LDAP - Escaping commas in CN

[JessopDev]

• Gitea version (or commit ref): 1.10.0
• Git version: 2.24.0
• Operating system: Windows Server 2016
• Database (use [x]):
  • [ ] PostgreSQL
  • [ ] MySQL
  • [x] MSSQL
  • [ ] SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • [ ] Yes (provide example URL)
  • [ ] No
  • [x] Not relevant
• Log gist: ...es/auth/ldap/ldap.go:101:findUserDN() [D] Failed search using filter[(&(objectCategory=Person)(memberof=CN=Gitea Group,OU=This\, Name\, Contains\, Commas,OU=Users,DC=domain,DC=com)(sAMAccountName=username)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))]: LDAP Result Code 201 "Filter Compile Error": ldap: invalid characters for escape in filter

Description

I am trying to set up Gitea to work with our Active Directory.

Unfortunately the Groups I have been given to work with are contained within an OU which has commas in it's name. This is the name of a department and cannot be changed. The commas need to be escaped as commas are used to seperate the OUs within the string. The 'normal' way to do this in LDAP would be to escape using a backslash.

Unfortunately this is causing the error as given above 'ldap: invalid characters for escape in filter'.

This issue also seems to have been logged here: https://github.com/gogs/gogs/issues/4760

Does anyone know of a solution to this?

Thanks.

[guillep2k]

Have you tried escaping the comma yourself? \2c instead of ,. Since a valid query contains commas, Gitea wouldn't know which commas to escape.

[JessopDev]

Thanks guillep2k,

I had actually tried escaping the commas using \2c and \, instead of ,. It turns out that what actually worked was using \5c instead of \ as the escape char - therefore my filter became: (memberof=CN=Gitea Group,OU=This\5c, Name\5c, Contains\5c, Commas,OU=Users,DC=domain,DC=com)

This is somewhat unintuative - as \ is the standard escape character maybe it would be possible for Gitea to replace \ with \5c ?

If not, maybe this could be added to the documentation? (happy to contribute if that's helpful)

[guillep2k]

If not, maybe this could be added to the documentation? (happy to contribute if that's helpful)

Please do! 😄

I think it's not a good idea to add any automatic replacement now because that would break some existing installations.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.