Without bind_dn_template, any password is authenticated successfully!

[djrobstep]

When initially configuring ldapauthenticator, I accidentally left bind_dn_template out of my config. When I tested it, I noticed it was authenticating me even with incorrect passwords!

This seems very dangerous. Although this parameter is required, authentication should probably always fail rather than always succeeding (or jupyter hub should simply refuse to start if required values are missing).

This happened when I had the following config vars set: server_address, lookup_dn, user_search_base, user_attribute.

[dhirschfeld]

This sounds like a bug. I'll check if I can reproduce to confirm...

[ermakovpetr]

this is fact!
after update 1.1->1.2.2 have this problem

[ermakovpetr]

If don't set bind_dn_template - bind_dn_template=[]
and isBound don't set True
https://github.com/jupyterhub/ldapauthenticator/blob/master/ldapauthenticator/ldapauthenticator.py#L315-L335

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Lines 315 to 335 in 718eb59

	for dn in bind_dn_template:
	userdn = dn.format(username=resolved_username)
	msg = 'Status of user bind {username} with {userdn} : {isBound}'
	try:
	conn = getConnection(userdn, username, password)
	except ldap3.core.exceptions.LDAPBindError as exc:
	isBound = False
	msg += '\n{exc_type}: {exc_msg}'.format(
	exc_type=exc.__class__.__name__,
	exc_msg=exc.args[0] if exc.args else ''
	)
	else:
	isBound = conn.bind()
	msg = msg.format(
	username=username,
	userdn=userdn,
	isBound=isBound
	)
	self.log.debug(msg)
	if isBound:
	break

[ermakovpetr]

But we can take userdn from connection after search user conn.response[0]['dn']
my temporarily dirty fix :
#88
If you ok about the idea, I try to make pull-request correctly and beautifully

[AnirudhVyas]

How do we set bind_dn_template?

[dhirschfeld]

@AnirudhVyas - bind_dn_template is set in your jupyterhub_config.py file.
https://github.com/jupyterhub/ldapauthenticator#ldapauthenticatorbind_dn_template

[dhirschfeld]

I can't reproduce and I can't follow the logic how this could be the case.

isBound is initially set to False:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 298 in 718eb59

isBound = False

If bind_dn_template is empty this entire block is skipped:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 315 in 718eb59

for dn in bind_dn_template:

therefore isBound is still False here and this block is also skipped:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Line 337 in 718eb59

if isBound:

which then falls through to the else clause which blocks access:

ldapauthenticator/ldapauthenticator/ldapauthenticator.py

Lines 377 to 381 in 718eb59

	else:
	self.log.warn('Invalid password for user {username}'.format(
	username=username,
	))
	return None

[dhirschfeld]

Poking around some more, it seems that if your bind_dn_template is an empty string '' then it does indeed authenticate any password :(

[ermakovpetr]

@dhirschfeld
correctly I understand that my PR (#88) doesn't conflict your PR. and I can add functionality (get bind_dn_template from first request's response)
?

[dhirschfeld]

@ermakovpetr - yes, I think the functionality in #88 is orthogonal to that in #95