Skip to content

Propagate LDAP errors instead of silently ignoring, send more ldap_error signals #379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 10, 2024
Merged

Propagate LDAP errors instead of silently ignoring, send more ldap_error signals #379

merged 1 commit into from
Sep 10, 2024

Conversation

intgr
Copy link
Contributor

@intgr intgr commented Jul 30, 2024 •
edited
Loading

Before I add tests and put more effort in this PR, I would like some indication that I'm on the right track. Please let me know, what you think.

Fixes #378.

  • LDAPError exceptions are now propagated from the LDAPSearch.execute() method, which is used internally in many code paths. It's now possible to distinguish errors from empty results.
  • In particular NestedMemberDNGroupType no longer returns partial results when faced with errors -- fixes Intermittent errors from LDAP cause django-auth-ldap to return partial groups list #378.
  • When MIRROR_GROUPS or MIRROR_GROUPS_EXCEPT is enabled, then an error during group mirroring will fail authentication. Previously it could mirror a partial set of groups or remove all groups.
  • The ldap_error Django signal is now sent for more situations -- previously it only reported errors from authentication, but nothing else.
  • We could enable the new 'error propagation' logic unconditionally in newer django-auth-ldap versions.
  • To ease migration pains, we could enable new logic by default, but create a setting to restore previous "ignore" behavior. Though if some environment frequently experiences errors, the admins should be made aware of it.
  • I could also make error propagation an opt-in feature, and restore old behavior by default.

intgr
intgr commented Jul 30, 2024
View reviewed changes
@francoisfreitag
Copy link
Member

We could enable the new 'error propagation' logic unconditionally in newer django-auth-ldap versions.

I would do that because it’s simpler, and the reported issue can easily cause data loss and confusion in systems using the library.
This lib is fairly stable and few changes are made with each release, and releases aren’t that frequent either. Users shouldn’t need a backward compatibility period because of the impact of other changes on their code base.
I would bump major version, and we do need to write out the release note carefully to communicate the changes and migration paths clearly.

francoisfreitag
francoisfreitag reviewed Jul 30, 2024
View reviewed changes
Copy link
Member

@francoisfreitag francoisfreitag left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your effort, the patch looks on the right track to me, and I’m sure it will be helpful to others. 🌟

@intgr
Copy link
Contributor Author

intgr commented Jul 31, 2024

Thanks, this response is encouraging. I can probably find time tomorrow to improve this PR further and add tests.

intgr
intgr commented Aug 6, 2024
View reviewed changes
intgr
intgr commented Aug 6, 2024
View reviewed changes
@intgr
Copy link
Contributor Author

intgr commented Aug 6, 2024

Pushed tests and documentation updates for ldap_error signal.

@intgr
Copy link
Contributor Author

intgr commented Aug 15, 2024

Hi! No pressure, it would be helpful to have some indication: do you feel like this is close to ready, or still needs a more thorough review? When might you be able to do a complete review (days? weeks?)

@francoisfreitag
Copy link
Member

Hi! I’ve been off the past week, and will be busy catching up and with somewhat urgent stuff at work. I’ll try to give this patch a thorough review in the upcoming weeks. At a glance, it looks mostly fine 🙌.

francoisfreitag
francoisfreitag approved these changes Sep 2, 2024
View reviewed changes
Copy link
Member

@francoisfreitag francoisfreitag left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking great, thank you for this patch!

The next step is probably to draft the release note. I’ll try to do that in the upcoming days.

@francoisfreitag
Copy link
Member

Thanks for the update. You can go ahead and squash the commits.

@intgr
Propagate LDAP errors instead of silently ignoring, send more ldap_er…
42a7eb7 
…ror signals

* LDAPError exceptions are now propagated from the
  `LDAPSearch.execute()` method, which is used internally in many code
  paths. It's now possible to distinguish errors from empty results.
* In particular `NestedMemberDNGroupType` no longer returns partial
  results when faced with errors, but also propagate the results.
* When `MIRROR_GROUPS` or `MIRROR_GROUPS_EXCEPT` is enabled, then an
  error during group mirroring will fail authentication. Previously it
  could mirror a partial set of groups or remove all groups.
* The `ldap_error` Django signal is now sent for more situations --
  previously it only reported errors from authentication, but nothing
  else.
@intgr intgr force-pushed the propagate-ldap-errors branch from 49b416b to 42a7eb7 Compare September 5, 2024 22:03
@intgr
Copy link
Contributor Author

intgr commented Sep 5, 2024 •
edited
Loading

Ah sorry, I missed your last comment. Squashed now.

(By the way, is there any reason you don't use GitHub's "Squash and merge" feature?)

@francoisfreitag
Copy link
Member

No big reason. It’s kind of nice to let the author have their say in the wording of the final commit message. 🤷

@francoisfreitag francoisfreitag merged commit 3685761 into django-auth-ldap:master Sep 10, 2024
8 checks passed
@francoisfreitag
Copy link
Member

I’m thinking of setting the following section in the release note for this commit, please let me know if you see possible improvements.

Breaking changes

An LDAPError during an LDAP search operation would cause the library to assume an empty result set.
When mirroring groups, only a portion of a user groups would be mirrored. Allowing them to proceed with authentication may then break application access controls, as membership to a group (imagine an exclude group) would be missing.

The library now systematically sends the ldap_error django signal. If an LDAPError occurs during an operation, the operation is aborted. In particular, when mirroring groups (LDAPUser._mirror_groups), an AuthenticationFailed might now be raised.

See #378 for details.

@intgr intgr deleted the propagate-ldap-errors branch September 10, 2024 18:34
@andersk andersk mentioned this pull request Oct 20, 2024
Merged
terjekv added a commit to unioslo/mreg that referenced this pull request Nov 20, 2024
@terjekv
Dependency updates.
172c363 
django-auth-ldap: 4.8.0 -> 5.1.0
django-filter: 24.2 -> 24.3
structlog: 24.1.0 -> 24.4.0
rich: 13.7.1 -> 13.9.4
gunicorn: 22.0.0 -> 23.0.0
idna: 3.7 -> 3.10
sentry-sdk: 2.3.1 -> 2.8.0
tzdata: 2024.1 -> 2024.2

Changes to `django-auth-ldap` warrant an extra look at the ldap auth code, as per django-auth-ldap/django-auth-ldap#379.
This was referenced Nov 20, 2024
Closed
Merged
terjekv added a commit to unioslo/mreg that referenced this pull request Nov 25, 2024
@terjekv
Dependency updates. (#561)
af6611e 
django-auth-ldap: 4.8.0 -> 5.1.0
django-filter: 24.2 -> 24.3
structlog: 24.1.0 -> 24.4.0
rich: 13.7.1 -> 13.9.4
gunicorn: 22.0.0 -> 23.0.0
idna: 3.7 -> 3.10
sentry-sdk: 2.3.1 -> 2.8.0
tzdata: 2024.1 -> 2024.2

Changes to `django-auth-ldap` warrant an extra look at the ldap auth code, as per django-auth-ldap/django-auth-ldap#379.
@jakobsen-lrz jakobsen-lrz mentioned this pull request May 22, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@francoisfreitag francoisfreitag francoisfreitag approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Intermittent errors from LDAP cause django-auth-ldap to return partial groups list
2 participants
@intgr @francoisfreitag
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy