Skip to content

Fixed #12331: Change the way userDn is build for non-AD login#13972

Closed
P-EB wants to merge 1 commit intogrokability:masterfrom
P-EB:master
Closed

Fixed #12331: Change the way userDn is build for non-AD login#13972
P-EB wants to merge 1 commit intogrokability:masterfrom
P-EB:master

Conversation

@P-EB
Copy link
Copy Markdown

@P-EB P-EB commented Nov 29, 2023

Currently, snipe-it relies on a manually crafted user DN to bind a user and therefore check if they exist, and then, it searches in LDAP if the user is found when applying the filter.

This works nicely when the base_dn is "fixed". In a company with multiple business lines or business units, though, there might be more than one OU for LDAP users, and in that case, crafting the DN manually might fail.

This patch aims at crafting the userDn from a ldap_search, assuming the user field is unique. If more than 1 user is found, the user field is not unique and the login method will throw.

This increases significantly the LDAP login flexibility.

Fixes #12331

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

  • Tested on our stage SnipeIT server.

Test Configuration:

  • PHP version: 8.1
  • MySQL version: MariaDB 10.3.39
  • Webserver version: nginx 1.14.2, snipeIT latest version
  • OS version: Debian 10

Checklist:

Currently, snipe-it relies on a manually crafted user DN to bind a user
and therefore check if they exist, and *then*, it searches in LDAP if
the user is found when applying the filter.

This works nicely when the base_dn is "fixed". In a company with
multiple business lines or business units, though, there might be more
than one OU for LDAP users, and in that case, crafting the DN manually
might fail.

This patch aims at crafting the userDn from a ldap_search, assuming the
user field is unique. If more than 1 user is found, the user field is
not unique and the login method will throw.

This increases significantly the LDAP login flexibility.

Fixes grokability#12331
@P-EB P-EB requested a review from snipe as a code owner November 29, 2023 11:11
@welcome
Copy link
Copy Markdown

welcome bot commented Nov 29, 2023

💖 Thanks for this pull request! 💖

We use semantic commit messages to streamline the release process and easily generate changelogs between versions. Before your pull request can be merged, you should update your pull request title to start with a semantic prefix if it doesn't have one already.

Examples of commit messages with semantic prefixes:

  • Fixed #<issue number>: don't overwrite prevent_default if default wasn't prevented
  • Added #<issue number>: add checkout functionality to assets
  • Improved Asset Checkout: use new notification method for checkout

Things that will help get your PR across the finish line:

  • Document any user-facing changes you've made.
  • Include tests when adding/changing behavior.
  • Include screenshots and animated GIFs whenever possible.

We get a lot of pull requests on this repo, so please be patient and we will get back to you as soon as we can.

@what-the-diff
Copy link
Copy Markdown

what-the-diff bot commented Nov 29, 2023

PR Summary

  • Enhanced Search Functionality for LDAP Users
    The team has incorporated additional logic to improve how the system finds and links to LDAP (Lightweight Directory Access Protocol) users. This enhancement offers more efficiency and accuracy in identifying user profiles in the network.

  • Revised Filter Query
    The filter query, which is used to sort and sift through data, has been modified for better data handling, further streamlining the process of looking up information.

  • Introduction of Logging
    New logging functionality has been added. This new feature will track events and errors, providing a valuable tool for troubleshooting and system maintenance, thereby reducing downtime and inefficiencies.

@P-EB P-EB changed the title Change the way userDn is build for non-AD login Fixed #12331: Change the way userDn is build for non-AD login Nov 29, 2023
@uberbrady
Copy link
Copy Markdown
Member

I took a swing at re-implementing this functionality here: #17832 - does this doe the same trick for you?

@uberbrady uberbrady closed this Oct 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

LDAP sync works - login/test fails if user not in base DN

2 participants