomron, should I just get rid of cfg.DiscoverDN clause? And simply re-bind if the second clause is true? That makes the most sense to me.

shomron · 2017-04-05T16:24:53Z

builtin/credential/ldap/backend.go

+	// the BindDN should be the one to search, not the user logging in.
+	if cfg.DiscoverDN || (cfg.BindDN != "" && cfg.BindPassword != "") {
+		if err := c.Bind(cfg.BindDN, cfg.BindPassword); err != nil {
+			return nil, logical.ErrorResponse(err.Error()), nil


Given we are performing up to three binds per login - I think we should improve the error messages to more clearly indicate where in the process we failed.

So maybe:

return nil, logical.ErrorResponse("Encountered an error when re-binding as the BindDN User: " + err.Error()), nil

shomron · 2017-04-05T16:37:48Z

builtin/credential/ldap/backend.go

+			b.Logger().Debug("auth/ldap: Re-Bound to original BindDN")
+		}
+	}
+
 	userDN, err := b.getUserDN(cfg, c, bindDN)


Between bindDN and cfg.BindDN, following the flow is a bit challenging. Perhaps we should rename the bindDN local variable to something like userBindDN, to differentiate it from the service bind DN - cfg.BindDN ?

Also note userBindDN would not necessarily equal userDN - userDN is the canonical representation of the user, whereas userBindDN could in fact be using a different mechanism such as user principal name (user@domain).

That would make sense to me, but if we're going to go down that path, shouldn't we rename the getBindDN method then? Line 107 is where bindDN get's set so...

jackdwyer · 2017-04-05T18:52:53Z

@mitchelldavis thanks for addressing this, I just started working on JumpCloud LDAP integration with our Vault cluster 👍

mitchelldavis · 2017-04-05T22:58:09Z

@shomron, I believe I've addressed all that. Does the code reflect what you were thinking?

lattwood · 2017-04-10T21:59:18Z

@shomron @mitchelldavis anything I can do to help get this into the next release?

mitchelldavis · 2017-04-10T23:41:14Z

I'm not sure @lattwood. I think we're just waiting for a final review.

shomron

Thanks for jumping on this! Two minor nits, but looks good!

In the future I'd like to see the tests overhauled with a mock LDAP provider, allowing us to capture this behavior in test.

shomron · 2017-04-11T04:56:05Z

builtin/credential/ldap/backend.go

 	if err != nil {
 		return nil, logical.ErrorResponse(err.Error()), nil
 	}

 	if b.Logger().IsDebug() {
-		b.Logger().Debug("auth/ldap: BindDN fetched", "username", username, "binddn", bindDN)
+		b.Logger().Debug("auth/ldap: BindDN fetched", "username", username, "binddn", userBindDN)


nit: Debug message does not reflect binddn->userbinddn.

shomron · 2017-04-11T04:58:36Z

builtin/credential/ldap/backend.go

+	// the BindDN should be the one to search, not the user logging in.
+	if cfg.BindDN != "" && cfg.BindPassword != "" {
+		if err := c.Bind(cfg.BindDN, cfg.BindPassword); err != nil {
+			return nil, logical.ErrorResponse("Encountered an error while attempting to re-bind with the BindDN User: " + err.Error()), nil


nit: use fmt.

return nil, logical.ErrorResponse(fmt.Sprintf("Encountered an error while attempting to re-bind with the BindDN User: %v", err)), nil

jefferai · 2017-04-11T15:09:39Z

@shomron thanks for reviewing this!

@shomron @mitchelldavis any backwards incompatible or notably changed behavior as a result of this?

In addition, any necessary documentation changes?

mitchelldavis · 2017-04-11T15:26:21Z

@jefferai, @shomron, that build issue looks like the vault unit tests failed. Have we seen that happening in other places because I didn't touch that code.

@jefferai, to answer your question about the documentation - The documentation didn't really specify much to begin with. It makes sense to me to mention that the binddn user needs permission to search groups because it's what is being used to do that search.

jefferai · 2017-04-13T20:37:59Z

@mitchelldavis We get some transient unit test failures that we know of (often issues with the MySQL docker container) so don't worry about it if it's not a part of your changes.

Please add the mention in the docs about the binddn user needing permission to search groups.

Still waiting to hear from you and @shomron about any backwards incompatibilities.

…rming the group search.

mitchelldavis · 2017-04-14T13:02:07Z

@jefferai, I've added those updates to the docs. I would love @shomron to look at the few lines I edited/added though. I'm not an ldap expert so want to make sure that I'm not adding confusion or am outright wrong.

lattwood · 2017-04-14T23:34:22Z

@mitchelldavis might be worth mentioning the user and group searches are done under separate (but identical) binds.

mitchelldavis · 2017-04-15T04:26:40Z

Because we have to bind to the binddn user twice @lattwood?

shomron · 2017-04-17T19:10:27Z

The clarification in the documentation looks good to me.

@jefferai I don't see this as a backwards-incompatible change, more of a bugfix. It might be worthwhile adding something along these lines to the release notes:

LDAP Auth Backend - Group membership queries will now run as the binddn user when binddn/bindpass are configured, rather than as the authenticating user as was the case previously.

jefferai · 2017-04-18T19:51:42Z

Sounds good to me!

Merging -- thanks everyone!

Updating the ldap backend to address issue hashicorp#2387

71fd6e8

jefferai changed the title ~~Updating the ldap backend to address issue #2387~~ Use service bind for searching LDAP groups Mar 28, 2017

jefferai added this to the 0.7.1 milestone Mar 28, 2017

shomron reviewed Apr 5, 2017

View reviewed changes

Mitch Davis added 3 commits April 5, 2017 14:21

Addressing lines 127 and 129 from @shomron's comments

7583c60

Changing 'bind' to 're-bind'.

ab7f99c

Addressing line 136 of @shomron's comments

ee62b8f

shomron approved these changes Apr 11, 2017

View reviewed changes

Addressing @somron's review requests on formatting and clarity.

286c3b8

Updating the docs to add a little more clarity on which user is perfo…

9ec9434

…rming the group search.

jefferai merged commit a208159 into hashicorp:master Apr 18, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use service bind for searching LDAP groups #2534

Use service bind for searching LDAP groups #2534

mitchelldavis commented Mar 28, 2017

jefferai commented Mar 28, 2017

shomron left a comment

shomron Apr 5, 2017

mitchelldavis Apr 5, 2017

shomron Apr 5, 2017

mitchelldavis Apr 5, 2017

shomron Apr 5, 2017

mitchelldavis Apr 5, 2017 •

edited

Loading

jackdwyer commented Apr 5, 2017

mitchelldavis commented Apr 5, 2017

lattwood commented Apr 10, 2017

mitchelldavis commented Apr 10, 2017

shomron left a comment •

edited

Loading

shomron Apr 11, 2017

shomron Apr 11, 2017

jefferai commented Apr 11, 2017

mitchelldavis commented Apr 11, 2017 •

edited

Loading

jefferai commented Apr 13, 2017

mitchelldavis commented Apr 14, 2017

lattwood commented Apr 14, 2017

mitchelldavis commented Apr 15, 2017

shomron commented Apr 17, 2017 •

edited

Loading

jefferai commented Apr 18, 2017

Use service bind for searching LDAP groups #2534

Use service bind for searching LDAP groups #2534

Conversation

mitchelldavis commented Mar 28, 2017

jefferai commented Mar 28, 2017

shomron left a comment

Choose a reason for hiding this comment

shomron Apr 5, 2017

Choose a reason for hiding this comment

mitchelldavis Apr 5, 2017

Choose a reason for hiding this comment

shomron Apr 5, 2017

Choose a reason for hiding this comment

mitchelldavis Apr 5, 2017

Choose a reason for hiding this comment

shomron Apr 5, 2017

Choose a reason for hiding this comment

mitchelldavis Apr 5, 2017 • edited Loading

Choose a reason for hiding this comment

jackdwyer commented Apr 5, 2017

mitchelldavis commented Apr 5, 2017

lattwood commented Apr 10, 2017

mitchelldavis commented Apr 10, 2017

shomron left a comment • edited Loading

Choose a reason for hiding this comment

shomron Apr 11, 2017

Choose a reason for hiding this comment

shomron Apr 11, 2017

Choose a reason for hiding this comment

jefferai commented Apr 11, 2017

mitchelldavis commented Apr 11, 2017 • edited Loading

jefferai commented Apr 13, 2017

mitchelldavis commented Apr 14, 2017

lattwood commented Apr 14, 2017

mitchelldavis commented Apr 15, 2017

shomron commented Apr 17, 2017 • edited Loading

jefferai commented Apr 18, 2017

mitchelldavis Apr 5, 2017 •

edited

Loading

shomron left a comment •

edited

Loading

mitchelldavis commented Apr 11, 2017 •

edited

Loading

shomron commented Apr 17, 2017 •

edited

Loading