[PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
the file was written using the default byte encoding. This caused
passwords containing non-ASCII characters (e.g., '£' or '§') to be
truncated to their lowest byte, resulting in authentication failures
during subsequent sync operations.

Pass the 'force_utf8' flag to file_set_contents to ensure the password
is encoded as UTF-8 before being written to disk.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 src/PVE/Auth/LDAP.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 6a73ee8..21ee047 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -438,7 +438,7 @@ sub ldap_set_credentials {
     my $cred_file = ldap_cred_file_name($realmid);
     mkdir $ldap_pw_dir;
 
-    PVE::Tools::file_set_contents($cred_file, $password);
+    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
 
     return $cred_file;
 }
-- 
2.47.3

Re: [PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Shannon Sterz]

On Thu Jul 9, 2026 at 4:00 PM CEST, Elias Huhsovitz wrote:
> When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
> the file was written using the default byte encoding. This caused
> passwords containing non-ASCII characters (e.g., '£' or '§') to be
> truncated to their lowest byte, resulting in authentication failures
> during subsequent sync operations.
>
> Pass the 'force_utf8' flag to file_set_contents to ensure the password
> is encoded as UTF-8 before being written to disk.
>
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>  src/PVE/Auth/LDAP.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
> index 6a73ee8..21ee047 100755
> --- a/src/PVE/Auth/LDAP.pm
> +++ b/src/PVE/Auth/LDAP.pm
> @@ -438,7 +438,7 @@ sub ldap_set_credentials {
>      my $cred_file = ldap_cred_file_name($realmid);
>      mkdir $ldap_pw_dir;
>
> -    PVE::Tools::file_set_contents($cred_file, $password);
> +    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);

nit: this also sets the previously unspecified permissions. while this
has no impact in reality because they match the permissions that were
assigned previously already, you should document that in the commit
message. if you don't want to explicitly set the perissions pass `undef`
instead of `0600`.

>
>      return $cred_file;
>  }

Re: [PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Dominik Csapak]

i guess to use the password correctly, we then have to also
decode it as utf8 when reading from that file?

otherwise the password is different in perl when it comes from the api
vs from the file?
(otherwise this issue wouldn't have happened?)

and we probably also have then to encode it again before
passing it to ldap (except if Net::LDAP does this automatically,
which i'm not sure of)

On 7/9/26 4:00 PM, Elias Huhsovitz wrote:
> When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
> the file was written using the default byte encoding. This caused
> passwords containing non-ASCII characters (e.g., '£' or '§') to be
> truncated to their lowest byte, resulting in authentication failures
> during subsequent sync operations.
> 
> Pass the 'force_utf8' flag to file_set_contents to ensure the password
> is encoded as UTF-8 before being written to disk.
> 
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>   src/PVE/Auth/LDAP.pm | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
> index 6a73ee8..21ee047 100755
> --- a/src/PVE/Auth/LDAP.pm
> +++ b/src/PVE/Auth/LDAP.pm
> @@ -438,7 +438,7 @@ sub ldap_set_credentials {
>       my $cred_file = ldap_cred_file_name($realmid);
>       mkdir $ldap_pw_dir;
>   
> -    PVE::Tools::file_set_contents($cred_file, $password);
> +    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
>   
>       return $cred_file;
>   }

[PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
the file was written using the default byte encoding. This caused
passwords containing non-ASCII characters (e.g., '£' or '§') to be
truncated to their lowest byte, resulting in authentication failures
during subsequent sync operations.

Pass the 'force_utf8' flag to file_set_contents to ensure the password
is encoded as UTF-8 before being written to disk.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 src/PVE/Auth/LDAP.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 6a73ee8..21ee047 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -438,7 +438,7 @@ sub ldap_set_credentials {
     my $cred_file = ldap_cred_file_name($realmid);
     mkdir $ldap_pw_dir;
 
-    PVE::Tools::file_set_contents($cred_file, $password);
+    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
 
     return $cred_file;
 }
-- 
2.47.3

Re: [PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

Please disregard my previous email. I accidentally sent this patch to 
the user mailing list instead of the developer mailing list (pve-devel).

Sorry for the noise!

Best regards,
Elias Huhsovitz