From 1a965cfe5e74408dd765f79e6414d93d438347aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Thu, 30 Jul 2020 16:13:34 +0200 Subject: [PATCH] return invalid credentials when user was not found MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- changelog/unreleased/fix-bind-when-not-found.md | 5 +++++ pkg/server/glauth/handler.go | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changelog/unreleased/fix-bind-when-not-found.md diff --git a/changelog/unreleased/fix-bind-when-not-found.md b/changelog/unreleased/fix-bind-when-not-found.md new file mode 100644 index 0000000000..81c77e7fe7 --- /dev/null +++ b/changelog/unreleased/fix-bind-when-not-found.md @@ -0,0 +1,5 @@ +Bugfix: return invalid credentials when user was not found + +We were relying on an error code of the ListAccounts call when the username and password was wrong. But the list will be empty if no user with the given login was found. So we also need to check if the list of accounts is empty. + +https://github.com/owncloud/ocis-glauth/pull/30 \ No newline at end of file diff --git a/pkg/server/glauth/handler.go b/pkg/server/glauth/handler.go index 4ca9408f80..ac7ec863a0 100644 --- a/pkg/server/glauth/handler.go +++ b/pkg/server/glauth/handler.go @@ -64,14 +64,14 @@ func (h ocisHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (ldap.LDAP userName := strings.TrimPrefix(parts[0], "cn=") // check password - _, err := h.as.ListAccounts(context.TODO(), &accounts.ListAccountsRequest{ + res, err := h.as.ListAccounts(context.TODO(), &accounts.ListAccountsRequest{ //Query: fmt.Sprintf("username eq '%s'", username), // TODO this allows lookung up users when you know the username using basic auth // adding the password to the query is an option but sending the sover the wira a la scim seems ugly // but to set passwords our accounts need it anyway Query: fmt.Sprintf("login eq '%s' and password eq '%s'", userName, bindSimplePw), }) - if err != nil { + if err != nil || len(res.Accounts) == 0 { h.log.Error(). Str("username", userName). Str("binddn", bindDN).