{"action":"created","issue":{"url":"https://api.github.com/repos/nuxsmin/sysPass/issues/1120","repository_url":"https://api.github.com/repos/nuxsmin/sysPass","labels_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/1120/labels{/name}","comments_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/1120/comments","events_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/1120/events","html_url":"https://github.com/nuxsmin/sysPass/issues/1120","id":383797841,"node_id":"MDU6SXNzdWUzODM3OTc4NDE=","number":1120,"title":"Yet another LDAP group issue","user":{"login":"deajan","id":4681318,"node_id":"MDQ6VXNlcjQ2ODEzMTg=","avatar_url":"https://avatars1.githubusercontent.com/u/4681318?v=4","gravatar_id":"","url":"https://api.github.com/users/deajan","html_url":"https://github.com/deajan","followers_url":"https://api.github.com/users/deajan/followers","following_url":"https://api.github.com/users/deajan/following{/other_user}","gists_url":"https://api.github.com/users/deajan/gists{/gist_id}","starred_url":"https://api.github.com/users/deajan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deajan/subscriptions","organizations_url":"https://api.github.com/users/deajan/orgs","repos_url":"https://api.github.com/users/deajan/repos","events_url":"https://api.github.com/users/deajan/events{/privacy}","received_events_url":"https://api.github.com/users/deajan/received_events","type":"User","site_admin":false},"labels":[{"id":559413518,"node_id":"MDU6TGFiZWw1NTk0MTM1MTg=","url":"https://api.github.com/repos/nuxsmin/sysPass/labels/BUG-ProposedFix","name":"BUG-ProposedFix","color":"006b75","default":false},{"id":876579744,"node_id":"MDU6TGFiZWw4NzY1Nzk3NDQ=","url":"https://api.github.com/repos/nuxsmin/sysPass/labels/v3","name":"v3","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-23T11:54:20Z","updated_at":"2018-11-26T08:38:57Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"**sysPass Version**\r\nBleeding edge 3.0\r\n\r\n**Describe the bug**\r\nUpgraded from 2.1 latest to 3.0\r\nCheck LDAP parameters (working)\r\n\r\nWhen trying to login, I get the following in event log:\r\n```\r\nUser does not belong to the group\r\nUtilisateur: CN=Some Body,OU=Utilisateurs spéciaux,OU=Utilisateurs,DC=contoso,DC=local\r\nGroupe: cn=SYS GROUPE SysPass,OU=Groupes,DC=contoso,DC=local\r\nLDAP FILTER: (&(|(samaccountname=CN=Some Body,OU=Utilisateurs\r\nspéciaux,OU=Utilisateurs,DC=contoso,DC=local)(cn=CN=Some Body,OU=Utilisateurs\r\nspéciaux,OU=Utilisateurs,DC=contoso,DC=local)(uid=CN=Some Body,OU=Utilisateurs\r\nspéciaux,OU=Utilisateurs,DC=contoso,DC=local)(userPrincipalName=CN=Some Body,OU=Utilisateurs\r\nspéciaux,OU=Utilisateurs,DC=contoso,DC=local))(|(memberOf=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local)(groupMembership=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local)(memberof:1.2.840.113556.1.4.1941:=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local)))\r\n```\r\n\r\nThe following filter cannot work since we're testing a DN against sAMAccountName, cn, uid and userPrincipalName.\r\nThe test should be using the sysPass username instead of it's DN I think.\r\n\r\nThe filter itself works (even if it gives zero results) on my Win2012 R2 test setup.\r\nSince we got the DN, a way easier filter would be to search the DN as base scope, and only keep the group filters:\r\n\r\n```\r\nUser does not belong to the group\r\nLDAP BASE SCOPE: CN=Some Body,OU=Utilisateurs spéciaux,OU=Utilisateurs,DC=contoso,DC=local\r\nLDAP FILTER: (|(memberOf=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local)(groupMembership=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local)(memberof:1.2.840.113556.1.4.1941:=cn=SYS GROUPE\r\nSysPass,OU=Groupes,DC=contoso,DC=local))\r\n```\r\n\r\nBest regards."},"comment":{"url":"https://api.github.com/repos/nuxsmin/sysPass/issues/comments/441558512","html_url":"https://github.com/nuxsmin/sysPass/issues/1120#issuecomment-441558512","issue_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/1120","id":441558512,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTU1ODUxMg==","user":{"login":"deajan","id":4681318,"node_id":"MDQ6VXNlcjQ2ODEzMTg=","avatar_url":"https://avatars1.githubusercontent.com/u/4681318?v=4","gravatar_id":"","url":"https://api.github.com/users/deajan","html_url":"https://github.com/deajan","followers_url":"https://api.github.com/users/deajan/followers","following_url":"https://api.github.com/users/deajan/following{/other_user}","gists_url":"https://api.github.com/users/deajan/gists{/gist_id}","starred_url":"https://api.github.com/users/deajan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deajan/subscriptions","organizations_url":"https://api.github.com/users/deajan/orgs","repos_url":"https://api.github.com/users/deajan/repos","events_url":"https://api.github.com/users/deajan/events{/privacy}","received_events_url":"https://api.github.com/users/deajan/received_events","type":"User","site_admin":false},"created_at":"2018-11-26T08:38:57Z","updated_at":"2018-11-26T08:38:57Z","author_association":"CONTRIBUTOR","body":"I actually wrote a small patch before posting about the filter.\r\nTwo methods are involved in my patch, getObjects and getResults, on which I added an optional searchbase which defines search behavior."}}
{"actor":{"display_login":"deajan"}}