[PATCH pve-access-control] ldap: decode attribute values as UTF-8

[PATCH pve-access-control] ldap: decode attribute values as UTF-8

[Hannes Laimer]

Net::LDAP's get_value() returns octets as raw bytes as received over
the wire. Per RFC 4511 [0] LDAPString values are UTF-8 encoded, but
Perl does not know that.

PVE::Tools::encode_text() then re-encodes the bytes as UTF-8, producing
a double-encoded sequence that ends up in user.cfg for any non-ASCII
name. On read decode_text() only undoes one layer, so the GUI and CLI
render the partially-decoded middle form instead of the original text.

Decode the value as UTF-8 right after retrieval so that downstream
code operates on a proper character string and encode_text() produces
single-encoded UTF-8.

[0] https://datatracker.ietf.org/doc/html/rfc4511#section-4.1.2

Reported-by: https://forum.proxmox.com/threads/support-for-unicode-characters-in-usernames.182832/
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Auth/LDAP.pm | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 093863c..ae17878 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -3,6 +3,8 @@ package PVE::Auth::LDAP;
 use strict;
 use warnings;
 
+use Encode;
+
 use PVE::Auth::Plugin;
 use PVE::JSONSchema;
 use PVE::LDAP;
@@ -330,6 +332,11 @@ sub get_users {
         foreach my $attr (keys %$user_attributes) {
             if (my $ours = $ldap_attribute_map->{$attr}) {
                 my $value = $user_attributes->{$attr}->[0];
+                # Net::LDAP returns octets; DirectoryString-syntax attributes
+                # (sn, givenName, mail, description, ...) are UTF-8 on the
+                # wire, so mark them as such before we hand them off to the
+                # rest of the stack, which assumes character strings.
+                $value = Encode::decode('UTF-8', $value) if defined($value);
                 eval { verify_sync_attribute_value($ours, $value) };
                 if (my $err = $@) {
                     warn "skipping attribute mapping '$attr'->'$ours' for user '$username' - $err";
-- 
2.47.3

applied: [PATCH pve-access-control] ldap: decode attribute values as UTF-8

[Thomas Lamprecht]

On Fri, 17 Apr 2026 13:04:51 +0200, Hannes Laimer wrote:
> Net::LDAP's get_value() returns octets as raw bytes as received over
> the wire. Per RFC 4511 [0] LDAPString values are UTF-8 encoded, but
> Perl does not know that.
> 
> PVE::Tools::encode_text() then re-encodes the bytes as UTF-8, producing
> a double-encoded sequence that ends up in user.cfg for any non-ASCII
> name. On read decode_text() only undoes one layer, so the GUI and CLI
> render the partially-decoded middle form instead of the original text.
> 
> [...]

Applied, thanks!

[1/1] ldap: decode attribute values as UTF-8
      commit: 48197eb464e9e752c794a2618ab4d753634544c9