totoroliu/open-build-service — comment on commit 5a65582e7315ab8ca1a3bf5cb49f37dbb08273ba
File:  line 0
By totoroliu:

There's something wrong.

When LDAP_MODE is enabled,
and OBS database has only 2 default user accounts (Admin and _nobody_),
I asked one of LDAP user (mfernand) to login OBS using LDAP username/password,
he is able to log-in,
which he should not because OBS database doesn't have his account.

From api production log,
it seems OBS creates (mfernand) user account automatically
when user passed LDAP check.
(No user found in database, creating)

I have the following settings:
/srv/www/obs/api/config/environments/production.rb
LDAP_MODE = :on

/srv/www/obs/api/config/options.yml
new_user_registration: deny

/srv/www/obs/api/log/production.log
[^[[32mINFO ^[[0m|#15512] Processing PersonController#userinfo (for 127.0.0.1 at 2011-11-24 15:45:48) [GET]
[^[[32mINFO ^[[0m|#15512] Parameters: {"login"=>"mfernand"}
[^[[0;37mDEBUG^[[0m|#15512] Validate XML request: #
[^[[0;37mDEBUG^[[0m|#15512] no schema found, skipping validation for methodgetactionuserinfotyperequestcontrollerpersonloginmfernand
[^[[0;37mDEBUG^[[0m|#15512] AUTH: ["Basic", "bWZlcm5hbmQ6aXd0NTBpMjAxMw=="]
[^[[0;37mDEBUG^[[0m|#15512] Using LDAP to find mfernand
[^[[0;37mDEBUG^[[0m|#15512] Looking for mfernand using ldap
[^[[0;37mDEBUG^[[0m|#15512] Cache read: ldap_cache_userpasswd:mfernand
[^[[0;37mDEBUG^[[0m|#15512] Search for (cn=mfernand)
[^[[0;37mDEBUG^[[0m|#15512] Connecting to nt-rmna-0001 as 'CN=mfernand,CN=Users,DC=corp,DC=ad,DC=broadcom,DC=com'
[^[[0;37mDEBUG^[[0m|#15512] Bound as CN=mfernand,CN=Users,DC=corp,DC=ad,DC=broadcom,DC=com
[^[[0;37mDEBUG^[[0m|#15512] login success for checking with ldap server
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mUser Load (0.2ms)^[[0m ^[[0mSELECT * FROM `users` WHERE (`users`.`login` = 'mfernand') LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] No user found in database, creating
[^[[0;37mDEBUG^[[0m|#15512] Email: mfernand@broadcom.com
[^[[0;37mDEBUG^[[0m|#15512] Name : mfernand
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (0.0ms)^[[0m ^[[0;1mBEGIN^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mUser Load (0.1ms)^[[0m ^[[0mSELECT `users`.id FROM `users` WHERE (`users`.`login` = 'mfernand') LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mUser Create (0.1ms)^[[0m ^[[0;1mINSERT INTO `users` (`realname`, `created_at`, `password_hash_type`, `password_crypted`, `updated_at`, `adminnote`, `last_logged_in_at`, `password_salt`, `login`, `password`, `login_failure_count`, `email`, `state`) VALUES('', '2011-11-24 15:45:48', 'md5', 'osf91KEZHCVpM', '2011-11-24 15:45:48', NULL, '2011-11-24 15:45:48', 'EllHTHCvrK', x'6d6665726e616e64', '6b48fce43cb8bef709eba4aca64a0d91', 0, 'mfernand@broadcom.com', 1)^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mSQL (2.3ms)^[[0m ^[[0mCOMMIT^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mRole Load (0.1ms)^[[0m ^[[0;1mSELECT * FROM `roles` WHERE (`roles`.`title` = 'User') LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mSQL (0.0ms)^[[0m ^[[0mBEGIN^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (0.3ms)^[[0m ^[[0;1mdescribe `roles_users`^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mSQL (0.1ms)^[[0m ^[[0mINSERT INTO `roles_users` (`role_id`, `user_id`) VALUES (2, 7)^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (1.8ms)^[[0m ^[[0;1mCOMMIT^[[0m
[^[[0;37mDEBUG^[[0m|#15512] saving new user...
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mSQL (0.0ms)^[[0m ^[[0mBEGIN^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mUser Load (0.1ms)^[[0m ^[[0;1mSELECT `users`.id FROM `users` WHERE (`users`.`login` = 'mfernand' AND `users`.id <> 7) LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] Error - skipping to create user
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mUser Update (0.4ms)^[[0m ^[[0mUPDATE `users` SET `updated_at` = '2011-11-24 15:45:48', `adminnote` = 'User created via LDAP', `realname` = 'mfernand', `state` = 2 WHERE `id` = 7^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (2.4ms)^[[0m ^[[0;1mCOMMIT^[[0m
[^[[0;37mDEBUG^[[0m|#15512] USER found: mfernand
[^[[0;37mDEBUG^[[0m|#15512] User mfernand initialised
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mDbProject Load (0.1ms)^[[0m ^[[0mSELECT * FROM `db_projects` WHERE (name = BINARY 'home:mfernand') LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mRole Load (0.0ms)^[[0m ^[[0;1mSELECT * FROM `roles` WHERE (title = BINARY 'maintainer') LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] adding user: mfernand, maintainer
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mProjectUserRoleRelationship Columns (1.0ms)^[[0m ^[[0mSHOW FIELDS FROM `project_user_role_relationships`^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (0.0ms)^[[0m ^[[0;1mBEGIN^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mProjectUserRoleRelationship Load (4.7ms)^[[0m ^[[0mSELECT * FROM `project_user_role_relationships` WHERE (db_project_id = NULL AND role_id = 3 AND bs_user_id = 7) LIMIT 1^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mDbProject Create (0.1ms)^[[0m ^[[0;1mINSERT INTO `db_projects` (`name`, `created_at`, `title`, `maintenance_project_id`, `updated_at`, `remoteurl`, `type_id`, `description`, `develproject_id`, `remoteproject`) VALUES(x'686f6d653a6d6665726e616e64', '2011-11-24 15:45:48', 'mfernand\'s Home Project', NULL, '2011-11-24 15:45:48', NULL, NULL, 'Please add a suitable description and don\'t forget to add some repositories you want to build your packages against (just click on \'Repositories\' above). Have fun!', NULL, NULL)^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mProjectUserRoleRelationship Create (0.2ms)^[[0m ^[[0mINSERT INTO `project_user_role_relationships` (`db_project_id`, `role_id`, `bs_user_id`) VALUES(4, 3, 7)^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (2.4ms)^[[0m ^[[0;1mCOMMIT^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mSQL (0.0ms)^[[0m ^[[0mBEGIN^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mSQL (0.0ms)^[[0m ^[[0;1mCOMMIT^[[0m
[^[[0;37mDEBUG^[[0m|#15512] Cache read: meta_project_4
[^[[0;37mDEBUG^[[0m|#15512] ----------------- rendering project home:mfernand ------------------------
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mLinkedProject Load (5.1ms)^[[0m ^[[0mSELECT * FROM `linked_projects` WHERE (`linked_projects`.db_project_id = 4) ORDER BY position^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mUser Load (0.2ms)^[[0m ^[[0;1mSELECT bu.*, r.title AS role_name FROM `users` bu, project_user_role_relationships purr, roles r WHERE (bu.id = purr.bs_user_id AND purr.db_project_id = 4 AND r.id = purr.role_id) ^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mGroup Load (0.1ms)^[[0m ^[[0mSELECT bg.*, r.title AS role_name FROM `groups` bg, project_group_role_relationships pgrr, roles r WHERE (bg.id = pgrr.bs_group_id AND pgrr.db_project_id = 4 AND r.id = pgrr.role_id) ^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;36;1mDownload Load (0.1ms)^[[0m ^[[0;1mSELECT * FROM `downloads` WHERE (`downloads`.db_project_id = 4) ^[[0m
[^[[0;37mDEBUG^[[0m|#15512] ^[[4;35;1mFlag Load (0.1ms)^[[0m ^[[0mSELECT * FROM `flags` WHERE (`flags`.db_project_id = 4) ^[[0m

-----Original Message-----
From: Adrian Schröter [mailto:reply@reply.github.com]
Sent: Thursday, November 24, 2011 6:30 AM
To: Rick Liu
Subject: Re: [open-build-service] [api] add LDAP_OBSDB_FILTER feature (5a65582)

In commit 0d25aa6d4a376f75905227ada1f529bb4bbf31aa I hopefully have fixed the new_user_registration=deny configuration also for LDAP (I have no test setup). When you set this, you need to create user object as admin to allow the user for login (using his ldap login&password) and you can also lock the user by setting his state to "locked" or "unconfirmed". The password in OBS user database should not matter when using LDAP and the user object is there.

Does this solve your use case ? (could you test ?;) It will be in obs-server 2.2.100 package in openSUSE:Tools:Unstable.

---
Reply to this email directly or view it on GitHub:
https://github.com/totoroliu/open-build-service/commit/5a65582e7315ab8ca1a3bf5cb49f37dbb08273ba#commitcomment-744415