MM-62930: Add validation of LDAP attribute values. (#30419)

.github/workflows/mmctl-test-template.yml

@@ -49,6 +49,7 @@ jobs:
         run: |
           cd server/build
           docker compose --ansi never run --rm start_dependencies
+          cat ../tests/custom-schema-objectID.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
           cat ../tests/custom-schema-cpa.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
           cat ../tests/test-data.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -x -D "cn=admin,dc=mm,dc=test,dc=com" -w mostest';
           docker compose --ansi never exec -T minio sh -c 'mkdir -p /data/mattermost-test';

.github/workflows/server-test-template.yml

@@ -41,6 +41,7 @@ jobs:
         run: |
           cd server/build
           docker compose --ansi never run --rm start_dependencies
+          cat ../tests/custom-schema-objectID.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
           cat ../tests/custom-schema-cpa.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
           cat ../tests/test-data.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -x -D "cn=admin,dc=mm,dc=test,dc=com" -w mostest';
           docker compose --ansi never exec -T minio sh -c 'mkdir -p /data/mattermost-test';

e2e-tests/.ci/server.prepare.sh

@@ -55,6 +55,7 @@ for SERVICE in $ENABLED_DOCKER_SERVICES; do
       continue
     fi
     mme2e_log "Configuring the $SERVICE container"
+    ${MME2E_DC_SERVER} exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true' <../../server/tests/custom-schema-objectID.ldif
     ${MME2E_DC_SERVER} exec -T -- openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true' < ../../server/tests/custom-schema-cpa.ldif
     ${MME2E_DC_SERVER} exec -T -- openldap bash -c 'ldapadd -x -D "cn=admin,dc=mm,dc=test,dc=com" -w mostest' <../../server/tests/test-data.ldif
     ;;

server/Makefile

@@ -224,6 +224,7 @@ else
 	docker compose rm start_dependencies
 	$(GO) run ./build/docker-compose-generator/main.go $(ENABLED_DOCKER_SERVICES) | docker compose -f docker-compose.makefile.yml -f /dev/stdin $(DOCKER_COMPOSE_OVERRIDE) run -T --rm start_dependencies
   ifneq (,$(findstring openldap,$(ENABLED_DOCKER_SERVICES)))
+	cat tests/custom-schema-objectID.ldif | docker compose -f docker-compose.makefile.yml $(DOCKER_COMPOSE_OVERRIDE) exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
 	cat tests/custom-schema-cpa.ldif | docker compose -f docker-compose.makefile.yml ${DOCKER_COMPOSE_OVERRIDE} exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
 	cat tests/${LDAP_DATA}-data.ldif | docker compose -f docker-compose.makefile.yml ${DOCKER_COMPOSE_OVERRIDE} exec -T openldap bash -c 'ldapadd -x -D "cn=admin,dc=mm,dc=test,dc=com" -w mostest || true';
   endif

server/i18n/en.json

@@ -8056,6 +8056,10 @@
     "id": "ent.ldap.do_login.certificate.app_error",
     "translation": "Error loading LDAP TLS Certificate file."
   },
+  {
+    "id": "ent.ldap.do_login.invalid_id",
+    "translation": "Invalid AD/LDAP Id"
+  },
   {
     "id": "ent.ldap.do_login.invalid_password.app_error",
     "translation": "Invalid Password."
@@ -8156,6 +8160,10 @@
     "id": "ent.ldap_groups.groups_search_error",
     "translation": "error retrieving ldap groups"
   },
+  {
+    "id": "ent.ldap_groups.invalid_ldap_id",
+    "translation": "Invalid AD/LDAP id"
+  },
   {
     "id": "ent.ldap_groups.members_of_group_error",
     "translation": "error retrieving members of group"

server/tests/custom-schema-objectID.ldif

@@ -0,0 +1,14 @@
+dn: cn=schema,cn=config
+changetype: modify
+add: olcAttributeTypes
+olcAttributeTypes: ( 1.2.840.113556.1.4.2 NAME 'objectGUID'
+  DESC 'AD object GUID'
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
+  SINGLE-VALUE )
+-
+add: olcObjectClasses
+olcObjectClasses: ( 1.2.840.113556.1.5.256 NAME 'activeDSObject'
+  DESC 'Active Directory Schema Object'
+  SUP top AUXILIARY
+  MAY ( objectGUID ) )

server/tests/test-data.ldif

@@ -6,6 +6,7 @@ objectclass: organizationalunit
 dn: uid=test.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Test1
@@ -24,6 +25,7 @@ multiUserReferenceCustomAttribute: uid=test.four,ou=testusers,dc=mm,dc=test,dc=c
 dn: uid=test.two,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Test2
@@ -42,6 +44,7 @@ multiUserReferenceCustomAttribute: uid=test.five,ou=testusers,dc=mm,dc=test,dc=c
 dn: uid=test.three,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Test3
@@ -60,6 +63,7 @@ multiUserReferenceCustomAttribute: uid=dev-ops.one,ou=testusers,dc=mm,dc=test,dc
 dn: uid=test.four,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Test4
@@ -78,6 +82,7 @@ multiUserReferenceCustomAttribute: uid=dev.one,ou=testusers,dc=mm,dc=test,dc=com
 dn: uid=test.five,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Test5
@@ -97,6 +102,7 @@ multiUserReferenceCustomAttribute: uid=dev.two,ou=testusers,dc=mm,dc=test,dc=com
 dn: uid=dev-ops.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Dev3
@@ -115,6 +121,7 @@ multiUserReferenceCustomAttribute: uid=dev.three,ou=testusers,dc=mm,dc=test,dc=c
 dn: uid=dev.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Dev1
@@ -133,6 +140,7 @@ multiUserReferenceCustomAttribute: uid=dev.four,ou=testusers,dc=mm,dc=test,dc=co
 dn: uid=dev.two,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Dev2
@@ -151,6 +159,7 @@ multiUserReferenceCustomAttribute: uid=exec.one,ou=testusers,dc=mm,dc=test,dc=co
 dn: uid=dev.three,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Dev3
@@ -169,6 +178,7 @@ multiUserReferenceCustomAttribute: uid=exec.two,ou=testusers,dc=mm,dc=test,dc=co
 dn: uid=dev.four,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Dev4
@@ -188,6 +198,7 @@ multiUserReferenceCustomAttribute: uid=board.one,ou=testusers,dc=mm,dc=test,dc=c
 dn: uid=exec.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Exec1
@@ -206,6 +217,7 @@ multiUserReferenceCustomAttribute: uid=board.two,ou=testusers,dc=mm,dc=test,dc=c
 dn: uid=exec.two,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Exec2
@@ -225,6 +237,7 @@ multiUserReferenceCustomAttribute: uid=board.three,ou=testusers,dc=mm,dc=test,dc
 dn: uid=board.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Board1
@@ -243,6 +256,7 @@ multiUserReferenceCustomAttribute: uid=firstloginuser.one,ou=testusers,dc=mm,dc=
 dn: uid=board.two,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Board2
@@ -261,6 +275,7 @@ multiUserReferenceCustomAttribute: uid=firstloginuser.two,ou=testusers,dc=mm,dc=
 dn: uid=board.three,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 objectclass: customInetOrgPerson
 sn: User
 cn: Board3
@@ -273,6 +288,7 @@ dateCustomAttribute: 20240218020000Z
 dn: uid=firstloginuser.one,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 sn: User
 cn: FirstLogin1
 mail: success+firstloginuser.one@simulator.amazonses.com
@@ -281,6 +297,7 @@ userPassword: Password1
 dn: uid=firstloginuser.two,ou=testusers,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: iNetOrgPerson
+objectclass: activeDSObject
 sn: User
 cn: FirstLogin2
 mail: success+firstloginuser.two@simulator.amazonses.com
@@ -291,21 +308,31 @@ changetype: add
 objectclass: organizationalunit
 
 # groupOfNames
+
+# groupOfNames with Base64 Encoded ObjectGUID
 dn: cn=outsiders,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID:: UcVUS/HonkGbqAAAAAAAAA==
 member: uid=board.three,ou=testusers,dc=mm,dc=test,dc=com
 
+# groupOfNames with Hex Separated ObjectGUID
 dn: cn=board,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID: \56\6d\95\5b\a8\9a\9c\42\a4\61\00\00\00\00\00\00
 member: uid=board.one,ou=testusers,dc=mm,dc=test,dc=com
 member: uid=board.two,ou=testusers,dc=mm,dc=test,dc=com
 member: cn=outsiders,ou=testgroups,dc=mm,dc=test,dc=com
 
+# groupOfNames with Binary Encoded ObjectGUID
 dn: cn=executive,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID:: EBYPDQ4NDAsKCQgHBgUEAwIBAA==
 member: uid=exec.one,ou=testusers,dc=mm,dc=test,dc=com
 member: uid=exec.two,ou=testusers,dc=mm,dc=test,dc=com
 member: cn=board,ou=testgroups,dc=mm,dc=test,dc=com
@@ -313,45 +340,61 @@ member: cn=board,ou=testgroups,dc=mm,dc=test,dc=com
 dn: cn=tgroup-84,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID:: YB4aM/vJn0CfhQAAAAAAAA==
 member: cn=tgroup-9,ou=testgroups,dc=mm,dc=test,dc=com
 member: uid=test.five,ou=testusers,dc=mm,dc=test,dc=com
 
 dn: cn=tgroup-9,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID:: ZA9bHYy+n0KVlgAAAAAAAA==
 member: cn=tgroup-97,ou=testgroups,dc=mm,dc=test,dc=com
 
 dn: cn=tgroup-97,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfNames
+objectclass: activeDSObject
+objectGUID:: aS77A+eDnke+7AAAAAAAAA==
 member: uid=test.four,ou=testusers,dc=mm,dc=test,dc=com
 
 # groupOfUniqueNames
 dn: cn=tgroup,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: bThfVKmRn0S5mQAAAAAAAA==
 uniqueMember: uid=test.one,ou=testusers,dc=mm,dc=test,dc=com
 
 dn: cn=ugroup,cn=tgroup,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: cEdgf5/JnkCZtQAAAAAAAA==
 uniqueMember: uid=test.two,ou=testusers,dc=mm,dc=test,dc=com
 
 dn: cn=vgroup,cn=tgroup,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: dUvgN8VXnkC9EQAAAAAAAAA==
 uniqueMember: uid=test.three,ou=testusers,dc=mm,dc=test,dc=com
 
 # Adds a group with a cycle
 dn: cn=team-one-a,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: eXyMRG3BnUCJsQAAAAAAAA==
 uniqueMember: uid=dev.four,ou=testusers,dc=mm,dc=test,dc=com
 uniqueMember: cn=developers,ou=testgroups,dc=mm,dc=test,dc=com
 
 dn: cn=team-one,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: fM8fdh6MnUGsYQAAAAAAAA==
 uniqueMember: uid=dev.one,ou=testusers,dc=mm,dc=test,dc=com
 uniqueMember: uid=dev.three,ou=testusers,dc=mm,dc=test,dc=com
 uniqueMember: cn=team-one-a,ou=testgroups,dc=mm,dc=test,dc=com
@@ -359,11 +402,15 @@ uniqueMember: cn=team-one-a,ou=testgroups,dc=mm,dc=test,dc=com
 dn: cn=team-two,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: gI9GHKjnn0G7LQAAAAAAAAA==
 uniqueMember: uid=dev.two,ou=testusers,dc=mm,dc=test,dc=com
 
 dn: cn=developers,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: hKDpuRd+nECFKwAAAAAAAA==
 uniqueMember: uid=dev-ops.one,ou=testusers,dc=mm,dc=test,dc=com
 uniqueMember: cn=team-one,ou=testgroups,dc=mm,dc=test,dc=com
 uniqueMember: cn=team-two,ou=testgroups,dc=mm,dc=test,dc=com
@@ -371,5 +418,7 @@ uniqueMember: cn=team-two,ou=testgroups,dc=mm,dc=test,dc=com
 dn: cn=firstlogingroup,ou=testgroups,dc=mm,dc=test,dc=com
 changetype: add
 objectclass: groupOfUniqueNames
+objectclass: activeDSObject
+objectGUID:: iS3dxTuwnkC2MQAAAAAAAAA==
 uniqueMember: uid=firstloginuser.one,ou=testusers,dc=mm,dc=test,dc=com
 uniqueMember: uid=firstloginuser.two,ou=testusers,dc=mm,dc=test,dc=com