8000 Escape ldap id when using normal attribute syntax (#25) by stianst · Pull Request #25037 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Escape ldap id when using normal attribute syntax (#25) #25037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stianst wants to merge 1 commit into from
Closed

Escape ldap id when using normal attribute syntax (#25) #25037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ...ion/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
import org.keycloak.models.ModelException;
import org.keycloak.storage.ldap.LDAPConfig;
import org.keycloak.storage.ldap.idm.model.LDAPDn;
import org.keycloak.storage.ldap.idm.query.EscapeStrategy;
import org.keycloak.storage.ldap.idm.query.internal.LDAPQuery;
import org.keycloak.storage.ldap.idm.store.ldap.extended.PasswordModifyRequest;
import org.keycloak.storage.ldap.mappers.LDAPOperationDecorator;
Expand Down Expand Up @@ -386,7 +387,7 @@ public String getFilterById(String id) {
).append(LDAPUtil.convertGUIDToEdirectoryHexString(id)).append(")");
} else {
filter.append("(objectClass=*)(").append(getUuidAttributeName()).append(LDAPConstants.EQUAL)
.append(id).append(")");
.append(EscapeStrategy.DEFAULT.escape(id)).append(")");
}

if (config.getCustomUserSearchFilter() != null) {
Expand Down
2 changes: 1 addition & 1 deletion ...org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ private UserModel getUser(AuthenticationFlowContext context, MultivaluedMap<Stri

private UserModel getUserFromForm(AuthenticationFlowContext context, MultivaluedMap<String, String> inputData) {
String username = inputData.getFirst(AuthenticationManager.FORM_USERNAME);
if (username == null) {
if (username == null || username.isEmpty()) {
context.getEvent().error(Errors.USER_NOT_FOUND);
Response challengeResponse = challenge(context, getDefaultChallengeMessage(context), FIELD_USERNAME);
context.failureChallenge(AuthenticationFlowError.INVALID_USER, challengeResponse);
Expand Down
42 changes: 42 additions & 0 deletions ...tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSpecialCharsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.ComponentRepresentation;
import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.storage.ldap.idm.model.LDAPObject;
import org.keycloak.storage.ldap.mappers.membership.LDAPGroupMapperMode;
Expand Down Expand Up @@ -198,4 +199,45 @@ public void test03_specialCharUserJoiningSpecialCharGroup() {
});
}

@Test
public void test04_loginWithSpecialCharacterUsingSameUUIDThanUsernameAttribute() {
// remove users from the ldap to use the new UUID attribute
adminClient.realm(TEST_REALM_NAME).userStorage().removeImportedUsers(ldapModelId);

// change the UUID attribute to be the username attribute
String origUuidAttrName = testingClient.server().fetch(session -> {
LDAPTestContext ctx = LDAPTestContext.init(session);

String uidAttrName = ctx.getLdapProvider().getLdapIdentityStore().getConfig().getUsernameLdapAttribute();
String origUuidAttrNamee = ctx.getLdapModel().get(LDAPConstants.UUID_LDAP_ATTRIBUTE);
ctx.getLdapModel().put(LDAPConstants.UUID_LDAP_ATTRIBUTE, uidAttrName);
ctx.getRealm().updateComponent(ctx.getLdapModel());

return origUuidAttrNamee;
}, String.class);

try {
// assert the user is found and UUID is the name
List<UserRepresentation> users = adminClient.realm(TEST_REALM_NAME).users().search("jamees,key*cložak)ppp", true);
Assert.assertEquals("User not found", 1, users.size());
UserRepresentation jamees = users.iterator().next();
Assert.assertEquals("Incorrect user", "jamees,key*cložak)ppp", jamees.getUsername());
Assert.assertEquals("Incorrect UUID attribute", "jamees,key*cložak)ppp", jamees.firstAttribute(LDAPConstants.LDAP_ID));

// Fail login with wildcard
loginPage.open();
loginPage.login("jamees*", "Password1");
Assert.assertEquals("Invalid username or password.", loginPage.getInputError());

// Success login as username exactly match
loginPage.login("jamees,key*cložak)ppp", "Password1");
Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
} finally {
// Revert config changes to be back to previous UUID attribute
ComponentRepresentation ldapRep = testRealm().components().component(ldapModelId).toRepresentation();
ldapRep.getConfig().putSingle(LDAPConstants.UUID_LDAP_ATTRIBUTE, origUuidAttrName);
testRealm().components().component(ldapModelId).update(ldapRep);
}
}
}
0