Bug: Autoconfig LDAP - Thunderbird hangs on open
Status: RESOLVED
Priority: --
Resolution: FIXED
Created: 2022-01-31 04:21:55+00:00
Resolved: 2022-02-03 10:23:25+00:00

Steps to reproduce:

1. Enable anonymous binding on Active Directory (tested on both samba 4.3.11 and 4.6.6)
a. Set dsHeuristics to 0000002
b. Give permissions on Users container (CN=Users,DC=samdom,DC=example,DC=com):
 ANONYMOUS LOGON | This object only | List contents
 ANONYMOUS LOGON | Descendant User objects | Read general information + Read public information

See article for more details: https://activedirectoryfaq.com/2016/09/anonymous-access/

2. Autoconfig (thunderbird.cfg):
 try {
   var userInfo = new Object();
   userInfo.envUser = getenv("USERNAME");
 
   var ldapHost = "jf.samdom.example.com";
   var ldapBase = "dc=samdom,dc=example,dc=com";
   var ldapFilter = 'sAMAccountName=' + userInfo.envUser;
   var ldapAttrs = new Array( "cn", "mail", "title" );
 
   function processLDAPValues(queryResults) {
     for (var i in ldapAttrs)
 	  userInfo[ldapAttrs[i]] = getLDAPValue(queryResults, ldapAttrs[i]);
   }
   getLDAPAttributes( ldapHost, ldapBase, ldapFilter, ldapAttrs.join(",") );
 
   for (var i=0; i < ldapAttrs.length; i++)
  	lockPref('autoconfig.ldap.' + ldapAttrs[i], userInfo[ldapAttrs[i]]);
 } catch(e) {
   displayError("Error: ", e);
 }

Open thunderbird with new profile


Actual results:

Tested versions:
68.12.1 -> ldap doesn't work (displays error) [https://bugzilla.mozilla.org/show_bug.cgi?id=1662433]
78.14.0 -> hangs
91.5.1 -> hangs

Hangs meaning the process is eating CPU (25%+ in my case) and never displays the UI; the process must be force killed.


Expected results:

Now I set on the domain object (DC=samdom,DC=example,DC=com) the following permission:
 ANONYMOUS LOGON | List contents | This object only

And in Autoconfig I change ldapBase to:
 var ldapBase = "cn=users,dc=samdom,dc=example,dc=com";
 
And now it works correctly. Note that if I leave ldapBase as before, the hang still occurs, irrespective of the permissions change.

Now I don't know much about LDAP so maybe my permissions make no sense, but using ldpasearch for instance I can find the properties I need without giving permissions on the domain object. And everywhere I see warnings against allowing anonymous binds so I'm trying to give as little permissions as possible (any chance for GSSAPI auth in autoconfig?).
For instance:
 domain='DC=samdom,DC=example,DC=com'; dc='jf.samdom.example.com:389';
 ldapsearch -LLL -x -H ldap://$dc -b "$domain" '(objectClass=user)' sAMAccountName cn title mail

But in any case the real problem is Thunderbird hanging.

Here's the sequence in Wireshark (filtering with "ldap"):
 First two packets are the same:
 bindRequest(1) "<ROOT>" simple 
 bindResponse(1) success

When it hangs (unbindRequest never happens):
 searchRequest(2) "dc=samdom,dc=example,dc=com" wholeSubtree 
 searchResEntry(2) "CN=VM,CN=Users,DC=samdom,DC=example,DC=com"  | searchResRef(2)  | searchResRef(2)  | searchResRef(2)  | searchResDone(2) success  [1 result]

When it works fine: 
 searchRequest(2) "cn=users,dc=samdom,dc=example,dc=com" wholeSubtree
 searchResEntry(2) "CN=VM,CN=Users,DC=samdom,DC=example,DC=com"  | searchResDone(2) success  [1 result]
 unbindRequest(3)