search

adobe-apiplatform / user-sync.py

Application for synchronizing Adobe customer directories via the User Management API
https://adobe-apiplatform.github.io/user-sync.py/en/user-manual/
MIT License
87 stars 67 forks source link

2.6.3 doesn't work with ldap secured password on Windows #708

Closed madumro closed 3 years ago

madumro commented 3 years ago

Description When storing ldap password in Windows Credential Manager, using 'secure_password_key: ldap_password', UST 2.6.3 throws this error: CRITICAL main - ldap configuration: No value in secure storage for user "CBART\Administrator", key "ldap_password"

Steps to reproduce

Expected behavior UST 2.6.3 should find the password in Windows Credential Manager. When running 2.6.2 executable with the same configuration files, the password is retrieved and the connection created.

Screenshots If applicable, add screenshots to help explain your problem.

Environment

adorton-adobe commented 3 years ago

Make sure the system account used to create the credential is the same account used to run the sync tool.

madumro commented 3 years ago

It is the same user account. This works for all the other UST versions on my server, but not for 2.6.3.

adorton-adobe commented 3 years ago

If you don't need anything from 2.6.3 specifically, I recommend sticking to 2.6.2 until we make a new release in the next 1-2 weeks. 2.6.3 had some build issues so I just deleted it from the releases page. I'll keep this open to investigate further.

jones948 commented 3 years ago

Noticed the same problem, but I had upgraded to 2.6.4.

periops commented 3 years ago

I see the same message with 2.6.4.

Previously, I would get this and it worked fine with 2.6.2:

2021-09-03 07:30:03 4188 INFO main - ========== Start Run (User Sync version: 2.6.2) ====================== 2021-09-03 07:30:03 4188 INFO main - User Sync 2.6.2 - Python 3.6.8 - Windows 6.3.9600 2021-09-03 07:30:03 4188 INFO main - ------- Command line arguments ------- 2021-09-03 07:30:03 4188 INFO main - --users mapped --process-groups --adobe-only-user-action remove --update-user-info 2021-09-03 07:30:03 4188 INFO main - ------------------------------------- 2021-09-03 07:30:04 4188 INFO keyring - Using keyring 'Windows WinVaultKeyring' to retrieve: ldap_password 2021-09-03 07:30:04 4188 INFO keyring - Using keyring 'Windows WinVaultKeyring' to retrieve: umapi_api_key 2021-09-03 07:30:04 4188 INFO keyring - Using keyring 'Windows WinVaultKeyring' to retrieve: umapi_client_secret 2021-09-03 07:30:04 4188 INFO keyring - Using keyring 'Windows WinVaultKeyring' to retrieve: umapi_private_key_passphrase 2021-09-03 07:30:05 4188 INFO processor - ---------- Start Load from Directory ---------------------------------

With 2.6.4 and no changes other than dropping in the new executable, I get this:

2021-09-03 09:03:54 2060 INFO main - ========== Start Run (User Sync version: 2.6.4) ====================== 2021-09-03 09:03:54 2060 INFO main - User Sync 2.6.4 - Python 3.6.8 - Windows 6.3.9600 2021-09-03 09:03:54 2060 INFO main - ------- Command line arguments ------- 2021-09-03 09:03:54 2060 INFO main - --users mapped --process-groups --adobe-only-user-action remove --update-user-info 2021-09-03 09:03:54 2060 INFO main - ------------------------------------- 2021-09-03 09:03:54 2060 INFO keyring - Using keyring 'cryptfile CryptFileKeyring' to retrieve: ldap_password 2021-09-03 09:03:54 2060 CRITICAL main - ldap configuration: No value in secure storage for user "user@domain.com", key "ldap_password" 2021-09-03 09:03:54 2060 INFO main - ========== End Run (User Sync version: 2.6.4) (Total time: 0:00:00) ==

cbalanoiu commented 3 years ago

This replicates in 2.6.4 for newly created Credential Store entries. Older entries work but this is not really a solution. @adorton-adobe I have a couple of customers who are asking for this feature. Is there an ETA on a fix?

vossen-adobe commented 3 years ago

We haven't changed any of the associated code between these versions, so it could be an upstream dependency issue. I will look into it

see: https://github.com/adobe-apiplatform/user-sync.py/compare/v2.6.4...v2.6.2

vossen-adobe commented 3 years ago

I have a fix for this but will need to test it on another platform before I make a PR I don't know what changed or where outside our code, but the OS reports the backend differently through keyring now. I will adapt the code to resolve

vossen-adobe commented 3 years ago

https://github.com/vossen-adobe/user-sync-fork/commit/7ecf4898a43d4c63b003e43e8eb341f2030fce19