Details
Assignee
UnassignedUnassignedReporter
Coby GeralnikCoby GeralnikNeeds Review
YesNeeds QA
YesAffects versions
Priority
Medium
Details
Details
Assignee
Unassigned
UnassignedReporter
Coby Geralnik
Coby GeralnikNeeds Review
Yes
Needs QA
Yes
Affects versions
Priority
Smart Checklist
Smart Checklist
Smart Checklist
Created November 28, 2022 at 7:03 PM
Updated March 2, 2025 at 4:26 PM
When using the authentication_ldap_simple plugin, the ldap query is not properly escaped, when the users DN has a double quote `"` in their name.
During authentication, the function "search_ldap_uid" returns the users DN.
After authentication, in order to proxy the user to a domain group, the function "[search_groups|https://github.com/percona/percona-server/blob/8.0/plugin/auth_ldap/src/connection.cc#L300]" is called, which looks for the group, and uses the users DN to filter the users groups (Replacing "{UD}" in the variable "authentication_ldap_simple_group_search_filter" with the users DN).
If the users DN contains a double quote, then the library will attempt to pass the string returned from `search_ldap_uid` to the ldap function `ldap_search_ext_s`, which will return an error: `Bad search filter`
The reason for this, is that the DN returned by `search_ldap_uid` is not properly escaped.
The ldap library expects double quotes to be double escaped (usern
"ame instead of usern\"ame), while it only returns singly escaped DN.
This means:
```
ldap_search_ext_s(filter_to_find_user_dn) == "CN=tea\\\"m,CN=Users,DC=example,DC=local"
```
where the query must be:
```
This will work
ldap_search_ext_s("CN=tea\\\\\"m,CN=Users,DC=example,DC=local")
This will not work
ldap_search_ext_s("CN=tea\\\"m,CN=Users,DC=example,DC=local")
```
As a fix, I am opening a PR on github, which will replace the string `\"` with `
"` in the user DN