pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #15495: Ldap authentication not working with multiple server in Postgresql 11
4+ messages / 2 participants
[nested] [flat]
Commits from this thread:
2018-11-13 257ef3cd4f 6b6c64a96d Fix handling of HBA ldapserver with multiple hostnames.
* BUG #15495: Ldap authentication not working with multiple server in Postgresql 11
@ 2018-11-09 15:47 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 1 reply; 4+ messages in thread
From: PG Bug reporting form @ 2018-11-09 15:47 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: rnavarro@nocibe.fr
The following bug has been logged on the website:
Bug reference: 15495
Logged by: Renaud Navarro
Email address: rnavarro@nocibe.fr
PostgreSQL version: 11.1
Operating system: Oracle Linux 7.5
Description:
Hi
After upgrade database from postgresql 10.5 to postgresql 11.1, LDAP
authentication no longer work with multiple ldap server specified.
The pg_hba.conf have the following line :
hostssl all all 172.20.0.0/16 ldap
ldapserver="dcinfrap01s.nocibe.net dcinfrap02s.nocibe.net"
ldapprefix="NOCIBE\" ldaptls=1 "
I have the following error in log file :
2018-11-09 16:32:45.407 CET [29629] LOG: could not initialize LDAP: Bad
parameter to an ldap routine
2018-11-09 16:32:45.408 CET [29629] FATAL: LDAP authentication failed for
user "admin_rnavarro"
If I modify the pg_hba.conf with one LDAP server, the authentication is
working.
The same entry with postgresql 10.5 work perfectly
Thanks for helping me
Kind Regards
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #15495: Ldap authentication not working with multiple server in Postgresql 11
@ 2018-11-09 19:28 Thomas Munro <thomas.munro@enterprisedb.com>
parent: PG Bug reporting form <noreply@postgresql.org>
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Munro @ 2018-11-09 19:28 UTC (permalink / raw)
To: rnavarro@nocibe.fr, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Sat, Nov 10, 2018 at 4:48 AM PG Bug reporting form
<noreply@postgresql.org> wrote:
> The following bug has been logged on the website:
>
> Bug reference: 15495
> Logged by: Renaud Navarro
> Email address: rnavarro@nocibe.fr
> PostgreSQL version: 11.1
> Operating system: Oracle Linux 7.5
> Description:
>
> Hi
>
> After upgrade database from postgresql 10.5 to postgresql 11.1, LDAP
> authentication no longer work with multiple ldap server specified.
> The pg_hba.conf have the following line :
> hostssl all all 172.20.0.0/16 ldap
> ldapserver="dcinfrap01s.nocibe.net dcinfrap02s.nocibe.net"
> ldapprefix="NOCIBE\" ldaptls=1 "
> I have the following error in log file :
> 2018-11-09 16:32:45.407 CET [29629] LOG: could not initialize LDAP: Bad
> parameter to an ldap routine
> 2018-11-09 16:32:45.408 CET [29629] FATAL: LDAP authentication failed for
> user "admin_rnavarro"
> If I modify the pg_hba.conf with one LDAP server, the authentication is
> working.
> The same entry with postgresql 10.5 work perfectly
Thanks for the report. I see the problem. In commit
35c0754fadca8010955f6b10cb47af00bdbe1286 we switched from ldap_init()
to ldap_initialize() because the newer interface supports LDAPS. To
do that we have to build a URI from the given protocol, server and
port. I overlooked the case where multiple servers are specified in
ldapserver. If you say ldapserver="a b c" then we generate a URI
"ldap://a b c:389", but it looks like we should instead generate a URI
list "ldap://a:389 ldap://b:389 ldap://c:389".
Unfortunately there doesn't seem to be an obvious workaround until we
can ship a fix in the next point release, because ldapurl doesn't
support the space-separated list format either.
--
Thomas Munro
http://www.enterprisedb.com
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #15495: Ldap authentication not working with multiple server in Postgresql 11
@ 2018-11-09 22:45 Thomas Munro <thomas.munro@enterprisedb.com>
parent: Thomas Munro <thomas.munro@enterprisedb.com>
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Munro @ 2018-11-09 22:45 UTC (permalink / raw)
To: rnavarro@nocibe.fr, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Sat, Nov 10, 2018 at 8:28 AM Thomas Munro
<thomas.munro@enterprisedb.com> wrote:
> On Sat, Nov 10, 2018 at 4:48 AM PG Bug reporting form
> <noreply@postgresql.org> wrote:
> > The following bug has been logged on the website:
> >
> > Bug reference: 15495
> > Logged by: Renaud Navarro
> > Email address: rnavarro@nocibe.fr
> > PostgreSQL version: 11.1
> > Operating system: Oracle Linux 7.5
> > Description:
> >
> > Hi
> >
> > After upgrade database from postgresql 10.5 to postgresql 11.1, LDAP
> > authentication no longer work with multiple ldap server specified.
> > The pg_hba.conf have the following line :
> > hostssl all all 172.20.0.0/16 ldap
> > ldapserver="dcinfrap01s.nocibe.net dcinfrap02s.nocibe.net"
> > ldapprefix="NOCIBE\" ldaptls=1 "
> > I have the following error in log file :
> > 2018-11-09 16:32:45.407 CET [29629] LOG: could not initialize LDAP: Bad
> > parameter to an ldap routine
> > 2018-11-09 16:32:45.408 CET [29629] FATAL: LDAP authentication failed for
> > user "admin_rnavarro"
> > If I modify the pg_hba.conf with one LDAP server, the authentication is
> > working.
> > The same entry with postgresql 10.5 work perfectly
>
> Thanks for the report. I see the problem. In commit
> 35c0754fadca8010955f6b10cb47af00bdbe1286 we switched from ldap_init()
> to ldap_initialize() because the newer interface supports LDAPS. To
> do that we have to build a URI from the given protocol, server and
> port. I overlooked the case where multiple servers are specified in
> ldapserver. If you say ldapserver="a b c" then we generate a URI
> "ldap://a b c:389", but it looks like we should instead generate a URI
> list "ldap://a:389 ldap://b:389 ldap://c:389".
Here's a draft patch.
--
Thomas Munro
http://www.enterprisedb.com
Attachments:
0001-Fix-handling-of-ldapserver-with-multiple-hostnames.patch (application/octet-stream, 3.2K) download
From 6df7d08d289c6299abbfbb7a54557b0bfe2f9617 Mon Sep 17 00:00:00 2001
From: Thomas Munro <thomas.munro@enterprisedb.com>
Date: Sat, 10 Nov 2018 11:34:55 +1300
Subject: [PATCH] Fix handling of ldapserver with multiple hostnames.
Commit 35c0754f failed to handle the case where a space-separated list
of a hostnames is provided in ldapserver, when building a URI for
ldap_initialize(). Such lists need to be expanded to a space-separated
list of URIs. Repair. Back-patch to 11, to fix bug report #15495.
Reported-by: Renaud Navarro
Discussion: https://postgr.es/m/15495-2c39fc196c95cd72%40postgresql.org
---
src/backend/libpq/auth.c | 42 ++++++++++++++++++++++++++++++++-----
src/test/ldap/t/001_auth.pl | 18 +++++++++++++++-
2 files changed, 54 insertions(+), 6 deletions(-)
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 8517565535..28594d7149 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -2352,12 +2352,44 @@ InitializeLDAPConnection(Port *port, LDAP **ldap)
#else
#ifdef HAVE_LDAP_INITIALIZE
{
- char *uri;
+ const char *hostnames = port->hba->ldapserver;
+ char *uris = NULL;
- uri = psprintf("%s://%s:%d", scheme, port->hba->ldapserver,
- port->hba->ldapport);
- r = ldap_initialize(ldap, uri);
- pfree(uri);
+ /*
+ * We have a space-separated list of hostnames. We convert it
+ * to a space-separated list of URIs.
+ */
+ do
+ {
+ const char *hostname;
+ size_t hostname_size;
+ char *new_uris;
+
+ /* Find the leading hostname. */
+ hostname_size = strcspn(hostnames, " ");
+ hostname = pnstrdup(hostnames, hostname_size);
+
+ /* Append a URI for this hostname. */
+ new_uris = psprintf("%s%s%s://%s:%d",
+ uris ? uris : "",
+ uris ? " " : "",
+ scheme,
+ hostname,
+ port->hba->ldapport);
+
+ pfree(hostname);
+ if (uris)
+ pfree(uris);
+ uris = new_uris;
+
+ /* Step over this hostname and any spaces. */
+ hostnames += hostname_size;
+ while (*hostnames == ' ')
+ ++hostnames;
+ } while (*hostnames);
+
+ r = ldap_initialize(ldap, uris);
+ pfree(uris);
if (r != LDAP_SUCCESS)
{
ereport(LOG,
diff --git a/src/test/ldap/t/001_auth.pl b/src/test/ldap/t/001_auth.pl
index 67b406c981..431ad6442c 100644
--- a/src/test/ldap/t/001_auth.pl
+++ b/src/test/ldap/t/001_auth.pl
@@ -6,7 +6,7 @@ use Test::More;
if ($ENV{with_ldap} eq 'yes')
{
- plan tests => 19;
+ plan tests => 22;
}
else
{
@@ -179,6 +179,22 @@ test_access($node, 'test1', 2,
$ENV{"PGPASSWORD"} = 'secret1';
test_access($node, 'test1', 0, 'search+bind authentication succeeds');
+note "multiple servers";
+
+unlink($node->data_dir . '/pg_hba.conf');
+$node->append_conf('pg_hba.conf',
+ qq{local all all ldap ldapserver="$ldap_server $ldap_server" ldapport=$ldap_port ldapbasedn="$ldap_basedn"}
+);
+$node->restart;
+
+$ENV{"PGPASSWORD"} = 'wrong';
+test_access($node, 'test0', 2,
+ 'search+bind authentication fails if user not found in LDAP');
+test_access($node, 'test1', 2,
+ 'search+bind authentication fails with wrong password');
+$ENV{"PGPASSWORD"} = 'secret1';
+test_access($node, 'test1', 0, 'search+bind authentication succeeds');
+
note "LDAP URLs";
unlink($node->data_dir . '/pg_hba.conf');
--
2.19.1
* Re: BUG #15495: Ldap authentication not working with multiple server in Postgresql 11
@ 2018-11-13 04:54 Thomas Munro <thomas.munro@enterprisedb.com>
parent: Thomas Munro <thomas.munro@enterprisedb.com>
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Munro @ 2018-11-13 04:54 UTC (permalink / raw)
To: rnavarro@nocibe.fr, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Sat, Nov 10, 2018 at 11:45 AM Thomas Munro
<thomas.munro@enterprisedb.com> wrote:
> On Sat, Nov 10, 2018 at 8:28 AM Thomas Munro
> <thomas.munro@enterprisedb.com> wrote:
> > On Sat, Nov 10, 2018 at 4:48 AM PG Bug reporting form
> > <noreply@postgresql.org> wrote:
> > > After upgrade database from postgresql 10.5 to postgresql 11.1, LDAP
> > > authentication no longer work with multiple ldap server specified.
> > Thanks for the report. I see the problem. In commit
> > 35c0754fadca8010955f6b10cb47af00bdbe1286 we switched from ldap_init()
> > to ldap_initialize() because the newer interface supports LDAPS. To
> > do that we have to build a URI from the given protocol, server and
> > port. I overlooked the case where multiple servers are specified in
> > ldapserver. If you say ldapserver="a b c" then we generate a URI
> > "ldap://a b c:389", but it looks like we should instead generate a URI
> > list "ldap://a:389 ldap://b:389 ldap://c:389".
>
> Here's a draft patch.
I did some testing with various multi-server configurations, added a
simple two hostname case to the regression tests and pushed this to
master and 11. Thanks again for the report.
--
Thomas Munro
http://www.enterprisedb.com
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2018-11-13 04:54 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-11-09 15:47 BUG #15495: Ldap authentication not working with multiple server in Postgresql 11 PG Bug reporting form <noreply@postgresql.org>
2018-11-09 19:28 ` Thomas Munro <thomas.munro@enterprisedb.com>
2018-11-09 22:45 ` Thomas Munro <thomas.munro@enterprisedb.com>
2018-11-13 04:54 ` Thomas Munro <thomas.munro@enterprisedb.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox