[PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
the file was written using the default byte encoding. This caused
passwords containing non-ASCII characters (e.g., '£' or '§') to be
truncated to their lowest byte, resulting in authentication failures
during subsequent sync operations.

Pass the 'force_utf8' flag to file_set_contents to ensure the password
is encoded as UTF-8 before being written to disk.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 src/PVE/Auth/LDAP.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 6a73ee8..21ee047 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -438,7 +438,7 @@ sub ldap_set_credentials {
     my $cred_file = ldap_cred_file_name($realmid);
     mkdir $ldap_pw_dir;
 
-    PVE::Tools::file_set_contents($cred_file, $password);
+    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
 
     return $cred_file;
 }
-- 
2.47.3

Re: [PATCH access-control] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

Please disregard my previous email. I accidentally sent this patch to 
the user mailing list instead of the developer mailing list (pve-devel).

Sorry for the noise!

Best regards,
Elias Huhsovitz