Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

LDAP/AD sync aborts entirely when two directory users share the same e-mail address

Aperta
  • Qualcosa non va?
#3,750 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
postgresql, rust
Ambito
authentication, backend, databases

Direzione di ricerca

Start with crates/defguard_core/src/enterprise/ldap/sync.rs at the import path around lines 1133-1169 and apply_user_modifications around line 629; compare the conflict handling in directory_sync/mod.rs:867-897. Reproduce the duplicate-mail case, then verify that the conflicting user is skipped, both users are named in the error, and the remaining sync operations continue instead of rolling back.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

Component: defguard core – enterprise/ldap/sync.rs
Version: 2.1.0 (also present on current main)

Description
user.email has a case-insensitive unique index (email_unique_idx, migration 20241204113104_case_insensitive_email). The LDAP sync only checks for username collisions before importing a user, never for e-mail collisions. If two AD accounts carry the same mail attribute (e.g. personal account + admin account, or a shared-mailbox account), User::save() hits the unique violation, the error propagates via ?, the whole transaction is rolled back and the entire sync run fails. All other pending adds/updates/deletes of that run are lost as well.

Affected code paths

  • Import: crates/defguard_core/src/enterprise/ldap/sync.rs:1133-1169 – only find_by_username is checked; user.save() at line 1169 fails on duplicate e-mail.
  • Update: apply_user_modifications, sync.rs:629 – changing a user's e-mail in AD to an address already used by another Defguard user fails the same way.
  • User::save() is a plain INSERT without ON CONFLICT (crates/defguard_common/src/db/models/user.rs:1138).

Steps to reproduce

  1. Create two AD users alice and alice-admin, both with mail = [email protected].
  2. Enable LDAP sync (AD, LDAP as authority).
  3. Trigger sync.

Actual behaviour
Sync fails with a Postgres unique-constraint error on email_unique_idx. No users from that run are imported or updated.

Expected behaviour
Same as the OIDC directory sync (directory_sync/mod.rs:867-897): detect the conflict via User::find_by_email, log an error naming both users, skip that single user and continue the sync. Ideally also surface the conflict in the sync-preview/dry-run.

Workaround
Ensure unique mail attributes in AD or exclude the conflicting account via the LDAP user search filter / sync group.

Lingua principale
Rust
Stelle
2.9k
Fork
121
Merge medio
22h 6m
PR unite (30g)
64

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DefGuard/defguard

Tutte le issue di DefGuard/defguard

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.