Skip to content

Conversation

@Godmartinz
Copy link
Member

This adds error handling around LDAP login. if it times out, it does so with an amorphous response:

image

@snipe snipe changed the title adds an error message bag for connection issues with LDAP Added an error message bag for connection issues with LDAP Oct 1, 2025
@Godmartinz
Copy link
Member Author

@uberbrady I made some changes around the self::bindAdminToLdap($connection), You left a warning about it. but I think with the throws, it should be handled now. But I really would like your blessing or input on this before this moves forward.
The tests were failing because the if statement on Model/Ldap.php:173 was returns on failure and nothing on success, I am just calling self::bindAdminToLdap($connection) instead now. Let me know iwhat you think. Please and thank you 🙂

@Godmartinz
Copy link
Member Author

@uberbrady gentle poke, do you have any thoughts or issues with this?

@uberbrady
Copy link
Member

I think I would be okay with this if it, say, showed an error (only to a superuser) about how it needed to fail through LDAP to do local login, I think something like that would be just fine - and useful. But showing ldap errors or codes to unauthenticated users could disclose to an attacker that LDAP was being employed - and might even disclose the IP address in an error message - something like "Could not connect to 1.2.3.4 port 636" - that could be very dangerous.

Also, the LDAP system has been pretty heavily re-worked recently, so this PR is pretty heavily conflicted. If you want to try and get it back into a mergable state, I will definitely take another look at it, but I'm still generally pretty nervous about this approach for security reasons.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants