Change request for org.apereo.cas.util.LdapUtils

[Pablo Vidaurri]

For this method in LdapUtils, can a property be wrapped around the  setAuthenticationControls call? I do not have permission to query for the OID "1.3.6.1.4.1.42.2.27.8.5.1" object that ldaptive request during user credential validation. I had to comment out that line for my deployment but I do not want to have to maintain this file.

private static SimpleBindAuthenticationHandler getBindAuthenticationHandler(final ConnectionFactory factory) {

val handler = new SimpleBindAuthenticationHandler(factory);
// wrap this line around a config property
handler.setAuthenticationControls(new PasswordPolicyControl());

return handler;

}

Thanks.

-psv

[Pablo Vidaurri]

To follow up, the error returned by oracle ldap is:

authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE, resultCode=INSUFFICIENT_ACCESS_RIGHTS, matchedDN=, diagnosticMessage=The request control with Object Identifier (OID) "1.3.6.1.4.1.42.2.27.8.5.1" cannot be used due to insufficient access rights, referralURLs=[], messageID=3, controls=[]]

and all logins fail. 

-psv

[Daniel Fisher]

On Fri, Jan 7, 2022 at 11:30 PM Pablo Vidaurri <psvid...@gmail.com> wrote:

For this method in LdapUtils, can a property be wrapped around the  setAuthenticationControls call? I do not have permission to query for the OID "1.3.6.1.4.1.42.2.27.8.5.1" object that ldaptive request during user credential validation. I had to comment out that line for my deployment but I do not want to have to maintain this file.

I submitted a PR for this: https://github.com/apereo/cas/pull/5338

--Daniel Fisher

 

[Pablo Vidaurri]

It looks like this issue has returned with version 6.6.8. I was on 6.3.7 when I reporting the issue, it was resolved shortly after that but I never upgraded. Now upgrading to 6.6.8 and I see issue again.

[Pablo Vidaurri]

It looks like  handler.setAuthenticationControls(new PasswordPolicyControl());

is now being called from pac4j-config LdaptiveAuthenticatorBuilder class:

    private static SimpleBindAuthenticationHandler getPooledBindAuthenticationHandler(final LdapAuthenticationProperties l) {
        final var handler = new SimpleBindAuthenticationHandler(newPooledConnectionFactory(l));
        handler.setAuthenticationControls(new PasswordPolicyControl());
        return handler;
    }

Does not look like any option to not set the controls even via ldap.type value.

[Daniel Fisher]

I’ll get a PR together for pac4j, but it won’t happen until next week.

—Daniel Fisher

On Thu, Jun 22, 2023 at 10:59 PM Pablo Vidaurri <psvid...@gmail.com> wrote:

I ended up commenting out setControls method from ldaptive's AuthenticationRequest.java source via overlay

--

--Daniel Fisher

[Pablo Vidaurri]

I ended up commenting out setControls method from ldaptive's AuthenticationRequest.java source via overlay