SyncExternalUsers is deactivating ldap users

[junkb]

• Gitea version (or commit ref): 1.4.0
• Git version: n/a
• Operating system: ubuntu 17.10
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: https://gist.github.com/junkb/63517845b0bfbb110434903137b96fbf

Description

i've set up and am using ldap authentication. this seems to be working fine. users in the specified ldap group are able to log in, and are able to use the system. upon a new user's initial login, they are active, and the user management panel confirms this.

however, once SyncExternalUsers runs, it decides all ldap users need to be deactivated, and does so [see logs referenced above].

once this happens, the user is still able to log in, but is shown in the user management panel as inactive, and cannot be seen by other users [for example, in explore -> users].

users can be manually reactivated, by editing that user's settings in the user management panel, and the user is then again visible, etc., but as soon as SyncExternalUsers runs again, it deactivates everyone.

[lafriks]

Do you have user filter set (&(objectclass=user)(samaccountname=*)(memberof=cn=vcs_users,ou=groups,dc=example,dc=com))?

[lafriks]

It should be (&(objectclass=user)(samaccountname=%s)(memberof=cn=vcs_users,ou=groups,dc=example,dc=com))

[junkb]

no asterisk in the actual filter, no [see screen shot] - that's only appearing in the log output

i don't know go really at all, but could that asterisk be coming from

https://github.com/go-gitea/gitea/blob/master/modules/auth/ldap/ldap.go#L293 ?

it looks like userFilter might be getting explicitly set with a literal '*'?

[junkb]

what else can i do to troubleshoot this further?

[s-hamann]

I experienced similar behaviour until I set the username attribute to sAMAccountName. Does not seem to be as optional as the docs indicate (for AD environments, at least).

[hexathos]

setting username to sAMAaccountName didn't help... my gitea installation with active directory backend is still deactivating users... same goes for the instance with openldap backend... ;c(

[lafriks]

I can't seem to reproduce that

[hexathos]

I am not that fine with go... but
524885d#diff-5b36fdb03ccb6b7625fd57a6c675051dR309

returned two bools (which i assume was isadmin and isactive) while search result returns just isadmin

[liquidat]

I can verify the issue - upon each run of SyncExternalUsers the LDAP user is deactivated. However I fail to reproduce the log message mentioned above, even in Debug mode!

My user filter is much simpler: (&(objectclass=person)(uid=%s)) It is running against a freeipa LDAP server.

• Gitea version (or commit ref): e6b0a2d
• Git version: git version 2.15.0
• Operating system: docker container gitea/gitea:latest running on CentOS
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant

[okimiko]

I can verfiy the issue, too. I reverted to an older image.

• Gitea version (or commit ref): docker -> 6015731584f2
• Git version: n/a
• Operating system: n/a docker
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite

[sapk]

We should maybe raise this issue to kind/bug tag and add to 1.5.0 release ?

[lafriks]

I can not seem to reproduce this bug with either MS AD or OpenLDAP :(

[liquidat]

@lafriks Any idea how we could further debug the problem? I am using the pre-build docker container.

Also, in #3815 (comment) you mentioned that the filter should contain samaccountname and memberof - is this a requirement? As mentioned above I use a rather simple filter, maybe that's the problem?

[lafriks]

@liquidat I'm testing OpenLDAP with same configuration as in tests: https://github.com/go-gitea/gitea/blob/master/integrations/auth_ldap_test.go#L99