Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

LDAP/AD sync aborts entirely when two directory users share the same e-mail address

Open
  • Is something wrong?
#3,750 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
postgresql, rust
Domain
authentication, backend, databases

Research direction

Start with crates/defguard_core/src/enterprise/ldap/sync.rs at the import path around lines 1133-1169 and apply_user_modifications around line 629; compare the conflict handling in directory_sync/mod.rs:867-897. Reproduce the duplicate-mail case, then verify that the conflicting user is skipped, both users are named in the error, and the remaining sync operations continue instead of rolling back.

Written by the indexing model from the issue text.

Description

bug

Component: defguard core – enterprise/ldap/sync.rs
Version: 2.1.0 (also present on current main)

Description
user.email has a case-insensitive unique index (email_unique_idx, migration 20241204113104_case_insensitive_email). The LDAP sync only checks for username collisions before importing a user, never for e-mail collisions. If two AD accounts carry the same mail attribute (e.g. personal account + admin account, or a shared-mailbox account), User::save() hits the unique violation, the error propagates via ?, the whole transaction is rolled back and the entire sync run fails. All other pending adds/updates/deletes of that run are lost as well.

Affected code paths

  • Import: crates/defguard_core/src/enterprise/ldap/sync.rs:1133-1169 – only find_by_username is checked; user.save() at line 1169 fails on duplicate e-mail.
  • Update: apply_user_modifications, sync.rs:629 – changing a user's e-mail in AD to an address already used by another Defguard user fails the same way.
  • User::save() is a plain INSERT without ON CONFLICT (crates/defguard_common/src/db/models/user.rs:1138).

Steps to reproduce

  1. Create two AD users alice and alice-admin, both with mail = [email protected].
  2. Enable LDAP sync (AD, LDAP as authority).
  3. Trigger sync.

Actual behaviour
Sync fails with a Postgres unique-constraint error on email_unique_idx. No users from that run are imported or updated.

Expected behaviour
Same as the OIDC directory sync (directory_sync/mod.rs:867-897): detect the conflict via User::find_by_email, log an error naming both users, skip that single user and continue the sync. Ideally also surface the conflict in the sync-preview/dry-run.

Workaround
Ensure unique mail attributes in AD or exclude the conflicting account via the LDAP user search filter / sync group.

Dominant language
Rust
Stars
2.9k
Forks
121
Avg merge
1d 1h
Merged PRs (30d)
68

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DefGuard/defguard

All issues in DefGuard/defguard

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.