Improper handling of groups with same RDN in ldap-group-mapper
#33,255 opened on Sep 24, 2024
Repository metrics
- Stars
- (34,398 stars)
- PR merge metrics
- (Avg merge 6d 19h) (384 merged PRs in 30d)
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
ldap
Describe the bug
When two LDAP groups have the same RDN in two different parent groups, the current tree-building algorithms mixes them up, improperly creates a group that has two parents, and crashes the whole mapping process. It seems that relying on a map to facilitate the retrieval of groups is at the core of the issue.
Version
25.0.6
Regression
- The issue is a regression
Expected behavior
Take an LDAP directory with two groups sn=c:sn=b1:dc=a and sn=c:sn=b2:dc=a. Map it to Keycloak groups. This should create a subgroup named c in b1 and another with the same name in b2.
Actual behavior
The LDAP group mapper fails and shows an error message about group c having two parents b1 and b2.
How to Reproduce?
Create an LDAP directory with two groups sn=c:sn=b1:dc=a and sn=c:sn=b2:dc=a. Configure the LDAP group mapper with Group Name LDAP Attribute = sn and the appropriate value for Membership User LDAP Attribute. Launch the LDAP-to-Keycloak group synchronization. Look at the logs when the UI shows an error message.
Anything else?
2024-09-24 21:33:16,138 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-1) Uncaught server error: org.keycloak.models.ModelException: Couldn't resolve groups from LDAP. Fix LDAP or skip preserve inheritance. Details: Group 'c' detected to have multiple parents. This is not allowed in Keycloak. Parents are: [b1, b2] at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper.syncDataFromFederationProviderToKeycloak(GroupLDAPStorageMapper.java:186) at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper.findKcGroupOrSyncFromLDAP(GroupLDAPStorageMapper.java:390) at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper$LDAPGroupMappingsUserDelegate.lambda$getLDAPGroupMappingsConverted$0(GroupLDAPStorageMapper.java:772) ...