You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@answer.apache.org by "DanielAuerX (via GitHub)" <gi...@apache.org> on 2025/06/30 12:23:33 UTC
[PR] LDAP plugin [answer-plugins]
DanielAuerX opened a new pull request, #294:
URL: https://github.com/apache/answer-plugins/pull/294
Hi, just wanted to check if there is interest in a ldap plugin such as this.
Obviously, some things that are specific to my use case have to be changed before merged, such as the login html and the email dummy solution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5653116417
> Hi @LinkinStars, currently i see two issues:
>
> 1. login page: since one is not redirected to separately hosted login page (e.g. the case with the google connector), i am uising the ResponseWriter (wrapped in the GinContext) to provide the user with the login page. I used css specific to my use case, so currently its a plain html login page. Either we could add some default css, let the user upload his/her own css or maybe you have a completely different solution?
>
> 2. since i did not want to send user credentials with a get request, i added an additional endpoint in my implementation added to the answer core. Namely a post endpoint to the PluginAPIRouter calling ConnectorController.ConnectorRedirectDispatcher
here the related PR in answer core for 2.
https://github.com/apache/answer/pull/1612
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5740816137
regarding the bind flow:
1) positive path: an logged in user can bind his/her account to an ldap identity via the real settings-page flow. It is binding to whichever account initiated it.
<img width="1125" height="873" alt="Screenshot from 2026-09-19 11-28-23" src="https://github.com/user-attachments/assets/57e39246-d0c0-48af-a187-2d9ca8edf69b" />
2) conflict: a different logged in user binding to the same ldap identity is rejected. Proving one ldap identity cant be hijacked onto a second account
<img width="968" height="656" alt="Screenshot from 2026-09-19 11-29-42" src="https://github.com/user-attachments/assets/efcb5dd6-043b-43c3-a0a6-242965aaedba" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5652948993
A manual to test the plugin locally:
[LOCAL_TESTING.md](https://github.com/user-attachments/files/32159555/LOCAL_TESTING.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5653552868
> Hi @LinkinStars, currently i see two issues:
>
> 1. login page: since one is not redirected to separately hosted login page (e.g. the case with the google connector), i am uising the ResponseWriter (wrapped in the GinContext) to provide the user with the login page. I used css specific to my use case, so currently its a plain html login page. Either we could add some default css, let the user upload his/her own css or maybe you have a completely different solution?
>
> 2. since i did not want to send user credentials with a get request, i added an additional endpoint in my implementation added to the answer core. Namely a post endpoint to the PluginAPIRouter calling ConnectorController.ConnectorRedirectDispatcher
Problem described in 1) is addressed in [8c931fdd8a031c88b9b5207d6f7914e308cdb354](https://github.com/apache/answer-plugins/pull/294/changes/8c931fdd8a031c88b9b5207d6f7914e308cdb354)
This is how the login page would look with branding/favicon and a green primary color:
<img width="1330" height="955" alt="login_page_with_branding" src="https://github.com/user-attachments/assets/e6155f88-b4a7-4612-a20d-9bc70f4e3a46" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5717002624
regarding CSRF protection in https://github.com/apache/answer-plugins/pull/294/commits/f86e06755199f848f454f093f982ce81c3139197
case 1: correct origin
case 2: no headers
case 3: wrong origin, but a correct referer
<img width="1454" height="829" alt="Screenshot from 2026-09-17 17-23-51" src="https://github.com/user-attachments/assets/a20ac688-c00a-4ce2-a53a-f4956542a6ed" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5674085050
Hi @DanielAuerX, yes — we are still interested in supporting an LDAP connector. Thank you for picking this up again.
The POST callback change in apache/answer#1612 is the right direction: credentials must not be sent in a GET URL. The custom login page is also acceptable for now; please do not spend more time polishing its visual design yet.
Before we can merge, the two PRs need to complete the existing connector state flow:
- The LDAP form must preserve and submit the `state` generated by `/connector/login/ldap`.
- This is required for the one-time callback validation and, in particular, for the “bind LDAP account” flow from user settings.
- Please update the core change so the callback rejects a missing or invalid state, rather than treating it as a normal login.
- Please add CSRF protection appropriate for a same-site credential form.
Could you also rebase onto the current `main` branches and update the plugin module path and Answer dependency to match the repository conventions?
For the LDAP connector itself, please add tests for LDAP, LDAPS, StartTLS, private CA, failed authentication, and account binding. We also need a stable, configurable LDAP attribute for `ExternalID` (for example `entryUUID` / `objectGUID`), rather than using a mutable login name.
Once those pieces are updated, we will be happy to review the implementation in detail. Thanks again for the contribution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-6096791669
> Hi @LinkinStars, did you have a chance to look into it?
Got it. You can change the pull request's status from “Draft” to “Normal,” and we'll review it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5652884280
<img width="1358" height="905" alt="answer_ldap_plugin_configurations" src="https://github.com/user-attachments/assets/be57599d-ffc5-4f2c-b04b-d30d0cfe9020" />
<img width="535" height="526" alt="answer_ldap_plugin_login" src="https://github.com/user-attachments/assets/36949444-ae5c-405d-bf2e-959f745c9200" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5652851284
Hi @LinkinStars, are you still interested in this plugin? If yes, I would continue working on it and finish the PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5741400463
Hi @LinkinStars, I think I included all your remarks. Is there anything I should work on?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-3021556176
@DanielAuerX Thank you very much for your contribution. A related issue has been mentioned before. #19 #61
You don't have to worry about the front-end UI. When you finish the feature, we will help to improve it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5717160013
regarding the state check in https://github.com/apache/answer-plugins/pull/294/commits/476ceaa2beeda5b62d050e76a1ae194e64987f7a
the state is added to the post request as a parameter:
<img width="1330" height="198" alt="Screenshot from 2026-09-17 13-59-50" src="https://github.com/user-attachments/assets/df6da3b8-c22f-4e6f-98f0-99d865dab01d" />
the callback is rejected in case of an invalid state or no state at all
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars merged PR #294:
URL: https://github.com/apache/answer-plugins/pull/294
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-3039329856
Hi @LinkinStars, currently i see two issues:
1. login page: since one is not redirected to separately hosted login page (e.g. the case with the google connector), i am uising the ResponseWriter (wrapped in the GinContext) to provide the user with the login page. I used css specific to my use case, so currently its a plain html login page. Either we could add some default css, let the user upload his/her own css or maybe you have a completely different solution?
2. since i did not want to send user credentials with a get request, i added an additional endpoint in my implementation added to the answer core. Namely a post endpoint to the PluginAPIRouter calling ConnectorController.ConnectorLoginDispatcher
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "DanielAuerX (via GitHub)" <gi...@apache.org>.
DanielAuerX commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-5958785899
Hi @LinkinStars, did you have a chance to look into it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LDAP plugin [answer-plugins]
Posted by "LinkinStars (via GitHub)" <gi...@apache.org>.
LinkinStars commented on PR #294:
URL: https://github.com/apache/answer-plugins/pull/294#issuecomment-6311647684
Thank you for this contribution. We have merged it and will continue with integration testing and follow-up fixes for any newly discovered issues.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@answer.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org