Re: [PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Dominik Csapak <d.csapak@proxmox.com>]

i guess to use the password correctly, we then have to also
decode it as utf8 when reading from that file?

otherwise the password is different in perl when it comes from the api
vs from the file?
(otherwise this issue wouldn't have happened?)

and we probably also have then to encode it again before
passing it to ldap (except if Net::LDAP does this automatically,
which i'm not sure of)

On 7/9/26 4:00 PM, Elias Huhsovitz wrote:
> When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
> the file was written using the default byte encoding. This caused
> passwords containing non-ASCII characters (e.g., '£' or '§') to be
> truncated to their lowest byte, resulting in authentication failures
> during subsequent sync operations.
> 
> Pass the 'force_utf8' flag to file_set_contents to ensure the password
> is encoded as UTF-8 before being written to disk.
> 
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>   src/PVE/Auth/LDAP.pm | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
> index 6a73ee8..21ee047 100755
> --- a/src/PVE/Auth/LDAP.pm
> +++ b/src/PVE/Auth/LDAP.pm
> @@ -438,7 +438,7 @@ sub ldap_set_credentials {
>       my $cred_file = ldap_cred_file_name($realmid);
>       mkdir $ldap_pw_dir;
>   
> -    PVE::Tools::file_set_contents($cred_file, $password);
> +    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
>   
>       return $cred_file;
>   }