idm icon indicating copy to clipboard operation
idm copied to clipboard

Bind from LDIF data source panics when there is no userPassword and the panic is not logged

Open longsleep opened this issue 2 years ago • 1 comments

The panic recover in https://github.com/libregraph/idm/blob/1bc74738d4ba3099dbd059de1c88c6a0cd94e88c/pkg/ldapserver/bind.go#L17 does not get logged.

For example when for whatever reason a user record has no userPassword field, the nesting code in server/handler/ldif/entry.go goes like

ldappassword.Validate(bindSimplePw, entry.UserPassword.Values[0])

and that panics.

Panics should be logged so it is clear why Bind commands return an Operational Error and this particular case should not panic in the first place.

longsleep avatar Sep 19 '23 15:09 longsleep

@rhafer i might fix this one soon-ish and then cut a new release - it has been a while.

longsleep avatar Sep 19 '23 15:09 longsleep