search

oracle / opengrok

OpenGrok is a fast and usable source code search and cross reference engine, written in Java
http://oracle.github.io/opengrok/
Other
4.35k stars 747 forks source link

LdapUser plugin should check the attribute values #3515

Open vladak opened 3 years ago

vladak commented 3 years ago

Another post-mortem related issue: During some 30 minutes the LDAP queries to particular server were failing for many different users like this:

31-Mar-2021 09:18:39.887 WARNING [http-nio-8080-exec-2290] opengrok.auth.plugin.LdapUserPlugin.fillSession failed to get LDAP attributes '[uid, mail]' for user User{id=XXX@foo.com, username=XXX@foo.com, cookieTimestamp=null, timeouted=false, attrs={}} with filter '(&(objectclass=person)(mail=XXX@foo.com)(uid=XXX@foo.com))' from LDAP provider {server=ldaps://ldap.foo.com, connect timeout: 2000, read timeout: 1000, username: cn=myadmin,ou=adminusers,dc=foo,dc=com, searchBase=dc=foo,dc=com}

The LDAP server pool has more than this server so it might make sense to fallback if the error count hits certain threshold (moving average ?). Or simply try to reconnect to the existing server.

vladak commented 3 years ago

Actually, the problem here was in the LDAP filter: the uid=XXX@foo.com part should have login name, not e-mail address. The LdapUser plugin should check for that.