keycloak/keycloak

Improper handling of groups with same RDN in ldap-group-mapper

Open

#33,255 opened on Sep 24, 2024

View on GitHub
 (14 comments) (6 reactions) (0 assignees)Java (8,346 forks)batch import
area/ldaphelp wantedkind/bugpriority/normalstatus/auto-bumpteam/core-iam

Repository metrics

Stars
 (34,398 stars)
PR merge metrics
 (Avg merge 6d 19h) (384 merged PRs in 30d)

Description

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

ldap

Describe the bug

When two LDAP groups have the same RDN in two different parent groups, the current tree-building algorithms mixes them up, improperly creates a group that has two parents, and crashes the whole mapping process. It seems that relying on a map to facilitate the retrieval of groups is at the core of the issue.

Version

25.0.6

Regression

  • The issue is a regression

Expected behavior

Take an LDAP directory with two groups sn=c:sn=b1:dc=a and sn=c:sn=b2:dc=a. Map it to Keycloak groups. This should create a subgroup named c in b1 and another with the same name in b2.

Actual behavior

The LDAP group mapper fails and shows an error message about group c having two parents b1 and b2.

How to Reproduce?

Create an LDAP directory with two groups sn=c:sn=b1:dc=a and sn=c:sn=b2:dc=a. Configure the LDAP group mapper with Group Name LDAP Attribute = sn and the appropriate value for Membership User LDAP Attribute. Launch the LDAP-to-Keycloak group synchronization. Look at the logs when the UI shows an error message.

Anything else?

2024-09-24 21:33:16,138 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-1) Uncaught server error: org.keycloak.models.ModelException: Couldn't resolve groups from LDAP. Fix LDAP or skip preserve inheritance. Details: Group 'c' detected to have multiple parents. This is not allowed in Keycloak. Parents are: [b1, b2] at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper.syncDataFromFederationProviderToKeycloak(GroupLDAPStorageMapper.java:186) at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper.findKcGroupOrSyncFromLDAP(GroupLDAPStorageMapper.java:390) at org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapper$LDAPGroupMappingsUserDelegate.lambda$getLDAPGroupMappingsConverted$0(GroupLDAPStorageMapper.java:772) ...

Contributor guide