Repository navigation
Login via user_ldap sends two LDAP bind requests instead of one #28467
Description
Hi!
Steps to reproduce
- use current ownCloud master (26631fd), user_ldap master (5d9f3fca)
- apply the fix from Fix user_ldap login on master by using userSession to retrieve the user object #28450 (otherwise, login via user_ldap does not work at all)
- configure the user_ldap app, use a logging LDAP proxy (e.g. logging-proxy.py) or Wireshark to log LDAP traffic between ownCloud and backend
- log into ownCloud using the credentials of a user located on the LDAP server (e.g.
user123)
Expected behaviour
ownCloud should send exactly one LDAP Bind Request in the context of user123 to check the user credentials.
Actual behaviour
ownCloud sends two LDAP Bind Requests, as we can see from the LDAP proxy log:
$ grep BindRequest log.txt | grep user123 2017-07-22 17:54:52+0200 [LDAPClient,client] Request [7ff7749c2d88] => LDAPBindRequest(version=3, dn='uid=user123,cn=users,dc=ucs-test,dc=intranet', auth=****, sasl=False) 2017-07-22 17:54:53+0200 [LDAPClient,client] Request [7ff7749ceea8] => LDAPBindRequest(version=3, dn='uid=user123,cn=users,dc=ucs-test,dc=intranet', auth=****, sasl=False)
We already discussed in #26065 why this is suboptimal.
tl;dr: Suppose the LDAP backend implements two-factor authentication via One Time Passwords. Then, the first bind request will succeed, but the second bind request will fail because the one-time password is reused. Thus, the user cannot log in.
Here are the tracebacks of the two calls to OCA\User_LDAP\LDAP->bind:
#0 /var/www/owncloud/apps/user_ldap/lib/Connection.php(608): OCA\User_LDAP\LDAP->bind(Resource id #53, 'uid=user123,cn=...', 'password123')
#1 /var/www/owncloud/apps/user_ldap/lib/Access.php(1411): OCA\User_LDAP\Connection->bind()
#2 /var/www/owncloud/apps/user_ldap/lib/User_LDAP.php(134): OCA\User_LDAP\Access->areCredentialsValid('uid=user123,cn=...', 'password123')
#3 [internal function]: OCA\User_LDAP\User_LDAP->checkPassword('user123', 'password123')
#4 /var/www/owncloud/apps/user_ldap/lib/User_Proxy.php(79): call_user_func_array(Array, Array)
#5 /var/www/owncloud/apps/user_ldap/lib/Proxy.php(140): OCA\User_LDAP\User_Proxy->walkBackends('user123', 'checkPassword', Array)
#6 /var/www/owncloud/apps/user_ldap/lib/User_Proxy.php(194): OCA\User_LDAP\Proxy->handleRequest('user123', 'checkPassword', Array)
#7 /var/www/owncloud/lib/private/User/Manager.php(215): OCA\User_LDAP\User_Proxy->checkPassword('user123', 'password123')
#8 /var/www/owncloud/lib/private/User/Session.php(467): OC\User\Manager->checkPassword('user123', 'password123')
#9 /var/www/owncloud/lib/private/User/Session.php(301): OC\User\Session->loginWithPassword('user123', 'password123')
#10 /var/www/owncloud/core/Controller/LoginController.php(186): OC\User\Session->login('user123', 'password123')
#11 [internal function]: OC\Core\Controller\LoginController->tryLogin('user123', 'password123', NULL)
#12 /var/www/owncloud/lib/private/AppFramework/Http/Dispatcher.php(159): call_user_func_array(Array, Array)
#13 /var/www/owncloud/lib/private/AppFramework/Http/Dispatcher.php(89): OC\AppFramework\Http\Dispatcher->executeController(Object(OC\Core\Controller\LoginController), 'tryLogin')
#14 /var/www/owncloud/lib/private/AppFramework/App.php(98): OC\AppFramework\Http\Dispatcher->dispatch(Object(OC\Core\Controller\LoginController), 'tryLogin')
#15 /var/www/owncloud/lib/private/AppFramework/Routing/RouteActionHandler.php(46): OC\AppFramework\App::main('LoginController', 'tryLogin', Object(OC\AppFramework\DependencyInjection\DIContainer), Array)
#16 [internal function]: OC\AppFramework\Routing\RouteActionHandler->__invoke(Array)
#17 /var/www/owncloud/lib/private/Route/Router.php(299): call_user_func(Object(OC\AppFramework\Routing\RouteActionHandler), Array)
#18 /var/www/owncloud/lib/base.php(930): OC\Route\Router->match('/login')
#19 /var/www/owncloud/index.php(49): OC::handleRequest()
#20 {main}
and the second one:
#1 /var/www/owncloud/apps/user_ldap/lib/Access.php(1411): OCA\User_LDAP\Connection->bind()
#2 /var/www/owncloud/apps/user_ldap/lib/User_LDAP.php(134): OCA\User_LDAP\Access->areCredentialsValid('uid=user123,cn=...', 'password123')
#3 [internal function]: OCA\User_LDAP\User_LDAP->checkPassword('user123', 'password123')
#4 /var/www/owncloud/apps/user_ldap/lib/User_Proxy.php(79): call_user_func_array(Array, Array)
#5 /var/www/owncloud/apps/user_ldap/lib/Proxy.php(140): OCA\User_LDAP\User_Proxy->walkBackends('user123', 'checkPassword', Array)
#6 /var/www/owncloud/apps/user_ldap/lib/User_Proxy.php(194): OCA\User_LDAP\Proxy->handleRequest('user123', 'checkPassword', Array)
#7 /var/www/owncloud/lib/private/User/Manager.php(215): OCA\User_LDAP\User_Proxy->checkPassword('user123', 'password123')
#8 /var/www/owncloud/lib/private/User/Session.php(637): OC\User\Manager->checkPassword('user123', 'password123')
#9 /var/www/owncloud/lib/private/User/Session.php(672): OC\User\Session->checkTokenCredentials(Object(OC\Authentication\Token\DefaultToken), 'h7mtvk98tci5vso...')
#10 /var/www/owncloud/lib/private/User/Session.php(235): OC\User\Session->validateToken('h7mtvk98tci5vso...')
#11 /var/www/owncloud/lib/private/legacy/app.php(138): OC\User\Session->validateSession()
#12 /var/www/owncloud/lib/base.php(900): OC_App::loadApps(Array)
#13 /var/www/owncloud/index.php(49): OC::handleRequest()
Apparently, bind request 2 is triggered by validateSession, i.e. the user session is initially validated once right after login. Considering that the password was already checked in the previous request, do you think it may be possible to get rid of the second bind request? I'll open a PR with a proposed fix shortly.
(Side note: The sessions of logged-in users are validated in regular intervals (which also breaks 2FA), but #28269 has already made the interval configurable)
Server configuration
Operating system: Ubuntu 16.04.1 LTS
Web server: Apache 2.4.18-2ubuntu3.3
Database: MariaDB 10.0.29-0ubuntu0.16.04.1
PHP version: 7.0.18-0ubuntu0.16.04.1
ownCloud version: owncloud master
Updated from an older ownCloud or fresh install: fresh install
Where did you install ownCloud from: git
Signing status (ownCloud 9.0 and above): (installed from git)
The content of config/config.php:
{
"system": {
"instanceid": "ocbpiwifuq5m",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"192.168.33.234"
],
"datadirectory": "\/var\/www\/owncloud\/data",
"overwrite.cli.url": "http:\/\/192.168.33.234\/owncloud",
"dbtype": "mysql",
"version": "10.0.2.3",
"dbname": "owncloud",
"dbhost": "localhost",
"dbtableprefix": "oc_",
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"logtimezone": "UTC",
"installed": true,
"ldapIgnoreNamingRules": false
}
}
List of activated apps:
Enabled:
- comments: 0.3.0
- dav: 0.3.0
- federatedfilesharing: 0.3.0
- federation: 0.1.0
- files: 1.5.1
- files_external: 0.7.0
- files_sharing: 0.10.0
- files_trashbin: 0.9.0
- files_versions: 1.3.0
- provisioning_api: 0.5.0
- systemtags: 0.3.0
- updatenotification: 0.2.1
- user_ldap: 0.9.1
Disabled:
- testing
- theme-example
Are you using external storage, if yes which one: no
Are you using encryption: no
Are you using an external user-backend, if yes which one: LDAP
LDAP configuration (delete this part if not used)
+-------------------------------+-------------------------------------------------+
| Configuration | |
+-------------------------------+-------------------------------------------------+
| hasMemberOfFilterSupport | 0 |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | uid=serviceacc,cn=users,dc=ucs-test,dc=intranet |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | cn=users,dc=ucs-test,dc=intranet |
| ldapBaseGroups | cn=users,dc=ucs-test,dc=intranet |
| ldapBaseUsers | cn=users,dc=ucs-test,dc=intranet |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | |
| ldapExpertUsernameAttr | |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | |
| ldapGroupFilterGroups | |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | |
| ldapGroupMemberAssocAttr | uniqueMember |
| ldapHost | 192.168.33.1 |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(|(objectclass=person))(uid=%uid)) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 0 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 389 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | displayname |
| ldapUserDisplayName2 | |
| ldapUserFilter | (|(objectclass=person)) |
| ldapUserFilterGroups | |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | person |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| useMemberOfToDetectMembership | 1 |
+-------------------------------+-------------------------------------------------+
Client configuration
Browser: Chrome 52
Operating system: Arch Linux
Logs
no interesting logs :)
Thanks!
Activity
lock commentedon Aug 1, 2019
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.