{"action":"created","issue":{"url":"https://api.github.com/repos/metabase/metabase/issues/7635","repository_url":"https://api.github.com/repos/metabase/metabase","labels_url":"https://api.github.com/repos/metabase/metabase/issues/7635/labels{/name}","comments_url":"https://api.github.com/repos/metabase/metabase/issues/7635/comments","events_url":"https://api.github.com/repos/metabase/metabase/issues/7635/events","html_url":"https://github.com/metabase/metabase/issues/7635","id":322806620,"node_id":"MDU6SXNzdWUzMjI4MDY2MjA=","number":7635,"title":"LDAP Auth accepting old password","user":{"login":"marcusit","id":15941905,"node_id":"MDQ6VXNlcjE1OTQxOTA1","avatar_url":"https://avatars2.githubusercontent.com/u/15941905?v=4","gravatar_id":"","url":"https://api.github.com/users/marcusit","html_url":"https://github.com/marcusit","followers_url":"https://api.github.com/users/marcusit/followers","following_url":"https://api.github.com/users/marcusit/following{/other_user}","gists_url":"https://api.github.com/users/marcusit/gists{/gist_id}","starred_url":"https://api.github.com/users/marcusit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcusit/subscriptions","organizations_url":"https://api.github.com/users/marcusit/orgs","repos_url":"https://api.github.com/users/marcusit/repos","events_url":"https://api.github.com/users/marcusit/events{/privacy}","received_events_url":"https://api.github.com/users/marcusit/received_events","type":"User","site_admin":false},"labels":[{"id":172924550,"node_id":"MDU6TGFiZWwxNzI5MjQ1NTA=","url":"https://api.github.com/repos/metabase/metabase/labels/Bug","name":"Bug","color":"CC333F","default":false},{"id":454571821,"node_id":"MDU6TGFiZWw0NTQ1NzE4MjE=","url":"https://api.github.com/repos/metabase/metabase/labels/Permissions","name":"Permissions","color":"954535","default":false},{"id":276604400,"node_id":"MDU6TGFiZWwyNzY2MDQ0MDA=","url":"https://api.github.com/repos/metabase/metabase/labels/Priority/P1","name":"Priority/P1","color":"e11d21","default":false},{"id":235367056,"node_id":"MDU6TGFiZWwyMzUzNjcwNTY=","url":"https://api.github.com/repos/metabase/metabase/labels/Security","name":"Security","color":"B11623","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/metabase/metabase/milestones/58","html_url":"https://github.com/metabase/metabase/milestone/58","labels_url":"https://api.github.com/repos/metabase/metabase/milestones/58/labels","id":3194113,"node_id":"MDk6TWlsZXN0b25lMzE5NDExMw==","number":58,"title":"0.30","description":"","creator":{"login":"salsakran","id":107439,"node_id":"MDQ6VXNlcjEwNzQzOQ==","avatar_url":"https://avatars0.githubusercontent.com/u/107439?v=4","gravatar_id":"","url":"https://api.github.com/users/salsakran","html_url":"https://github.com/salsakran","followers_url":"https://api.github.com/users/salsakran/followers","following_url":"https://api.github.com/users/salsakran/following{/other_user}","gists_url":"https://api.github.com/users/salsakran/gists{/gist_id}","starred_url":"https://api.github.com/users/salsakran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salsakran/subscriptions","organizations_url":"https://api.github.com/users/salsakran/orgs","repos_url":"https://api.github.com/users/salsakran/repos","events_url":"https://api.github.com/users/salsakran/events{/privacy}","received_events_url":"https://api.github.com/users/salsakran/received_events","type":"User","site_admin":false},"open_issues":25,"closed_issues":22,"state":"open","created_at":"2018-03-16T18:40:33Z","updated_at":"2018-06-19T17:27:38Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-05-14T13:01:25Z","updated_at":"2018-06-20T19:09:55Z","closed_at":null,"author_association":"NONE","body":"**Problem:** When using LDAP authentication to Active Directory, and the user changes their password, they are still able to authenticate to Metabase with their old password.\r\n\r\n**Variables:**\r\nUser Browser: Chrome 66\r\nUser OS: Windows 10\r\nMetabase version v0.29.0\r\nMetabase hosting: Official Docker image\r\nMetabase internal database: MySQL\r\nLDAP server: Active Directory\r\n\r\n**Steps to replicate:**\r\n1. User LDAP authentication to Active Directory (Settings: [https://i.imgur.com/56RzC9f.png](url))\r\n2. Log in to Metabase with current AD credentials, then log out of Metabase.\r\n3. Change Active Directory password. If using multiple domain controllers make sure the password change has synced between all.\r\n4. Log in to Metabase using the old AD password.\r\n\r\n**Notes:**\r\nFrom looking in the Metabase config database, the table: 'core_user' appears to be storing AD password hashes. Comparing the password hash for a user that reported this issue with their password value in an older backup of the config database I saw that the password hash was the same.\r\nI tested changing my own password and after logging in a few times to Metabase with both my old and new password I saw that my password hash had been updated in the config database, and I was no longer able to log in with my old AD password.\r\n\r\nBased on this behavior I am guessing that the current authentication works as follows:\r\n_User tries to log in.\r\n  If username/password matches what is in the 'core_user' table accept the login.\r\n  Else do a LDAP lookup to validate the credentials._\r\n\r\nIf this is the case it might make more sense to always to a LDAP lookup, and only rely on the local database if the LDAP server is unavailable.\r\nBetter yet, do not store the password hash for accounts tied to LDAP authentication."},"comment":{"url":"https://api.github.com/repos/metabase/metabase/issues/comments/398863318","html_url":"https://github.com/metabase/metabase/issues/7635#issuecomment-398863318","issue_url":"https://api.github.com/repos/metabase/metabase/issues/7635","id":398863318,"node_id":"MDEyOklzc3VlQ29tbWVudDM5ODg2MzMxOA==","user":{"login":"senior","id":215910,"node_id":"MDQ6VXNlcjIxNTkxMA==","avatar_url":"https://avatars3.githubusercontent.com/u/215910?v=4","gravatar_id":"","url":"https://api.github.com/users/senior","html_url":"https://github.com/senior","followers_url":"https://api.github.com/users/senior/followers","following_url":"https://api.github.com/users/senior/following{/other_user}","gists_url":"https://api.github.com/users/senior/gists{/gist_id}","starred_url":"https://api.github.com/users/senior/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/senior/subscriptions","organizations_url":"https://api.github.com/users/senior/orgs","repos_url":"https://api.github.com/users/senior/repos","events_url":"https://api.github.com/users/senior/events{/privacy}","received_events_url":"https://api.github.com/users/senior/received_events","type":"User","site_admin":false},"created_at":"2018-06-20T19:09:55Z","updated_at":"2018-06-20T19:09:55Z","author_association":"MEMBER","body":"@marcusit I open https://github.com/metabase/metabase/pull/7913 to fix this issue. Could you test it and confirm that it fixes your issue?"}}
{"actor":{"display_login":"senior"}}