search

libregraph / idm

LibreGraph Identity Management
Apache License 2.0
27 stars 6 forks source link

Bind from LDIF data source panics when there is no userPassword and the panic is not logged #114

Open longsleep opened 1 year ago

longsleep commented 1 year ago

The panic recover in https://github.com/libregraph/idm/blob/1bc74738d4ba3099dbd059de1c88c6a0cd94e88c/pkg/ldapserver/bind.go#L17 does not get logged.

For example when for whatever reason a user record has no userPassword field, the nesting code in server/handler/ldif/entry.go goes like

ldappassword.Validate(bindSimplePw, entry.UserPassword.Values[0])

and that panics.

Panics should be logged so it is clear why Bind commands return an Operational Error and this particular case should not panic in the first place.

longsleep commented 1 year ago

@rhafer i might fix this one soon-ish and then cut a new release - it has been a while.