Is bottin case insensitive? Is it required by LDAP? #7

New issue

Open

opened 2021-08-18 06:41:19 +00:00 by quentin · 2 comments

quentin commented

2021-08-18 06:41:19 +00:00

Owner

My questions come from the following remark:

j'ai vu un bug sur la page de connexion de riot.deuxfleurs: si je rentre mon identifiant avec des majuscules, j'ai un message du type "votre session a expirée", et la page freeze. Si tu pense que c'est intéressant à faire remonter et que tu connais le canal approprié, je veux vien que tu m'indique le dit canal ;-)

I can reproduce this behavior:

This behavior looks like bottin authorized the connection through the uppercase login but then Matrix crashed because the account does not exist. I would say bottin is case insensitive and matrix case sensitive. Or the opposite.

We should at least investigate.

My questions come from the following remark: > j'ai vu un bug sur la page de connexion de riot.deuxfleurs: si je rentre mon identifiant avec des majuscules, j'ai un message du type "votre session a expirée", et la page freeze. Si tu pense que c'est intéressant à faire remonter et que tu connais le canal approprié, je veux vien que tu m'indique le dit canal ;-) I can reproduce this behavior: ![Error message](https://git.deuxfleurs.fr/attachments/3d8dc4ef-a329-4ce0-bd97-c7a4f58d51c2) This behavior looks like bottin authorized the connection through the uppercase login but then Matrix crashed because the account does not exist. I would say bottin is case insensitive and matrix case sensitive. Or the opposite. We should at least investigate.

Capture d’écran de 2021-08-18 08-43-21.png

253 KiB

lx commented

2021-08-18 11:04:24 +00:00

Owner

Bottin is mostly case insensitive, but maybe at the wrong places. I think the question is whether a full DN such as cn=quentin,ou=users,dc=deuxfleurs,dc=fr should be matched case-sensitively or not. Since matching is case-insensitive almost everywhere (attribute names, searching in values) it doesn't seem very logical that we make this specific aspect case-sensitive, but if that's in the LDAP spec maybe we should. In all cases I think we should target compliance with the official LDAP specification here.

Bottin is mostly case insensitive, but maybe at the wrong places. I think the question is whether a full DN such as `cn=quentin,ou=users,dc=deuxfleurs,dc=fr` should be matched case-sensitively or not. Since matching is case-insensitive almost everywhere (attribute names, searching in values) it doesn't seem very logical that we make this specific aspect case-sensitive, but if that's in the LDAP spec maybe we should. In all cases I think we should target compliance with the official LDAP specification here.

quentin added the

bug

label 2021-09-17 15:23:03 +00:00

quentin commented

2021-09-17 15:26:05 +00:00

Author

Owner

LDAP seems to be mostly case INsensitive.
https://ldapwiki.com/wiki/Case-sensitive

I keep this issue open as it might be interesting to still act.
Maybe the next step should be to open an issue on synapse ldap module.

LDAP seems to be mostly case INsensitive. https://ldapwiki.com/wiki/Case-sensitive I keep this issue open as it might be interesting to still act. Maybe the next step should be to open an issue on synapse ldap module.