Bug #51505 for Catalyst-Authentication-Store-LDAP: multiple uid attributes cause role lookups to fail

Fri Nov 13 10:51:36 2009 james [...] jameswhite.org - Ticket created

Subject:	multiple uid attributes cause role lookups to fail
Date:	Fri, 13 Nov 2009 09:51:15 -0600 (CST)
To:	bug-Catalyst-Authentication-Store-LDAP [...] rt.cpan.org
From:	"James S. White" <whitejs [...] jameswhite.org>

If a user has something like: dn: uid=whitejs,ou=People,[% LDAP_BASEDN %] ... uid: whitejs uid: james ... in their ldap entry, then role lookups fail in the case of user_basedn: 'ou=People,[% LDAP_BASEDN %]' user_filter: (&(objectClass=posixAccount)(uid=%s)) user_scope: one user_field: uid user_search_options: deref: always use_roles: 1 role_basedn: 'ou=Sets,[% LDAP_BASEDN %]' role_filter: (&(objectClass=groupOfUniqueNames)(uniqueMember=%s)) role_scope: one role_field: cn role_value: dn role_search_options: deref: always role_search_as_user: 0 the first role lookup will succeed but all subsequent ones error with " Store claimed to have a restorable user, but restoration failed. Did you change the user's id_field?" in the case of user_basedn: 'ou=People,[% LDAP_BASEDN %]' user_filter: (&(objectClass=posixAccount)(uid=%s)) user_scope: one user_field: uid user_search_options: deref: always use_roles: 1 role_basedn: 'ou=Group,[% LDAP_BASEDN %]' role_filter: (&(objectClass=posixGroup)(uid=%s)) role_scope: one role_field: cn role_value: dn role_search_options: deref: always role_search_as_user: 0 All role lookups are denied.

Fri Dec 04 21:57:25 2009 karman [...] cpan.org - Taken

Fri Dec 04 21:58:23 2009 karman [...] cpan.org - Status changed from 'new' to 'open'

Tue Mar 30 20:00:17 2010 SPACEBAT [...] cpan.org - Correspondence added

We don't use LDAP roles, but we have multiple uids for some users and I was running into the same problem. I have patched C::A::S::LDAP::User to check for multiple uids and always use the first one, which worked for me. See attached.

Subject:

catalyst_auth_store_ldap_user.patch

--- /apps/site_perl/5.8.5/Catalyst/Authentication/Store/LDAP/User.pm 2009-12-12 04:54:44.000000000 +1030 +++ User.pm 2010-03-23 16:52:34.000000000 +1030 @@ -107,8 +107,8 @@ return $string; } else { - my ($string) = $self->$userfield; - return $string; + my $val = $self->$userfield; + return ref($val) eq 'ARRAY' ? $val->[0] : $val; } }

Fri Apr 02 22:58:31 2010 peter [...] peknet.com - Correspondence added

Subject:	Re: [rt.cpan.org #51505] multiple uid attributes cause role lookups to fail
Date:	Fri, 02 Apr 2010 21:58:16 -0500
To:	bug-Catalyst-Authentication-Store-LDAP [...] rt.cpan.org
From:	Peter Karman <peter [...] peknet.com>

Andrew Kirkpatrick via RT wrote on 3/30/10 7:00 PM: Show quoted text

> return ref($val) eq 'ARRAY' ? $val->[0] : $val;

thanks, patch applied as r13125. -- Peter Karman . http://peknet.com/ . peter@peknet.com

Fri Apr 02 23:05:26 2010 karman [...] cpan.org - Correspondence added

I've uploaded 1.008 with the patch from Andrew applied. I'm going to close this ticket. If 1.008 does not solve the role issue as well, please reopen.

Fri Apr 02 23:05:27 2010 karman [...] cpan.org - Status changed from 'open' to 'resolved'