Properly handle octet (byte) strings when converting LDAP responses
If LDAP returns a UUID as an octet string the LDAP driver will fail to convert it to something meaningful. The error usually looks something like: ID attribute objectGUID not found in LDAP object Microsoft AD's `objectGUID` parameter is stored and transmitted as an octet string [0]. If you attempt to use the `objectGUID` to generate user or group IDs, you'll get an HTTP 404 because keystone can't decode it properly. This is unfortunate because `objectGUID` are a fixed length, UUID format, and ideal for generating IDs in keystone. As opposed to using the object's CN, which is variable length, and can generate hashes that are larger than keystone's database table limit for user IDs. [0] https://docs.microsoft.com/en-us/windows/win32/ad/reading-an-objectampaposs-objectguid-and-creating-a-string-representation-of-the-guid Conflicts: keystone/identity/backends/ldap/common.py Due to python2 -> python3 migration code. Change-Id: Id80b17bdff015e10340e636102576b7435bd564f Closes-Bug: 1889936 (cherry picked from commit8bf222ac5d
) (cherry picked from commitd5870f69c1
)
This commit is contained in:
parent
56c95ce785
commit
a0b6560364
|
@ -18,6 +18,7 @@ import functools
|
||||||
import os.path
|
import os.path
|
||||||
import re
|
import re
|
||||||
import sys
|
import sys
|
||||||
|
import uuid
|
||||||
import weakref
|
import weakref
|
||||||
|
|
||||||
import ldap.controls
|
import ldap.controls
|
||||||
|
@ -95,7 +96,16 @@ def utf8_decode(value):
|
||||||
:raises UnicodeDecodeError: for invalid UTF-8 encoding
|
:raises UnicodeDecodeError: for invalid UTF-8 encoding
|
||||||
"""
|
"""
|
||||||
if isinstance(value, six.binary_type):
|
if isinstance(value, six.binary_type):
|
||||||
return _utf8_decoder(value)[0]
|
try:
|
||||||
|
return _utf8_decoder(value)[0]
|
||||||
|
except UnicodeDecodeError:
|
||||||
|
# NOTE(lbragstad): We could be dealing with a UUID in byte form,
|
||||||
|
# which some LDAP implementations use.
|
||||||
|
uuid_byte_string_length = 16
|
||||||
|
if len(value) == uuid_byte_string_length:
|
||||||
|
return six.text_type(uuid.UUID(bytes_le=value))
|
||||||
|
else:
|
||||||
|
raise
|
||||||
return six.text_type(value)
|
return six.text_type(value)
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -520,6 +520,20 @@ class CommonLdapTestCase(unit.BaseTestCase):
|
||||||
# The user name should still be a string value.
|
# The user name should still be a string value.
|
||||||
self.assertEqual(user_name, py_result[0][1]['user_name'][0])
|
self.assertEqual(user_name, py_result[0][1]['user_name'][0])
|
||||||
|
|
||||||
|
def test_user_id_attribute_is_uuid_in_byte_form(self):
|
||||||
|
results = [(
|
||||||
|
'cn=alice,dc=example,dc=com',
|
||||||
|
{
|
||||||
|
'cn': [b'cn=alice'],
|
||||||
|
'objectGUID': [b'\xdd\xd8Rt\xee]bA\x8e(\xe39\x0b\xe1\xf8\xe8'],
|
||||||
|
'email': [uuid.uuid4().hex],
|
||||||
|
'sn': [uuid.uuid4().hex]
|
||||||
|
}
|
||||||
|
)]
|
||||||
|
py_result = common_ldap.convert_ldap_result(results)
|
||||||
|
exp_object_guid = '7452d8dd-5dee-4162-8e28-e3390be1f8e8'
|
||||||
|
self.assertEqual(exp_object_guid, py_result[0][1]['objectGUID'][0])
|
||||||
|
|
||||||
|
|
||||||
class LDAPFilterQueryCompositionTest(unit.BaseTestCase):
|
class LDAPFilterQueryCompositionTest(unit.BaseTestCase):
|
||||||
"""These test cases test LDAP filter generation."""
|
"""These test cases test LDAP filter generation."""
|
||||||
|
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
fixes:
|
||||||
|
- |
|
||||||
|
[`bug 1889936 <https://bugs.launchpad.net/keystone/+bug/1889936>`_]
|
||||||
|
Properly decode octet strings, or byte arrays, returned from LDAP.
|
Loading…
Reference in New Issue