Crivaledaz / Mattermost-LDAP

This module provides an external LDAP authentication in Mattermost for the Team Edition (free).
MIT License
359 stars 71 forks source link

runtime error with MM4.4.2 #20

Closed lephisto closed 6 years ago

lephisto commented 6 years ago

Hello,

I'm trying to get this working with Mattermost 4.4.2, but I fail.

OpenLDAP Server running fine, serving all kinds of Services. Applied patch to support LDAP V3. No PHP Errors are thrown, so I assume that oauth<->ldap connection is fine.

MM and Fake Oauth run on a Ubuntu 16.04 Workstation (for testing), Apache and PHP7.

When trying to Authenticate against the Fake Gitlab, MM throws the following:

`[2017/12/06 11:05:18 CET] [EROR] Please check the std error output for the stack trace [2017/12/06 11:05:18 CET] [EROR] [runtime error: invalid memory address or nil pointer dereference] goroutine 2236 [running]: runtime/debug.Stack(0x0, 0x0, 0x1caaf60) /usr/local/go/src/runtime/debug/stack.go:24 +0xa7 runtime/debug.PrintStack() /usr/local/go/src/runtime/debug/stack.go:16 +0x22 github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers.recoveryHandler.log(0x1cab060, 0xc421fbba30, 0x1cab0a0, 0x1d34a08, 0x1, 0xc422879f50, 0x1, 0x1) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers/recovery.go:89 +0x70 github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers.recoveryHandler.ServeHTTP.func1(0x1cb5aa0, 0xc4213e2700, 0x1cab060, 0xc421fbba30, 0x1cab0a0, 0x1d34a08, 0x1) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers/recovery.go:74 +0xea panic(0x12b8fc0, 0x1cf7fc0) /usr/local/go/src/runtime/panic.go:491 +0x283 github.com/mattermost/mattermost-server/model/gitlab.(GitLabUser).IsValid(...) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/model/gitlab/gitlab.go:78 github.com/mattermost/mattermost-server/model/gitlab.(GitLabProvider).GetAuthDataFromJson(0x1d34a08, 0x1caa8e0, 0xc4228abb30, 0x6, 0xc420093b88) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/model/gitlab/gitlab.go:109 +0x3a github.com/mattermost/mattermost-server/app.(App).LoginByOAuth(0xc422030ea0, 0xc42134350c, 0x6, 0x7f9d29fc42d0, 0xc42288d040, 0x0, 0x0, 0x0, 0x0) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/app/oauth.go:458 +0x1e3 github.com/mattermost/mattermost-server/app.(App).CompleteOAuth(0xc422030ea0, 0xc42134350c, 0x6, 0x1cb1ee0, 0xc42288d040, 0x0, 0x0, 0xc422731140, 0x0, 0x0) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/app/oauth.go:438 +0x27d github.com/mattermost/mattermost-server/api4.completeOAuth(0xc4217c40f0, 0x1cb5aa0, 0xc4213e2700, 0xc422014d00) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/api4/oauth.go:472 +0x524 github.com/mattermost/mattermost-server/api4.handler.ServeHTTP(0xc422030ea0, 0x149e1b8, 0x0, 0x1cb5aa0, 0xc4213e2700, 0xc422014d00) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/api4/context.go:174 +0x9b2 github.com/mattermost/mattermost-server/api4.(*handler).ServeHTTP(0xc4212cf360, 0x1cb5aa0, 0xc4213e2700, 0xc422014d00)

:1 +0x63 github.com/mattermost/mattermost-server/vendor/github.com/gorilla/mux.(*Router).ServeHTTP(0xc421eafec0, 0x1cb5aa0, 0xc4213e2700, 0xc422014d00) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/vendor/github.com/gorilla/mux/mux.go:133 +0xed github.com/mattermost/mattermost-server/app.(*CorsWrapper).ServeHTTP(0xc421fbba30, 0x1cb5aa0, 0xc4213e2700, 0xc422014b00) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/app/server.go:81 +0x9f github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers.recoveryHandler.ServeHTTP(0x1cab060, 0xc421fbba30, 0x1cab0a0, 0x1d34a08, 0x1, 0x1cb5aa0, 0xc4213e2700, 0xc422014b00) /var/lib/jenkins/jobs/msr/jobs/d/jobs/enterprise-release/workspace/src/github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers/recovery.go:78 +0xb9 github.com/mattermost/mattermost-server/vendor/github.com/gorilla/handlers.(*recoveryHandler).ServeHTTP(0xc421fce420, 0x1cb5aa0, 0xc4213e2700, 0xc422014b00) :1 +0x76 net/http.serverHandler.ServeHTTP(0xc421ed0ea0, 0x1cb5aa0, 0xc4213e2700, 0xc422014b00) /usr/local/go/src/net/http/server.go:2619 +0xb4 net/http.(*conn).serve(0xc42283e000, 0x1cb6820, 0xc422812480) /usr/local/go/src/net/http/server.go:1801 +0x71d created by net/http.(*Server).Serve /usr/local/go/src/net/http/server.go:2720 +0x288 ` Webserver Requests to the fake Gitlab Authentication Server look like this: `192.168.7.37 - - [06/Dec/2017:11:05:08 +0100] "GET /oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9 HTTP/1.1" 302 395 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:08 +0100] "GET /oauth/index.php HTTP/1.1" 200 637 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:08 +0100] "GET /favicon.ico HTTP/1.1" 404 503 "http://192.168.7.37/oauth/index.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:13 +0100] "POST /oauth/connexion.php HTTP/1.1" 302 641 "http://192.168.7.37/oauth/index.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:13 +0100] "GET /oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9 HTTP/1.1" 200 1033 "http://192.168.7.37/oauth/index.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:13 +0100] "GET /oauth/style.css HTTP/1.1" 404 507 "http://192.168.7.37/oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:14 +0100] "GET /images/login.png HTTP/1.1" 404 508 "http://192.168.7.37/oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:18 +0100] "POST /oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9 HTTP/1.1" 302 551 "http://192.168.7.37/oauth/authorize.php?response_type=code&client_id=3d2f920c2887173cb8da53ce25e335075dd4e3902dbf18ee2c81e78488745e68&redirect_uri=http%3A%2F%2F192.168.7.37%3A8065%2Fsignup%2Fgitlab%2Fcomplete&state=eyJhY3Rpb24iOiJsb2dpbiIsInRva2VuIjoiOG5naHBucmU0aGRxZW81aWtvaGZvb2o0dWQ1ejFhYmZkaHBvdG14OTMzeG83N2FjbzM1NGd4a25pNXphNHR6NiJ9" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3260.2 Chrome/64.0.3260.2 Safari/537.36" 192.168.7.37 - - [06/Dec/2017:11:05:18 +0100] "POST /oauth/token.php HTTP/1.1" 200 363 "-" "Go-http-client/1.1" 192.168.7.37 - - [06/Dec/2017:11:05:18 +0100] "GET /oauth/resource.php HTTP/1.1" 200 283 "-" "Go-http-client/1.1" ` Any Idea, where to start digging?
panromir commented 6 years ago

Same problem here.

For reference, we have Mattermost behind a reverse proxy (nginx) and on the same server we have this script running (https://blabla:8080/oauth).

If the Mattermost Server does not accept the SSL certificate, it returns a regular error, if data is transmitted properly, it just returns a 500 with abovementioned details.

PHP 5.4, CentOS 7 Mattermost 4.9

Crivaledaz commented 6 years ago

Hi,

I have installed mattermost 4.9 on a new server and I have the same error.

I have not yet found the reason of this problem, but I'm pretty sure Mattermost has made some slight change on interactions with Gitlab. When I have some time, I will install Gitlab in order to study what information are exchanged.

I will let you know if I found a patch or anything about this issue. I am sorry for the inconvenience.

lephisto commented 6 years ago

This would be awesome. would love to have LDAP working right in the CE..

Crivaledaz commented 6 years ago

Hi,

I have a great news ! After a day of work, I finally found the problem and partially fix it. In fact, my first tests, with static data, are working, so the patch is on track.

As I said yesterday, the problem was Gitlab has added a lot of data to the json answer after authorization process. So Mattermost-LDAP was not consistent with Mattermost anymore.

Now, for my patch I just need to find a way to add lacking data, but there are many dates (creation, sign-in, last sign-in ...) and currently Mattermost-LDAP doesn't store them. I think I will propose a first patch before the next week. Hold on ! Mattermost-LDAP will come back soon ;)

Regards

Crivaledaz commented 6 years ago

Hello,

I have committed a new version of Mattermost-LDAP which solves the problem. Now, the output of the Oauth server is consistent with Mattermost 4.9 and should work with Mattermost 4.4.

Let me know if you still have difficulties to install Mattermost-LDAP, I will be happy to help you.

Thanks you for your feedbacks.