Comma in user dn cause authentication failure.

[ajay-fcb]

• If there's a comma in the user DN, the ldap authentication call fails

• user DN is of the form ' cn=ray\,rex,dc=example,dc=com'

• group attribute is the form member : cn=ray\,rex,dc=example,dc=com

• The program used to test is :

var LdapAuth = require("ldapauth-fork")
const fs = require('fs');

var ldap = new LdapAuth({
  url: 'ldap://localhost:10389',
  searchBase: 'dc=example,dc=com',
  searchFilter: '(uid={{username}})',
  groupSearchBase: 'dc=example,dc=com',
  groupSearchFilter:'(&(objectclass=*)(member={{dn}}))',
  groupSearchScope: 'sub',
  groupSearchAttributes: 'cn',
  reconnect: false
});

ldap.authenticate('ray', 'password', function(err, user) {
    if (err) {
      console.log("Authentication error: " + err);
      throw err;
      return process.exit(2);
    }
    else
    { 
      console.log("Successful Authentication");
	  roles = user._groups.map(element => {
          return "["+element['dn']+"]"
        })
      console.log('Successfully authenticated ldap groups dn: ' + roles)		 
      return process.exit(0);
    }
  });

• Error reported

PS C:\AJAY_WORK\APAR\ACELDAP\ldappgm> node .\ldaptest2.js Authentication error: LoopDetectError: LOOP_DETECT: failed for MessageType : SEARCH_REQUEST Message ID : 2 SearchRequest baseDn : 'dc=example, dc=com' filter : '(&(objectClass=*)(member=cn=ray,rex,dc=example,dc=com))' scope : whole subtree typesOnly : false Size Limit : no limit Time Limit : 10 Deref Aliases : never Deref Aliases attributes : 'cn' org.apache.directory.api.ldap.model.message.SearchRequestImpl@35551da: java.lang.IllegalArgumentException: ERR_13247_INVALID_VALUE_CANT_NORMALIZE Invalid upValue, it cant be normalized

C:\AJAY_WORK\APAR\ACELDAP\ldappgm\ldaptest2.js:18 throw err; ^ LDAPError [LoopDetectError]: LOOP_DETECT: failed for MessageType : SEARCH_REQUEST Message ID : 2 SearchRequest baseDn : 'dc=example, dc=com' filter : '(&(objectClass=)(member=cn=ray,rex,dc=example,dc=com))' scope : whole subtree typesOnly : false Size Limit : no limit Time Limit : 10 Deref Aliases : never Deref Aliases attributes : 'cn' org.apache.directory.api.ldap.model.message.SearchRequestImpl@35551da: java.lang.IllegalArgumentException: ERR_13247_INVALID_VALUE_CANT_NORMALIZE Invalid upValue, it cant be normalized at messageCallback (C:\AJAY_WORK\APAR\ACELDAP\ldappgm\node_modules\ldapauth-fork\node_modules\ldapjs\lib\client\client.js:1419:45) at Parser.onMessage (C:\AJAY_WORK\APAR\ACELDAP\ldappgm\node_modules\ldapauth-fork\node_modules\ldapjs\lib\client\client.js:1089:14) at Parser.emit (events.js:310:20) at Parser.write (C:\AJAY_WORK\APAR\ACELDAP\ldappgm\node_modules\ldapauth-fork\node_modules\ldapjs\lib\messages\parser.js:111:8) at Socket.onData (C:\AJAY_WORK\APAR\ACELDAP\ldappgm\node_modules\ldapauth-fork\node_modules\ldapjs\lib\client\client.js:1076:22) at Socket.emit (events.js:310:20) at addChunk (_stream_readable.js:286:12) at readableAddChunk (_stream_readable.js:268:9) at Socket.Readable.push (_stream_readable.js:209:10) at TCP.onStreamRead (internal/stream_base_commons.js:186:23) { lde_message: 'LOOP_DETECT: failed for MessageType : SEARCH_REQUEST\n' + 'Message ID : 2\n' + ' SearchRequest\n' + " baseDn : 'dc=example, dc=com'\n" + " filter : '(&(objectClass=)(member=cn=ray,rex,dc=example,dc=com))'\n" + ' scope : whole subtree\n' + ' typesOnly : false\n' + ' Size Limit : no limit\n' + ' Time Limit : 10\n' + ' Deref Aliases : never Deref Aliases\n' + " attributes : 'cn'\n" + 'org.apache.directory.api.ldap.model.message.SearchRequestImpl@35551da: java.lang.IllegalArgumentException: ERR_13247_INVALID_VALUE_CANT_NORMALIZE Invalid upValue, it cant be normalized', lde_dn: null }

[Grahahax]

I've worked around this issue myself by providing my own groupSearchFilter function in options, but we need to upgrade to ldapjs v2 to resolve this.

[vesse]

Oh v2 has been released, it was so long in next that I forgot the whole thing. I'll try to remember to bump the deps tomorrow

[pcworld]

The current escaping is insufficient. In certain scenarios, this may even be a security issue. See https://ldapwiki.com/wiki/DN%20Escape%20Values and https://tools.ietf.org/search/rfc4515 for some characters that need escaping.