Project

General

Profile

Actions
Copy link

Bug #40406

closed

USERNAME ldap token not replaced in rgw client

Added by Ween Jiann Lee almost 5 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Target version:
Ceph - v13.2.6
% Done:

0%

Source:
Tags:
ldap rgw s3
Backport:
nautilus, mimic
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
27964
Crash signature (v1):
Crash signature (v2):

Description

Hi,

Referencing from http://docs.ceph.com/docs/mimic/radosgw/ldap-auth/#specifying-a-complete-filter

By specifying the following is specified in ceph.conf:
rgw_ldap_searchfilter = "(&(objectClass=groupOfUniqueNames)(cn=ceph)(uniqueMember=uid=USERNAME))"

Should result in auth search filter for "user" to be:
(&(objectClass=groupOfUniqueNames)(cn=ceph)(uniqueMember=uid=user))

However the result is:
(&((&(objectClass=groupOfUniqueNames)(cn=ceph)(uniqueMember=uid=USERNAME)))(uid=user))

Logs:
2019-06-18 14:51:31.238 7fae78f76700 12 auth search filter: (&((&(objectClass=groupOfUniqueNames)(cn=ceph)(uniqueMember=uid=USERNAME)))(uid=user))
2019-06-18 14:51:31.238 7fae78f76700 5 auth ldap_search_s error uid=crawler ldap err=-7
2019-06-18 14:51:31.243 7fae78f76700 5 auth ldap_search_s error uid=crawler ldap err=-7
2019-06-18 14:51:31.243 7fae78f76700 20 rgw::auth::s3::LDAPEngine denied with reason=-13

Related issues 2 (0 open — 2 closed)

Copied to rgw - Backport #40672: nautilus: USERNAME ldap token not replaced in rgw clientResolvedPrashant DActions
Copied to rgw - Backport #40673: mimic: USERNAME ldap token not replaced in rgw clientResolvedNathan CutlerActions
Actions
Copy link

Also available in: Atom PDF