fix: gracefully handle missing ldap.group_search to prevent HTTP 500 - #12364
Open
andrianbalanesq wants to merge 4 commits into
Open
fix: gracefully handle missing ldap.group_search to prevent HTTP 500#12364andrianbalanesq wants to merge 4 commits into
andrianbalanesq wants to merge 4 commits into
Conversation
…nventree#12225) When LDAP is enabled but ldap.group_search is not configured, django-auth-ldap crashes at runtime with TypeError when performing group permission lookups. This results in HTTP 500 errors during normal API requests. Changes: - Make AUTH_LDAP_FIND_GROUP_PERMS configurable via ldap.find_group_perms setting (defaults to True for backward compatibility) - When group_search DN is None, disable all group-based features (find_group_perms, mirror_groups, require_group, deny_group, user_flags_by_group) gracefully with a warning instead of crashing - Set AUTH_LDAP_GROUP_SEARCH to None instead of LDAPSearch(None, ...) - Add tests for all three scenarios: missing group_search, configured group_search, explicit find_group_perms=False - Document new ldap.find_group_perms setting
✅ Deploy Preview for inventree-web-pui-preview canceled.
|
| # If group search DN is not configured, group-based features cannot | ||
| # work. Disable them gracefully with a warning instead of letting | ||
| # django-auth-ldap crash at runtime with a TypeError (see #12225). | ||
| if group_search_dn is None: |
Member
There was a problem hiding this comment.
Should you also check for empty string here? e.g.
if not group_search_dn:
...| 'AUTH_LDAP_MIRROR_GROUPS': get_boolean_setting( | ||
| 'INVENTREE_LDAP_MIRROR_GROUPS', 'ldap.mirror_groups', False | ||
| ), | ||
| ) if group_search_dn is not None else False, |
Member
There was a problem hiding this comment.
could simplify to:
) if group_search_dn else False
SchrodingersGat
added
setup
Member
|
Someone with LDAP experience will need to review this |
|
Thanks for the review! Both suggestions make sense:
Happy to wait for someone with LDAP experience to review the broader approach. |
Per review feedback from @SchrodingersGat: an empty-string ldap.group_search value should trigger the same fallback as None, otherwise django-auth-ldap receives an empty DN and crashes. Replace all 'is None' / 'is not None' checks on group_search_dn with truthy checks so '' and None are treated identically. Add test_find_group_perms_disabled_when_group_search_empty covering the empty-string case.
Author
|
Applied the empty-string fix in a28c78a. Switched all |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #12364 +/- ##
==========================================
- Coverage 86.74% 86.73% -0.01%
==========================================
Files 1445 1445
Lines 96340 96346 +6
Branches 11136 11136
==========================================
- Hits 83566 83563 -3
- Misses 12710 12719 +9
Partials 64 64
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Member
|
@AndrianBalanescu @andrianbalanesq please ensure to not waste maintainer time by posting AI chat messages to repos in the InvenTree org. Repeats might be considered code of conduct violations and lead to corrective action like a ban. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #12225
When LDAP authentication is enabled (
ldap.enabled: true) with group permission lookup active, butldap.group_searchis not configured, the server starts normally but later crashes withTypeError: search_ext() argument 1 must be str, not Noneduring normal API requests that require permission evaluation.This happens because
AUTH_LDAP_FIND_GROUP_PERMSwas hardcoded toTrue, andAUTH_LDAP_GROUP_SEARCHwas created asLDAPSearch(None, ...)when the setting was missing.Changes
AUTH_LDAP_FIND_GROUP_PERMSconfigurable via the newldap.find_group_permssetting (defaults toTruefor backward compatibility)ldap.group_searchis not set (None), all group-based features are disabled gracefully with a warning message instead of crashing:AUTH_LDAP_FIND_GROUP_PERMSset toFalseAUTH_LDAP_GROUP_SEARCHset toNone(instead ofLDAPSearch(None, ...))AUTH_LDAP_MIRROR_GROUPSset toFalseAUTH_LDAP_REQUIRE_GROUPset toNoneAUTH_LDAP_DENY_GROUPset toNoneAUTH_LDAP_USER_FLAGS_BY_GROUPset toNonegroup_searchwithfind_group_perms=True(should disable gracefully)group_searchwithfind_group_perms=True(should stay enabled)group_searchwithfind_group_perms=False(should respect explicit disable)ldap.find_group_permssetting in the LDAP configuration docsChecklist