Authenticating via LDAP with user that has a quote in DN will fail

Description

When using the authentication_ldap_simple plugin, the ldap query is not properly escaped, when the users DN has a double quote `"` in their name.

 

During authentication, the function "search_ldap_uid" returns the users DN.

After authentication, in order to proxy the user to a domain group, the function "[search_groups|https://github.com/percona/percona-server/blob/8.0/plugin/auth_ldap/src/connection.cc#L300]" is called, which looks for the group, and uses the users DN to filter the users groups (Replacing "{UD}" in the variable "authentication_ldap_simple_group_search_filter" with the users DN).

 

If the users DN contains a double quote, then the library will attempt to pass the string returned from `search_ldap_uid` to the ldap function `ldap_search_ext_s`, which will return an error: `Bad search filter`

 

The reason for this, is that the DN returned by `search_ldap_uid` is not properly escaped.

The ldap library expects double quotes to be double escaped (usern
"ame instead of usern\"ame), while it only returns singly escaped DN.

This means:

```

ldap_search_ext_s(filter_to_find_user_dn) == "CN=tea\\\"m,CN=Users,DC=example,DC=local"

```

where the query must be:

```

  1. This will work

ldap_search_ext_s("CN=tea\\\\\"m,CN=Users,DC=example,DC=local")

  1. This will not work

ldap_search_ext_s("CN=tea\\\"m,CN=Users,DC=example,DC=local")

```

 

As a fix, I am opening a PR on github, which will replace the string `\"` with `
"` in the user DN

Environment

None

Activity

Coby Geralnik March 2, 2025 at 4:26 PM

Yes, I can confirm that this worked for me in the version released after the patch. Thanks!

Vilnius Ramanauskas March 2, 2025 at 2:48 PM

PR: merged. Is the issue still actual?

Vilnius Ramanauskas March 2, 2025 at 2:48 PM

PR: merged. Is the issue still actual?

Aaditya Dubey December 2, 2022 at 2:05 PM

Hi ,

Thank you for the report and PR.
Sending the request to engineering for further review and updates.

Coby Geralnik November 28, 2022 at 7:17 PM

Sadly I can't edit the issue, and the Jira formatting didn't turn out exactly as I expected, so I recommend reading the description on Github, as it is formatted better.

Link to PR: https://github.com/percona/percona-server/pull/4942

Details

Assignee

Reporter

Needs Review

Yes

Needs QA

Yes

Affects versions

Priority

Smart Checklist

Created November 28, 2022 at 7:03 PM
Updated March 2, 2025 at 4:26 PM