Usernames containing + cannot be autoprovisioned

cakiwi commented 2 years ago

Describe the bug

Steps to reproduce

Steps to reproduce the behavior:

Run a deployment using keycloak.
Set realm login to use email as username (not required, can just set the username to contain +)
Register a user using + in the local part. a+b@example.org
Sign-in to oCIS

Expected behavior

Login to oCIS should occur.

Actual behavior

Login Error. Your user session is invalid or has expired. If you like to login with a different user please proceed to exit.

{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Error creating user"}
{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Autoprovisioning user failed"}
{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Could not get user by claim"}
{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Error creating user"}
{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Autoprovisioning user failed"}
{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2022-07-01T16:59:23Z","message":"Could not get user by claim"}

Setup

owncloud/ocis:2.0.0-beta.4

https://owncloud.dev/ocis/deployment/ocis_keycloak/ Originally changed realm login to use email as username.

C0rby commented 2 years ago

Just some notes because I can't work on this for the next two weeks.

So the issue is here: https://github.com/cs3org/reva/blob/0b65112600ccfd07504c8927d96c7a1e9ac85e7b/pkg/utils/ldap/identity.go#L534

We aren't escaping the memberName correctly which results in this error when parsing the filter: LDAP Result Code 201 "Filter Compile Error": ldap: invalid characters for escape in filter: encoding/hex: invalid byte: U+002B '+' (&(objectclass=groupOfNames)(member=uid=corby\+,ou=users,o=libregraph-idm))

Our filter looks like this (&(objectclass=groupOfNames)(member=uid=corby\\5c+,ou=users,o=libregraph-idm)) but the parser expects (&(objectclass=groupOfNames)(member=uid=corby\\2B,ou=users,o=libregraph-idm))"

My temporary change to check the fix was this:

func (i *Identity) getGroupMemberFilter(memberName string) string {
      return fmt.Sprintf("(&%s(objectclass=%s)(%s=%s))",
          i.Group.Filter,
          i.Group.Objectclass,
          i.Group.Schema.Member,
~         strings.ReplaceAll(memberName, "+", "2B"),
      )
  }

With that change logging into oCIS was possible.