Multi-value attributes (mail/groups) not handled correctly if using environment

Aperta
  • Qualcosa non va?
#700 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
apache, php
Ambito
authentication

Direzione di ricerca

Inizia in apps/user_saml/lib/UserBackend.php, nelle funzioni getAttribute*, e segui il percorso della variabile d'ambiente per gli attributi mail e gruppi mappati. Verifica come vengono gestiti gli attributi diretti dell'IdP, quindi fai in modo che il percorso della variabile d'ambiente suddivida in modo coerente i valori delimitati da punto e virgola e verifica che gli attributi con più valori vengano archiviati separatamente senza compromettere le mappature esistenti.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Steps to reproduce
  1. Configure user_saml with 'Use Environment variable'
  2. Configure an attribute mapping for mail and groups
  3. Log into your instance. If you have multiple groups and/or mail addresses, you can see in your personal information that they are not split into multiple values but treated as single values. This may even cause a crash if you are in many groups, because the database column is limited to 64 chars.
Expected behaviour

Multi-value attributes (delimited by semicolons) should be split. It works if not using the environment mechanism but connecting directly to an idp, but I want to integrate nextcloud into a federation, which requires the use of apache/mod_shib/shibd and environment variables.

Actual behaviour

Multi-value attributes are not split but treated as a single value, causing various problems.

I tracked that down to the behaviour of the getAttribute* functions in apps/user_saml/lib/UserBackend.php and I may be able to develop a workaround or clean fix, but of course this problem should be fixed in the official sources.

This bug makes the integration of Nextcloud into a Shibboleth-based federation impossible in many situations.

Server configuration

Operating system:

Ubuntu 22.04

Web server:

Apache 2.4.52

Database:

Postgresql 14

PHP version:

8.1

Nextcloud version: (see Nextcloud admin page)

25.0.3

Where did you install Nextcloud from:

?

List of activated apps:

  • activity: 2.17.0
  • admin_audit: 1.15.0
  • bruteforcesettings: 2.5.0
  • calendar: 4.2.3
  • circles: 25.0.0
  • cloud_federation_api: 1.8.0
  • comments: 1.15.0
  • contacts: 5.1.0
  • contactsinteraction: 1.6.0
  • dav: 1.24.0
  • deck: 1.8.3
  • federatedfilesharing: 1.15.0
  • federation: 1.15.0
  • files: 1.20.1
  • files_pdfviewer: 2.6.0
  • files_rightclick: 1.4.0
  • files_sharing: 1.17.0
  • files_trashbin: 1.15.0
  • files_versions: 1.18.0
  • issuetemplate: 0.7.0
  • logreader: 2.10.0
  • lookup_server_connector: 1.13.0
  • notes: 4.6.0
  • notifications: 2.13.1
  • oauth2: 1.13.0
  • password_policy: 1.15.0
  • photos: 2.0.1
  • privacy: 1.9.0
  • provisioning_api: 1.15.0
  • related_resources: 1.0.3
  • serverinfo: 1.15.0
  • settings: 1.7.0
  • sharebymail: 1.15.0
  • systemtags: 1.15.0
  • tasks: 0.14.5
  • text: 3.6.0
  • theming: 2.0.1
  • theming_customcss: 1.12.0
  • twofactor_backupcodes: 1.14.0
  • twofactor_totp: 7.0.0
  • updatenotification: 1.15.0
  • user_saml: 5.1.2
  • user_status: 1.5.0
  • viewer: 1.9.0
  • weather_status: 1.5.0
  • workflowengine: 2.7.0

Nextcloud configuration:

{
"system": {
"debug": true,
"instanceid": "REMOVED SENSITIVE VALUE",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"nc.uni-bremen.de",
"nextcloud.zfn.uni-bremen.de",
"nextcloud.uni-bremen.de",
"nextcloud.vm.uni-bremen.de"
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"dbtype": "pgsql",
"version": "25.0.3.2",
"overwrite.cli.url": "https://nc.uni-bremen.de",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"memcache.local": "\OC\Memcache\APCu",
"default_phone_region": "DE",
"filelocking.enabled": true,
"memcache.locking": "\OC\Memcache\Redis",
"memcache.distributed": "\OC\Memcache\Redis",
"redis": {
"host": "REMOVED SENSITIVE VALUE",
"port": 6379,
"timeout": 0,
"password": "REMOVED SENSITIVE VALUE"
},
"mail_smtpmode": "smtp",
"mail_smtpsecure": "tls",
"mail_sendmailmode": "smtp",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_domain": "REMOVED SENSITIVE VALUE",
"mail_smtphost": "REMOVED SENSITIVE VALUE",
"default_language": "de",
"default_locale": "de_DE",
"lookup_server": "",
"allow_user_to_change_display_name": false,
"enable_previews": true,
"maintenance": false,
"theme": "",
"loglevel": 1,
"trashbin_retention_obligation": "auto,30",
"bulkupload.enabled": false,
"app_install_overwrite": [
"issuetemplate"
]
}
}

Client configuration

Browser:

Firefox, Chrome, Chromium, ...

Operating system:

Ubuntu

Lingua principale
PHP
Stelle
106
Fork
84
Merge medio
1g 11h
PR unite (30g)
14

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/user_saml

Tutte le issue di nextcloud/user_saml

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.