Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HPCC-31574 Add option in Dali LDAP support to ignore default file user #18503

Merged
merged 1 commit into from
Apr 18, 2024
Merged

HPCC-31574 Add option in Dali LDAP support to ignore default file user #18503

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 17 additions & 8 deletions dali/server/daldap.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ class CDaliLdapConnection: implements IDaliLdapConnection, public CInterface
Owned<ISecManager> ldapsecurity;
StringAttr filesdefaultuser;
StringAttr filesdefaultpassword;
bool disableFilesDefaultUser;
unsigned ldapflags;
IDigitalSignatureManager * pDSM = nullptr;

Expand Down Expand Up @@ -82,6 +83,7 @@ class CDaliLdapConnection: implements IDaliLdapConnection, public CInterface
{
filesdefaultuser.set(ldapprops->queryProp("@filesDefaultUser"));
filesdefaultpassword.set(ldapprops->queryProp("@filesDefaultPassword"));
disableFilesDefaultUser = ldapprops->getPropBool("@disableDefaultUser", false);

try {
ignoreSigPipe(); // LDAP can generate
Expand Down Expand Up @@ -115,29 +117,36 @@ class CDaliLdapConnection: implements IDaliLdapConnection, public CInterface
return SecAccess_Full;


Owned<ISecUser> user;
StringBuffer username;
StringBuffer password;
if (udesc)
{
udesc->getUserName(username);
udesc->getPassword(password);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor: password is not used by the rest of the function.

user.setown(ldapsecurity->createUser(username));
user->setAuthenticateStatus(AS_AUTHENTICATED); // treat caller passing user as trusted
}
else
{
DBGLOG("NULL UserDescriptor in daldap.cpp getPermissions('%s')", key);
}
logNullUser(nullptr);

// If no user was provided, try to use the default user
if (disableFilesDefaultUser || filesdefaultuser.isEmpty())
{
OWARNLOG("Default user missing or disabled, access denied for request %s %s", key, nullText(obj));
return SecAccess_None; // no access if no default user or disabled
}

if (0 == username.length())
{
username.append(filesdefaultuser);
decrypt(password, filesdefaultpassword);
OWARNLOG("Missing credentials, injecting deprecated filesdefaultuser for request %s %s", key, nullText(obj));
logNullUser(nullptr);
OWARNLOG("Missing credentials, injecting deprecated filesdefaultuser (%s) for request %s %s", filesdefaultuser.str(), key,
nullText(obj));
user.setown(ldapsecurity->createUser(username));
user->credentials().setPassword(password); // Force authentication of default user when used
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really needed? What is it protecting against? The downside of using it is that the password needs to be included in the helm configuration - which is not secure.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default files user is not currently included in our helm charts, so both the username and password are empty.

}

Owned<ISecUser> user = ldapsecurity->createUser(username);
user->setAuthenticateStatus(AS_AUTHENTICATED);

SecAccessFlags perm = SecAccess_None;
unsigned start = msTick();
if (filescope)
Expand Down
Loading