[pbs-devel] [PATCH proxmox 1/2] ldap: add an integration test for `check_connection`

[pbs-devel] [PATCH proxmox 1/2] ldap: add an integration test for `check_connection`

[Stefan Sterz]

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
 proxmox-ldap/tests/glauth.rs | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/proxmox-ldap/tests/glauth.rs b/proxmox-ldap/tests/glauth.rs
index 8c0480e..88875d2 100644
--- a/proxmox-ldap/tests/glauth.rs
+++ b/proxmox-ldap/tests/glauth.rs
@@ -40,6 +40,11 @@ fn authenticate(con: &Connection, user: &str, pass: &str) -> Result<(), Error> {
     proxmox_async::runtime::block_on(con.authenticate_user(user, pass))
 }
 
+fn check_connection(config: &Config) -> Result<(), Error> {
+    let connection = Connection::new(config.clone());
+    proxmox_async::runtime::block_on(connection.check_connection())
+}
+
 fn default_config() -> Config {
     Config {
         servers: vec!["localhost".into()],
@@ -164,3 +169,25 @@ fn test_search() -> Result<(), Error> {
 
     Ok(())
 }
+
+#[test]
+#[ignore]
+fn test_check_connection() -> Result<(), Error> {
+    let _glauth = GlauthServer::new("tests/assets/glauth.cfg")?;
+
+    let mut config = default_config();
+    assert!(check_connection(&config).is_ok());
+
+    config.base_dn = "dc=invalid,dc=com".into();
+    assert!(check_connection(&config).is_err());
+    config.base_dn = "dc=example,dc=com".into();
+
+    config.bind_password = Some("invalid".into());
+    assert!(check_connection(&config).is_err());
+    config.bind_password = Some("password".into());
+
+    config.bind_password = None;
+    assert!(check_connection(&config).is_err());
+
+    Ok(())
+}
-- 
2.39.2

[pbs-devel] [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection

[Stefan Sterz]

this should avoid most common size limitations. the search should also
complete quicker as fewer results need to be computed. note that this
way a configuration may be accepted, but the related sync job can
fail due to and exceeded size limit warning for some ldap servers
(such as 2.5.14+dfsg-0ubuntu0.22.04.2).

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
spend way to much time figuring this out, anyway, wanted to add some
notes here that i encountered while testing potential solutions:

* when using an anonymous bind with slapd in its default configuration
  the default size limit will also be enforced against a paged
  search. this means that while a configuration may succeed with 5
  users with an anonymous bind, it will fail with 500+ users.
* if the client specifies a size limit for the search and the server
  finds more results than specified by the search limit it will
  return only the specified amount of results. however, the result
  code will still be 4 (sizeLimitExceeded) resulting in an error. the
  same happens if the server specifies a limit and the search exceeds
  it. it also uses the the result code 4 (sizeLimitExceeded) in that
  case.
* if a streaming_search is finished before all results are retrieved,
  ldap3 will handle this as specified in the relevant rfc from what i
  can tell [1]. however, the result code will then be 88 for a user
  canceled request, which is treated as an `Err` Result in ldap3.

[1]: https://datatracker.ietf.org/doc/html/rfc2696

 proxmox-ldap/src/lib.rs | 34 +++++++++++++---------------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/proxmox-ldap/src/lib.rs b/proxmox-ldap/src/lib.rs
index c47870d..b3b5d65 100644
--- a/proxmox-ldap/src/lib.rs
+++ b/proxmox-ldap/src/lib.rs
@@ -177,30 +177,22 @@ impl Connection {
                 .await?
                 .success()
                 .context("LDAP bind failed, bind_dn or password could be incorrect")?;
+        }
 
-            let (_, _) = ldap
-                .search(
-                    &self.config.base_dn,
-                    Scope::Subtree,
-                    "(objectClass=*)",
-                    vec!["*"],
-                )
-                .await?
-                .success()
-                .context("Could not search LDAP realm, base_dn could be incorrect")?;
+        // only search base to make sure the base_dn exists while avoiding most common size limits
+        let (_, _) = ldap
+            .search(
+                &self.config.base_dn,
+                Scope::Base,
+                "(objectClass=*)",
+                vec!["*"],
+            )
+            .await?
+            .success()
+            .context("Could not search LDAP realm, base_dn could be incorrect")?;
 
+        if self.config.bind_dn.is_some() {
             let _: Result<(), _> = ldap.unbind().await; // ignore errors, search succeeded already
-        } else {
-            let (_, _) = ldap
-                .search(
-                    &self.config.base_dn,
-                    Scope::Subtree,
-                    "(objectClass=*)",
-                    vec!["*"],
-                )
-                .await?
-                .success()
-                .context("Could not search LDAP realm, base_dn could be incorrect")?;
         }
 
         Ok(())
-- 
2.39.2

Re: [pbs-devel] [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection

[Lukas Wagner]

Looks good to me! (also applies to the new integration tests)

Tested-by: Lukas Wagner <l.wagner@proxmox.com>
Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>

On 7/21/23 16:34, Stefan Sterz wrote:
> * when using an anonymous bind with slapd in its default configuration
>    the default size limit will also be enforced against a paged
>    search. this means that while a configuration may succeed with 5
>    users with an anonymous bind, it will fail with 500+ users.
> * if the client specifies a size limit for the search and the server
>    finds more results than specified by the search limit it will
>    return only the specified amount of results. however, the result
>    code will still be 4 (sizeLimitExceeded) resulting in an error. the
>    same happens if the server specifies a limit and the search exceeds
>    it. it also uses the the result code 4 (sizeLimitExceeded) in that
>    case.
> * if a streaming_search is finished before all results are retrieved,
>    ldap3 will handle this as specified in the relevant rfc from what i
>    can tell [1]. however, the result code will then be 88 for a user
>    canceled request, which is treated as an `Err` Result in ldap3.
> 
> [1]: https://datatracker.ietf.org/doc/html/rfc2696

-- 
- Lukas

[pbs-devel] applied: [PATCH proxmox 2/2] ldap: only search base of base_dn when checking connection

[Wolfgang Bumiller]

applied both patches

On Tue, Jul 25, 2023 at 10:56:28AM +0200, Lukas Wagner wrote:
> Looks good to me! (also applies to the new integration tests)
> 
> Tested-by: Lukas Wagner <l.wagner@proxmox.com>
> Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>

but forgot to include these, sorry :-S